Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hey we use postfix as Mailsystem and the config contain virtual alias table for address verification. We also use a simple List for administrative use. The list is in /etc/postfix/virtual written as "test@domain.tld userxy"

The list and usermappings works fine but the problem is that we want protect some adresses for internal use only. So i add following lines to

smtpd_recipient_restrictions = 
      check_recipient_access hash:/etc/postfix/protected_destinations,

smtpd_restriction_classes = insiders_only 
insiders_only = check_sender_access hash:/etc/postfix/insiders, reject

The file protected_destinations contain:

test@domain.tld             insiders_only 

The file insiders contain:

domain.tld        DUNNO 

Output from postconf -n:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
inet_interfaces = all
mailbox_size_limit = 0
mailbox_transport = cyrus
message_size_limit = 0
mydestination = domain.tld,domain2.tld
myhostname = domain.tld
mynetworks = [::ffff:]/104 [::1]/128
myorigin = /etc/mailname
recipient_delimiter = +
relay_domains = domain.tld
relayhost = [x.x.x.x]
smtpd_recipient_restrictions = permit_mynetworks,        permit_sasl_authenticated,        reject_unauth_destination,   hash:/etc/postfix/access,   hash:/etc/postfix/virtual-user_access
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = smtpd
smtpd_sasl_security_options = noanonymous
virtual_alias_domains = /etc/postfix/virtual-domains
virtual_alias_maps = hash:/etc/postfix/virtual
virtual_mailbox_limit = 0

But it dosent work, i can send mail from external Address to test@domain.tld can anyone explain what i do wrong?

Here is a Logfile about a mail from extern to test@domain.tld:

Apr 19 16:57:34 serverx postfix/smtpd[15963]: 777A51762F1:[192.168.100.xy], sasl_method=LOGIN, sasl_username=userxy
Apr 19 16:57:34 serverx postfix/cleanup[15966]: 777A51762F1: message-id=<20120419145859.37090@externedomain.tld>
Apr 19 16:57:34 serverx postfix/qmgr[15959]: 777A51762F1: from=<address@externedomain.tld>, size=1720, nrcpt=2 (queue active)
Apr 19 16:57:34 serverx postfix/pipe[15972]: 777A51762F1: to=<interneruser@domain.tld>, orig_to=<test@domain.tld>, relay=cyrus, delay=0.24, delays=0.06/0.01/0/0.17, dsn=2.0.0, status=sent (delivered via cyrus service)
Apr 19 16:57:34 serverx postfix/pipe[15969]: 777A51762F1: to=<interneruser2@domain.tld>, orig_to=<test@domain.tld>, relay=cyrus, delay=0.24, delays=0.06/0/0/0.18, dsn=2.0.0, status=sent (delivered via cyrus service)
Apr 19 16:57:34 serverx postfix/qmgr[15959]: 777A51762F1: removed
share|improve this question
Please add relevant logs showing this not working, and include the full output of postconf -n in your post. – adaptr Apr 19 '12 at 9:14
What kind of log you need? When i try to send a mail from user@extern.tld to list@domain.tld then the mailserver accept the mail for deliver but he should reject this mail – kockiren Apr 19 '12 at 10:44
@kockiren: From where did you try to send the mail? and are listed in your mynetworks, which means those are trusted and mail originating from those addresses will be accepted, no matter what. Try from some not-listed address, the behaviour should change. – Janne Pikkarainen Apr 19 '12 at 10:50
Thx, i receive mails from a smarthost in the same network. How can i add a rule to check the restriction in case of both machine has the same IP Network? – kockiren Apr 19 '12 at 10:52
Put the access list BEFORE permit_mynetworks, of course. Don't forget to switch OK to DUNNO in that case! – adaptr Apr 19 '12 at 14:27

In order to restrict access to internal lists we have the follwoing:

smtpd_recipient_restrictions =

Then in the /etc/postfix/acccess map we have things like

all@          permit_mynetworks,reject
list2@        permit_mynetworks,reject

And in virtual-users_access things like

anonymous@domain     permit_mynetworks,reject
user1@domain        permit_mynetworks,reject
user2@domain        permit_mynetworks,reject
share|improve this answer
I try it but it dosent work. I can send mail from external Adress to test@domain.tld or in your example list2@domain.tld – kockiren Apr 19 '12 at 8:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.