Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have configured my postfix so as users under my server shall send mails through port 587 and port 25 will only be used to receive mails from mail servers.

I am successful to the extent that on connecting to port 25 mails are not allowed outside the mail server and it is being rejected as relay-access denied. whereas on port 587 the clients are able to sent mail to outside mail servers.

To achieve this I have set in my

smtpd_recipient_restriction=permit_mynetworks, reject_unauth_destination

that is I removed permit_sasl_authenticated.

if I add this condition, the mails are allowed to be sent outside the network and if I am removing the condition, any one can connect to port 25 and since there is no authentication can sent any number of mails to local recipients.

what is way that I can use sasl authentication on port 25, yet prevent it from relaying mails outside my network.

setting in

    reject_non_fqdn_recipient,reject_unauth_destination,check_sender_access mysql:/etc
    reject_unknown_sender_domain,reject_unknown_recipient_domain,reject_rbl_client,reject_rbl_client,reject_rbl_client,check_recipient_access mysql:/etc/postfix/mysql-,permit

setting in

submission inet  n       -       -       -       -       smtpd
   -o syslog_name=postfix/submission
   -o smtpd_tls_security_level=encrypt
   -o smtpd_sasl_auth_enable=yes
   -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
share|improve this question

migrated from Mar 6 '13 at 9:00

This question came from our site for computer enthusiasts and power users.

So you're saying that incoming mail on port 25 works properly. Why do you believe this is a problem? That's what is supposed to happen. – Michael Hampton Mar 6 '13 at 10:07

In the you can add restrictions per port. Have a look at the bottom of the file, you will see something like this:

#submission inet n – n – – smtpd
#587 inet n - n - - smtpd

you will want to uncomment it, then add (something like this, read up on what each value does)

submission inet n – n – – smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
(here there are a lot of options you can add)

Basically, the -o means override what is found in for that port. So you can set up to accept mail how you want on port 25, then set up port 587 (submission) to only allow sasl auth or whatever.

You want to allow anyone (within reason) to send mail to you on port 25, but allow no relaying through that port. That's what reject_unauth_destination does..

share|improve this answer
That what I exactly did. submission inet n - - - - smtpd. I at the same time don't want anyone to connect to server without authentication except the mail server, if I am removing the clause "permit_sasl_authenticated" in, relay is closed, but any one can send spam becoming the sender on my own server to the local recipients. My question is while keeping the "sasl authentication on in can I still prevent relay for mails on port 25. I am modifying my question to post the actual settings of my and – Joshi Mar 6 '13 at 19:00
quote- you want to allow anyone(within reason). No within reason also I want the users to authenticate. But once I am turning on the authentication,the relay becomes open, which I don't want. – Joshi Mar 6 '13 at 22:15
You're confused about what relaying is. Relaying is accepting an email to send to another domain NOT hosted on your server. People being able to send email to your users is the entire idea of hosting a mail server, you put things like DKIM, Greylisting, Blacklists and spamassassin, to reduce the amount of "spam" you receive. – NickW Mar 7 '13 at 9:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.