Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

After a considerable amount of research, I have configured my postfix server to use dovecot to accept SMTPS connections over port 465 and everything works swimmingly.

Unfortunately, I forgot that, unless I listen to port 25, I'm not going to receive any e-mail from the net.

I'm hoping somebody knows off the top of their head how to open up port 25 on Postfix for anonymous users, but disallow relaying and any other bad things on that port. And to leave the port 465 the way it is.

As to my current configuration, I changed the file:

smtps      inet  n       -       n       -       -       smtpd

and the file:

# Use our SSL certificates
smtpd_tls_cert_file = .....cer
smtpd_tls_key_file = .....key
smtpd_tls_security_level = may

# Use Dovecot for SASL authentication
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination

Any help is appreciated!

share|improve this question
How much did you change in By default it allows port 25. It would be useful if you posted your complete and output of postconf -n. – James O'Gorman Jun 22 '12 at 19:44
up vote 2 down vote accepted

ADD (and do not replace) the following line to master.conf to enable 25 again

smtp      inet  n       -       n       -       -       smtpd

Relay-control is done in, so you may want to use something like that:

smtpd_client_restrictions =
    check_client_access hash:/etc/postfix/policyd_weight_client_whitelist
    check_recipient_access hash:/etc/postfix/policyd_weight_recipient_whitelist
    check_policy_service inet:

The last line is for amavis. Anyway, smtpd_client_restrictions is what you search, and here you have more precise url:

share|improve this answer
Thanks! It ends up that all I had to do was add the line to master.conf that allows Postfix to listed to SMTP. – Monkey Boson Jun 25 '12 at 20:52
The documentation you linked to suggested that the restriction "reject_unauth_destination" does exactly what I was looking for, namely "allow Postfix to be the final destination, but not a relay". – Monkey Boson Jun 25 '12 at 21:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.