Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have defined global whitelist in postfix using MYSQL with the following options:

smtpd_recipient_restrictions =
        check_client_access mysql:/etc/postfix/client_whitelist
        check_sender_access mysql:/etc/postfix/sender_whitelist
        check_recipient_access mysql:/etc/postfix/recipient_whitelist

Content of /etc/postfix/client_whitelist

host = localhost:3306
user = root
password = password
dbname = postfix
query = SELECT restriction FROM client_whitelist WHERE client = "%s" AND status = "1";

The mysql table

| client        | restriction | status |
| | OK          |      1 |
| | OK          |      1 |
| | REJECT      |      1 |

And I have the same table for sender and receivers. My main problem is that I have multiple domains behind postfix and I would like to filter the clients/senders taking into account which is the receiver. For example:

Mail from and sender "" IS ALLOW to ""

Mail from and sender "" IS NOT ALLOW to ""

Mail from IS ALLOW for recipient or domain ""

Mail from IS NOT ALLOW for recipient or domain ""

Is there any way to implement this in postfix? I have been googleing but no luck.

On the other way I was thinking to put a "postfix proxy" to redirect to another postfix instances and each instance filter each domain. But I'm not sure about the performance of this environment, even if it is possible.

share|improve this question
up vote 2 down vote accepted

This is not possible in one access check since that only provides one of the values as input (either client, sender, or recipient, based on the access check you used), but not more than one.

This is inherent in how postfix access tables work.

You can work around this by either using a policy service like postfwd (which has access to all these values at once), or by using restriction classes.

This allows you to, for example, implement a restriction class on clients and return an access check as the result, instead of OK or REJECT.

See the access man page for more details about access maps and the possible outcomes.

Note that "whitelist" is not a useful term for what you have if it includes both OK and REJECT as results.

share|improve this answer
thanks for the instructions I will take a look to restriction classes and postfwd. – magiza83 May 25 '12 at 11:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.