Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm new to the world of mail server's and have been working on setting up my own via Postfix on Ubuntu 11.10. So far, I have SASL authentication working over TLS so that's good; I'm worrying about security now.

In short: I want Postfix to accept all unauthenticated incoming mail, but only allow authenticated outgoing mail. This also makes me wonder if I have STARTTLS and TLS support on ports 465 and 587, do I still need to listen on port 25? Will mail servers try to deliver mail on port 587 if 25 is closed?

But back to the allow unauthenticated incoming, but only authenticated outgoing, I tried adding

-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject

to the smtp line in my file, but then that blocks unauthenticated incoming mail. Is there a way to only allow incoming on port 25, and leave ports 465/587 for outgoing only?

I'm not sure what good it would do, but I can post the rest of my config if necessary. Any help is greatly appreciated since I'm new to all this and it's still confusing. Thank you!

share|improve this question
up vote 3 down vote accepted

As you have understood that to apply options in to override options in on a per-port basis.

To achieve your goal you want to place the restriction as smtpd_recipient_restrictions rather than smtpd_client_restrictions. The key is to reject_unauth_destination instead of just reject:

mydestination =, 
smtpd_recipient_restrictions = permit_sasl_authenticated,reject_unauth_destination

This prevents an unauthenticated client from sending to any domain you're not responsible for. In this context domains you're responsible for are more than just mydestination. See reject_unauth_destination in the manual.

share|improve this answer
Perfect. Thank you! – shanet Mar 4 '12 at 20:46

I have been looking for hours to solve this and your answer is spot-on Couling.

For more information, this also works when using Plesk/CentOS (my situation). Especially when using Plesk the value permit_mynetworks is also added to the smtpd_recipient_restrictions variable by default, allowing all Plesk domains to send SMTP mail out without authentication.


Also added to for security reasons (for anyone interested;

smtpd_client_connection_count_limit = 20
smtpd_sasl_authenticated_header = yes
maximal_queue_lifetime = 1d
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.