Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My postfix configuration allows mail via several local_recipient_maps. However, delivery to "proxy:unix:passwd.byname" is specifically disabled. This normally prevents delivery to local unix users:

$ getent passwd | grep www-data
$ nc localhost 25
220 ESMTP Postfix
helo localhost
250 2.1.0 Ok
550 5.1.1 <>: Recipient address rejected: User unknown in local recipient table
rcpt to:www-data
550 5.1.1 <www-data>: Recipient address rejected: User unknown in local recipient table

However this morning I noticed an email delivered to the local www-data mail spool file. Looking within, I see that:

  • It was a message from, sent by a different host within our network, using as the smarthost
  • It remained within queue for several days while attempting retries
  • It then bounced
  • The bounce was delivered to a "www-data" mail spool file on

So my question is: why did this happen, and how do I prevent it from happening in the future?

share|improve this question
up vote 1 down vote accepted


You said

delivery to "proxy:unix:passwd.byname" is specifically disabled. This normally prevents delivery to local unix users.

So, I may assume that you remove proxy:unix:passwd.byname parts from local_recipient_maps. By default the value of this parameter is

# postconf -d local_recipient_maps
local_recipient_maps = proxy:unix:passwd.byname $alias_maps

And you change it to

# postconf local_recipient_maps
local_recipient_maps = $alias_maps


So why it reject normal mail but bounce mail still going through?

To answer it, we need to see the big picture of Postfix Architecture Overview, especially when postfix receives email

Network ->  smtpd(8)           |  ^    
                       \       v  |
Network ->  qmqpd(8)    ->  cleanup(8)  ->  incoming
            pickup(8)   <-  maildrop
Local   ->  sendmail(1) ->  postdrop(1)

Postfix only consults local_recipient_maps when it checked email received via smtpd. Why? Because the checks was performed when parameter smtpd_reject_unlisted_recipient value is 'yes' or you set reject_unlisted_recipient in smtpd_*_restrictions (notice the word smtpd in both parameter's name). See man postconf for details of parameter. This check is enabled by default. That explains why your test email rejected by postfix.

Bounce is special email in postfix architecture. It generated internally by postfix to inform the (non-)delivery status report to sender. It flows through postfix directly to cleanup, bypassing smtpd. So that's why www-data still get bounce email.


Instead of reject it, you can send it to blackhole with mailbox_transport_maps and discard service.

To do this set mailbox_transport_maps
mailbox_transport_maps = hash:/etc/postfix/wwwdata-blackhole

www-data   discard:silently

Now, whenever www-data receive an email, it will silently discarded.

share|improve this answer
Thank you! That makes a lot of sense. I switched employers and no longer have access to the server that was doing this, so I can't test it. However it sounds legit, so I'm going to accept it. – EdwardTeach Jan 3 '15 at 23:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.