Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In an attempt to better fight spam, I've configured Postfix like this:

smtpd_client_restrictions =

    check_client_access hash:/etc/postfix/client_whitelist

smtpd_recipient_restrictions =

This config has reduced a lot of spam, and with the whitelist I was able to deal with some misconfigured but legitimate servers in order to accept them. However, I'm wondering if this particular whitelisting config will be able to do the job if some other legitimate servers found themselves blacklisted in one of these RBLs. Am I missing something?

share|improve this question
up vote 0 down vote accepted

In case an "innocent" mail server is on one of your configured RBLs and not in your whitelist, the e-mail simply is discarded.

If you want to protect yourself against that, you need to move to RBL scoring rather than direct RBL blocking. One good way to do that is with the use of policyd-weight scoring daemon. It'll be integrated into Postfix and works this way:

  1. From now on, you configure your RBLs in policyd-weight where you can assign "hit-" and "non-hit"- scores to every RBL individually (so with the negative score you can even use whitelist RBLs).

  2. Example: Score 3.5, Score 4. Minimal score needed to block: 6

  3. Now if an IP is listed in but not in, it won't be rejected because it didn't reach the required minimal score of 6.

This solution also protects you from dead RBLs. If they "die", the RBL often answers all queries with which means "listed" in order to catch your attention. But until you detect that error a lot of legitimate e-mail would be lost.

share|improve this answer

You could also try using postfix's permit_dnswl_client directive (if you are on postfix 2.8+), eg. this is one I use in my config:


I use several RBLs in my config, but some are more aggressive and list IPs from webmail providers (eg. AOL, gmail, yahoo), so the whitelist, which I define before the RBLs, lets those IPs pass through.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.