Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up postfix to allow relaying under a limited set of conditions:

  • The destination domain is one of a pre-defined list
  • The client successfully logs in

Here's the relevant bits o' config:


The problem is that it requires that BOTH restrictions be satisfied, rather than either-or. Which is to say, it only allows relaying if the client is authenticated AND the recipient domain is

Instead, I need it to allow relaying if either one of the requirements is satisfied. How do I do this without resorting to running SMTP on two separate ports with different rules?

The context is an outbound-use-only (bound to MTA on a shared web server which all site owners are allowed to relay mail to one of the "owned" domains (not server-local, though), and for which a limited set of "trusted" site owners are allowed to relay mail without restriction provided they have a valid SMTP login.

share|improve this question
up vote 3 down vote accepted

And of course I figure it out 6 minutes after posting the question.

You can put permit_sasl_authenticated in your smtpd_recipient_restrictions setting and remove the smtpd_client_restrictions altogether.


The fact that this option is not documented in has proved to be a source of not an insignificant amount of frustration in this case.

share|improve this answer
Yep. Great documentation and super useful errors in the logs make working with Postfix uber fun. – willdanceforfun Feb 23 '15 at 6:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.