How to disable local relay in postfix, for unauthenticated users?

Question

I want to prevent my php scripts from sending mails through the MTA in localhost 25, without authentication.

I have been told that the server, by default, trusts itself, and that's why I need no auth in this case. So I have to disable the 'unauthenticated local relay'. How can I achieve that in postfix?

Answer 1

Within your Postfix configuration, you can use the setting smtpd_recipient_restrictions in order to decide who should be able do use your server as a relay.

For example, in my config it looks like this:

smtpd_recipient_restrictions = 
  permit_mynetworks,
  permit_sasl_authenticated,
  reject_unauth_destination

That means that every one from my network (see also the mynetworks setting) and everyone who is authenticated can send email. Simply remove permit_mynetworks, and nobody will be able to send email without authentication anymore. Just be aware that this might break other programs that currently rely on being able to send you email without authentication, and not just your PHP application.

Answer 2

Are you sure your scripts send email over TCP connection to localhost? This is quite uncommon, local emails are usually injected into postfix maildrop queue directly.