I'm trying to setup a postfix server with recipient address verification, but I'm not having success. This is my relevant config (as per this)
relayhost = x.x.x.x smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination, reject_unknown_recipient_domain, reject_unverified_recipient unverified_recipient_reject_reason = Address lookup failed address_verify_negative_cache = no unverified_recipient_tempfail_action = defer
I set the host as MX record for the domain I'm testing.
The only thing I get is this:
May 4 10:36:29 marine postfix/smtpd: connect from xyz May 4 10:36:29 marine postfix/smtpd: NOQUEUE: reject: RCPT from xyz: 554 5.7.1 <email@example.com>: Relay access denied; from=<firstname.lastname@example.org> to=<email@example.com> proto=ESMTP helo=<example.nl> May 4 10:36:29 marine postfix/smtpd: disconnect from xyz
In the mean time, I learned that recipient address verification only verifies the user, not the domain. This means I still need to have the domain listed as relay domain. This is a problem.
I don't want to keep a list of domains on this server for which it can relay. What the target server will except is dynamic, so I can't keep synchronizing the domain list. I had planned to do this:
- Stop from becoming an open relay with reject_unknown_recipient_domain. Because the docs say this: "Reject the request when Postfix is not final destination for the recipient domain", I figured it would reject when the MX record is not this host, but apparently it doesn't (tested with netcat to port 25; it is an open relay).
- If that had worked, it would then have probed the relay_host for all addresses and domains that have this host as MX record. But, it doesn't.
Apparently, recipient address verification only verifies the user, not the domain.
How can I make sure postfix actually rejects mail which has an MX record pointing elsewhere?