Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am servicing 2 virtual domains: , I want to enforce the following policy:

If a client connects from an IP address in $mynetworks then I want to allow only mails for which the sender address domain belongs to one of my domains.

If a client connects from any other IP address then I want to allow only mails for which the sender address domain does not belong to one of my domains.

For that have two hash access files (sender_for_local_clients and sender_for_remote_clients)

sender_for_local_clients contains OK OK

sender_for_remote_clients contains REJECT REJECT

But I dont know how to combine them in the smtpd_sender_restrictions directive. Part of the problem is that the OK actions do not automatically PERMIT, while REJECT actions do automatically REJECT, so I cant find a proper sequence of smtpd_sender_restrictions that will accomplish my above stated policy. Any ideas?

share|improve this question

You will need a restriction class for this. Reproduce the contents of $mynetworks to a CIDR map, e.g. cidr:/etc/postfix/local_clients with something like this:

# local networks local_senders

smtpd_restriction_classes = local_senders
local_Senders = check_sender_access hash:/etc/postfix/sender_for_local_clients, reject

smtpd_recipient_restrictions = 
 check_client_access cidr:/etc/postfix/local_clients
 check_sender_access hash:/etc/postfix/sender_for_remote_clients
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.