Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a postfix server configured to require username/password when sending email, however I would like to add an exception that would allow to send mail without any authentication if it is directed to a certain domain.

I can't seem find any documentation how to achieve this or if it's even possible.

My main.cf:

smtpd_banner = $myhostname ESMTP $mail_name
biff = no

append_dot_mydomain = no
readme_directory = /usr/share/doc/postfix
smtpd_tls_cert_file = /etc/ssl/certs/server.crt
smtpd_tls_key_file = /etc/ssl/private/server.key

smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

myhostname = ****.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination =
relayhost =
mynetworks = 127.0.0.0/8
recipient_delimiter = +
inet_interfaces = all
html_directory = /usr/share/doc/postfix/html
virtual_alias_domains =
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, mysql:/etc/postfix/mysql-virtual_email2email.cf
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
virtual_mailbox_base = /home/vmail
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_authenticated_header = yes
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
transport_maps = proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
virtual_create_maildirsize = yes
virtual_maildir_extended = yes
virtual_mailbox_limit_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailbox_limit_maps.cf
virtual_mailbox_limit_override = yes
virtual_maildir_limit_message = "The user you are trying to reach is over quota."
virtual_overquota_bounce = yes
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $
content_filter = amavis:[127.0.0.1]:10024
receive_override_options = no_address_mappings
message_size_limit = 1024000000
virtual_mailbox_limit = 1073741824
smtpd_milters = inet:localhost:8892
share|improve this question

2 Answers 2

up vote 1 down vote accepted

This can be done by adding a check of the recipient to your smtpd_recipient_restrictions so it would look something like the following in main.cf:

smtpd_recipient_restrictions =
  permit_mynetworks,
  check_recipient_access hash:/etc/postfix/access.recipients,
  permit_sasl_authenticated,
  reject_unauth_destination

You also need to create the file specified as the argument for the check_recipient_access rule, here that is /etc/postfix/access.recipients.
That should look like (if example.com were the recipient domain you want to allow):

example.com OK

And any time you make changes to that file you need to run the command:

postmap /etc/postfix/access.recipients
share|improve this answer
    
I've actually tried this with proxy:mysql: but it didn't work. Weirdly enough, this one does work! –  karka91 Dec 13 '12 at 20:44

I am fairly certain that this is impossible. The reason is that after the client sends a HELO/EHLO, the server will ask the client to authenticate before allowing the client to issue any other commands.

share|improve this answer
    
The SMTP protocol doesn't offer a way for the server to ask for authentication, it can only state if authentication is supported. The client is free to attempt any command supported by the server without authenticating first. –  qqx Dec 13 '12 at 20:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.