Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I got a working postfix/dovecot configuration running with the following rule for recipients rejection:

smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject

This works as intended (authorize authenticated users or users from mynetworks, reject others). However if a user coming from mynetworks fails to authenticate he is not rejected.

Is there such a rule as reject_invalid_sasl_auth? Something that would reject the user only if he entered an invalid authentication, but would allow users without authentication.

Otherwise, is there another way than restriction rules to achieve this kind of behavior (SASL option, custom policy)?

share|improve this question
up vote 2 down vote accepted

Since you only explicitly permit SASL authenticated users, if the user is not authenticated the next restriction in line is checked - which is mynetworks, which happens to match.

So, entirely due to your rule ordering non-auth clients are allowed from your trusted networks.

Instead, consider setting it up like this:

smtpd_client_restrictions = permit_sasl_authenticated, reject
smtpd_recipient_restrictions = permit_mynetworks, reject

NOTE that when you apply this to your external port 25 smtpd listener, this will cause you to not receive internet mail, ever.

share|improve this answer
The idea you gave here seems to reject non-auth client even from the trusted network which is not what I'm looking for. I'd like that client from the trusted network be rejected only if they try and fail to authenticate, not if they don't authenticate at all. – Julien Dec 5 '11 at 15:08
There is no difference; authentication failure as a condition cannot be matched alone. – adaptr Dec 5 '11 at 15:26
OK, thanks for the info. I thought so but could not be sure. – Julien Dec 5 '11 at 15:34
I think this is not the answer the poster was asking for so I downvoted your answer. – cstamas Dec 5 '11 at 21:43
Perhaps you need to learn a bit more about postfix, then. The answer I gave is accurate, and directly related to why it is failing for him. – adaptr Dec 6 '11 at 8:29

I think the idea could be to run your MTA where you receive mail from other peers (other mail servers) on port 25. You run another smtpd process on port 587 to receive from authenticated users.

This way you can have standard rules like:

smtpd_recipient_restrictions =

in your

OTOH you configure your port 587 the following way in like:

submission inet  n       -       -       -       -       smtpd
    -o smtpd_enforce_tls=yes
    -o smtpd_sasl_auth_enable=yes
    -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject


To reply to the comment. This does two things.

First if it receives connection on port 25 it will only accept from mynetworks it will never accept mail except what can be delivered local.

Second if it receives connection on port 587 it will accept mail only from authenticated clients.

share|improve this answer
Unfortunately this won't reject clients (from mynetworks) that try to authenticate but fail. – Julien Dec 6 '11 at 15:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.