Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a scenario where I need to setup postfix with no TLS, no SMTP authentication, and open relay allowing from only one remote IP address. Emails from this remote IP may have spoofed "from" address as well.

I know, dont ask about how I got to this point...

My concern is that my server will be blacklisted in the future.

What are the best practices for managing open relay server so that it will not be blacklisted??

Thanks in advance.

share|improve this question
up vote 9 down vote accepted

It's not an open relay if you are merely accepting any mail from a single IP address. (Open relays accept any mail from anywhere.)

In this case, simply add the IP address to mynetworks in your Postfix

Oh, and don't send spam.

share|improve this answer
And, if you're extra paranoid, configure netfilter to only accept connections to 25/tcp from that single IP. – EEAA Dec 27 '12 at 18:47

Don't make it an "open relay"... Just don't require authentication from that one IP address to relay. It's really not the same thing. I do this all the time for internal IP ranges (eg my internal Printer range doesn't need to authenticate, so they can send e-mail notifications without user accounts that would need to be constantly maintained).

share|improve this answer

The best practice for open relay email servers is not to have one, and blacklist any you find.

share|improve this answer

SMTP best practices and open relays are mutually exclusive.


share|improve this answer

As long as it's only one remote ip, your simplest solution would be to firewall off the traffic except for that one machine.

Something like:

-A <chain> -s <your_ip>/32 -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
-A <chain> -m tcp -p tcp --dport 25 -j DROP

Also, like others have said, you really shouldn't be running an open relay.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.