Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have succesfully set up my postfix to lookup sql tables for servicing virtual domains. What I would like to do is REJECT and IMMEDIATELY DISCONNECT any client that:

1.attempts MAIL FROM: with a domain matching any of my virtual domains

AND not a local client (connection comes from my_networks).

(Legit users of my domains that want to send mail, use 587 submission service with other rules)

Point 2 is done by beginning smtpd_sender_restrictions with permit_mynetworks. Then I want to append check_sender_access = ????

I dont know what I should put in ???? to consult an sql query. I know how to do it with an access hash table.I dont want to use the hash , because the valid domains are already in SQL and anytime I add a domain, I dont want to have to update the access hash table.

The problem is that I should either REJECT the mail sender if the sql query returns any value, or OK the mail sender if the query returns no rows. I dont know how to express that pattern - action using sql.


share|improve this question

You should be able to achieve that using this:

smtpd_sender_restrictions = permit_mynetworks

This will allow any MAIL FROM only from $mynetworks or if the client is logged in and listed as the owner of the MAIL FROM via smtpd_sender_login_maps. You can then for example create a "fake" lookup-table via mysql that always returns a non-existing SASL loginname for your virtual-domains.


smtpd_sender_login_maps = proxy:mysql:/etc/postfix/

and like this

user = database_user
password = users_password
query = SELECT 'NON_EXISTING_SASL_LOGINNAME' FROM maildb.mail_users WHERE email='%s' UNION SELECT 'NON_EXISTING_SASL_LOGINNAME' FROM maildb.mail_domains WHERE CONCAT('@', domain) = '%s'

You need Postfix 2.2 or above for that, else you'll have to build this using db_name, table and select_field in You'll need to return that only for existing MAIL FROM addresses and domains else noone will be able to deliver mail to your server at all.

share|improve this answer

Maybe you want to look at . This is part of a bigger howto, building a databasecentric mailserver.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.