Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Postfix issue, (I asked this yesterday and manged to delete my own post instead of editing it sorry for that)

I use Postfix+SASL

I got these settings in

smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,check_client_access hash:/var/lib/pop-before-smtp/hosts,reject_unauth_destination

and on this server I have the domain

now if I use a SMTP tester and use the domain as sender it gets blocked as it should BUT if I use the mail server just dont accept the email it also delivers it to whatever email I tell it to deliver.

now I want it to ALWAYS ask for login and passwd when someone try to SEND an email from my server no matter if it uses a domain hosted on the mailserver or not!

as it is now you can use my server to spam other people as long as you use a domain that hosted on the mail server.

postconf -n output:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
content_filter = smtp-amavis:[]:10024

debug_peer_level = 1
debug_peer_list =
html_directory = /usr/share/doc/postfix/html
inet_interfaces = all
mailbox_size_limit = 0
mydestination = localhost
myhostname =
mynetworks =,
myorigin = /etc/mailname
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps   $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps  $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps     $mynetworks $virtual_mailbox_limit_maps $transport_maps
readme_directory = /usr/share/doc/postfix
receive_override_options = no_address_mappings
recipient_delimiter = +
relayhost =
sender_canonical_maps =
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_use_tls = yes
smtpd_banner = ESMTP  FrogSMTP powered by FrogLinux
smtpd_recipient_restrictions =   permit_mynetworks,permit_sasl_authenticated,check_client_access hash:/var/lib/pop-before-    smtp/hosts,reject_unauth_destination 
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_tls_CAfile = /etc/postfix/cacert.pem
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
transport_maps = proxy:mysql:/etc/postfix/
virtual_alias_domains =
virtual_alias_maps = proxy:mysql:/etc/postfix/,     proxy:mysql:/etc/postfix/
virtual_gid_maps = static:5000
virtual_mailbox_base = /home/vmail
virtual_mailbox_domains = proxy:mysql:/etc/postfix/
virtual_mailbox_maps = proxy:mysql:/etc/postfix/
virtual_uid_maps = static:5000
share|improve this question
Are you sure the smtp tester isn't in your $mynetworks? – NickW Mar 13 '13 at 17:49
yes i even tested to create a email act on a friend old XP pc in outlook and i could mail stright to anyone aslong as i used a domain hosted on the server mynetworks =, that all i have in mynetworks – Marf Mar 13 '13 at 18:03
Try adding this to your smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination – NickW Mar 14 '13 at 9:19
ok i did some kernel mods and had to reboot the server now it blocks like it should do not ask me why couse i cant figure out wth is going on anyhow it works now so im not gonna touch it lol :) – Marf Mar 14 '13 at 15:18
I suggest trying to figure out what made it work if you want to be someone who knows what he's doing. – gparent Mar 14 '13 at 17:49

Your smtpd_recipient_restrictions are not strict enough. If this machine is not a MX, but a MSA/MTA then you'll probably want to end with reject.

Example MSA/MTA setting:
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject

This will accept mail from authenticated users and the addresses listed in mynetworks and reject all other mail.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.