Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am servicing 2 virtual domains: domain1.org , domain2.org. I want to enforce the following policy:

If a client connects from an IP address in $mynetworks then I want to allow only mails for which the sender address domain belongs to one of my domains.

If a client connects from any other IP address then I want to allow only mails for which the sender address domain does not belong to one of my domains.

For that have two hash access files (sender_for_local_clients and sender_for_remote_clients)

sender_for_local_clients contains

domain1.org OK
domain2.org OK

sender_for_remote_clients contains

domain1.org REJECT
domain2.org REJECT

But I dont know how to combine them in the smtpd_sender_restrictions directive. Part of the problem is that the OK actions do not automatically PERMIT, while REJECT actions do automatically REJECT, so I cant find a proper sequence of smtpd_sender_restrictions that will accomplish my above stated policy. Any ideas?

share|improve this question

1 Answer 1

You will need a restriction class for this. Reproduce the contents of $mynetworks to a CIDR map, e.g. cidr:/etc/postfix/local_clients with something like this:

# local networks local_senders

smtpd_restriction_classes = local_senders
local_Senders = check_sender_access hash:/etc/postfix/sender_for_local_clients, reject

smtpd_recipient_restrictions = 
 check_client_access cidr:/etc/postfix/local_clients
 check_sender_access hash:/etc/postfix/sender_for_remote_clients
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.