PostFix Blacklist Configuration

Question

I have setup up a basic email server using PostFix with Dovecot/IMAP. But i face some issue with the blacklist setup.

below is my postfix main.cf

smtpd_recipient_restrictions = check_sender_access mysql:/etc/postfix/blacklist.cf reject_unauth_destination

blacklist.cf

user = mailuser
password = mailuser2011
hosts = 127.0.0.1
dbname = mailserver
query = SELECT 'REJECT' FROM blacklist WHERE email='%s' AND id=( SELECT id FROM virtual_users WHERE email='%u')

My SQL table have 2 columns for the blacklist. Namely the id and the email where id is the individual user and email is the blacklisted address.

What I want to do is to retrieve the address match from the database with reference to the recipient in the mail. If I hard code the email value to something existing in the database it will be able to reject mails from the blocked user.

However, if I uses the %u(which I assume it refers to the recipient), it fails to block at all.

Answer 1

Lookup tables in Postfix are Key-Value-Lookups. That means you have a key and get a value after lookup. In your case (check_sender_access) the key is the sender; and only the sender. So your requirement of having two keys (sender and recipient) can not be done with Postfix.

The only way to solve that is by Policy Delegation, where you have multiple keys (sender, recipient, IP, hostname, helo, ...) to do your lookup.

But on the other hand it is a very bad idea to rely on the sender address, as this is the easiest thing to forge.