Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We want to grant some specific servers of our network to send mails without authentication. I know that check_sender_access and check_recipient_access both can test sender (MAIL FROM) or recipient (RCPT TO).

To prevent heavy usage of smtp_restriction_classes I'm looking for a way to do such a lookup at once. I.e.

# /etc/postfix/check_noauth_servers

Is there a solution or access restriction that can do such a lookup?

share|improve this question
up vote 2 down vote accepted

You seem to be asking two unrelated questions.

The first,

We want to grant some specific servers of our network to send mails without authentification.

Is easily solved by placing a check_client_access in front of permit_sasl_authenticated:

smtpd_recipient_restrictions = check_client_access hash:/etc/postfix/no-auth, permit_sasl_authenticated, reject_unauth_destination

and in /etc/postfix/no-auth:    OK
  • The second part of the question, however, seems to be talking about both sender and recipient access maps, at the same time.

This is precisely what smtpd_restriction_classes are for:

smtpd_restriction_classes = noauth
noauth = check_recipient_access hash:/etc/postfix/allowed_recipients
smtpd_recipient_restrictions = permit_sasl_authenticated, check_sender_access hash:/etc/postfix/allowed_senders, reject_unauth_destination

and in /etc/postfix/allowed_senders:  noauth  noauth

and in /etc/postfix/allowed_recipients:  OK  OK

In which order you apply the access checks is up to you.

If you need more complex rules (that combine senders and recipients in one check, for example) look into postfwd, the Postfix FireWall Daemon.

This allows complex rules a la iptables, applied as a policy server (check_policy_service); the advantage of a policy service is that it has access to all pre-DATA parameters (client, helo , sender, recipient) at once.

share|improve this answer
Yes, that's exactly, what I have so for. But there are some of that servers, that need to be restricted, so that each server can use only its own sender address and is restricted in using recipients. So I have to use a dozen restriction classes and that's the point I want to optimize/minimize (whatever) – rabudde Aug 28 '12 at 10:52
Ah, that is different. For simple sender-recipient pairing, look into postfwd - the postfix firewall daemon. – adaptr Aug 28 '12 at 11:02
Yeah! Really great. As I see (and I think so) there is no way to do this in postfix directly without usage of dozens of classes. So postfwd is exactly what I'm looking for. Extend you answer, so I can accept it. – rabudde Aug 28 '12 at 11:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.