Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I would like to use postfwd version 2 to limit the amount of daily mail sent by my sasl authenticated users.

I installed latest tarball: postfwd-1.35 with latest postfix from Centos 6.4

In my I have only this rule

  action=rcpt(sasl_username/500/86400/REJECT only 500 recipients per day for $$sasl_username) 

which should reject only mail with authenticated users (not mail from trusted mailservers).

My postfwd2 listens on tcp 10045 and in my postfix I have

# Restriction Classes
smtpd_restriction_classes       = postfwdcheck
postfwdcheck                    = check_policy_service inet:      = 3600


smtpd_recipient_restrictions =
        check_recipient_access  hash:/etc/postfix/access
# postfwd con rate limiting
        check_policy_service inet:
        warn_if_reject reject_non_fqdn_helo_hostname
        warn_if_reject reject_unknown_helo_hostname
        warn_if_reject reject_unknown_client
        warn_if_reject reject_unverified_sender

in /etc/postfix/policy

.   postfwdcheck

I see no rule matching entries in log and the command

postfwd2 -vv --dumpcache -f /etc/

shows the request number

[STATS] postfwd2::policy 1.35: **5** requests since 0 days, 01:05:31 hours

increasing only for manual tests done with:

 nc 10045 <request.sample

Any idea why postfwd is not engaged by postfix?

share|improve this question
If a restriction class returns an OK, it terminates there. So it's probably stopping on permit_mynetworks, or permit_sasl_authenticated. –  NickW Apr 26 '13 at 14:22
I think you might have more luck putting it in smtpd_relay_restrictions as the first entry. –  NickW Apr 26 '13 at 14:32
ehm my actual conf is: smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination shall I add an check_policy_service inet: on top? –  golemwashere Apr 26 '13 at 14:47
I don't know, if it's not a production system, I'd say yes :) but put it after permit_mynetworks. –  NickW Apr 26 '13 at 14:56

2 Answers 2

up vote 2 down vote accepted

Postfix restriction classes can return three answers, OK, REJECT or DUNNO, usually they have (OK, DUNNO) or (REJECT, DUNNO), because of the way that postfix functions. DENY and OK mean the rest of the checks are ignored, DUNNO means go on to the next check.

So, in your case, permit_mynetworks or permit_sasl_authenticated are returning OK, so it does not check further under smtpd_recipient_restrictions, though you could place it in another restriction class which will then first have to return OK, for the mail to be forwarded.

share|improve this answer
I had good luck just moving check_policy_service inet: over permit_sasl_authenticated in smtpd_recipient_restriction .... Now I have this problem , I always get an empty counter: postfwd2/policy[6968]: [RULES] rule=0, id=RULEZEROSASL, client=unknown[x.y.z.w],, sender=<>, recipient=<>, helo=<hhhh>, proto=ESMTP, state=RCPT, ignoring empty counter –  golemwashere Apr 26 '13 at 15:01
Here I'm a little less sure.. it seems like postfwd isn't catching anything with that regex. –  NickW Apr 26 '13 at 15:10
Try using the sasl_username= field by itself? Comment out the regex. –  NickW Apr 26 '13 at 15:15
do you have any example of a working regexp to match any non empty sasl user? –  golemwashere Apr 26 '13 at 15:15
BTW empty regexp : no luck and lotsa ignoring empty counter –  golemwashere Apr 26 '13 at 15:17

You should not use "smtpd_recipient_restrictions" for a "action=rcpt(...)" as it needs to know the recipient_count attribute. From the man page:

 rcpt (<item>/<max>/<time>/<action>) 
   this command works similar to the rate() command with the difference,
   that the rate counter is increased by the request's recipient_count
   attribute. to do this reliably you should call postfwd from 
   smtpd_data_restrictions or smtpd_end_of_data_restrictions. if you want
   to be sure, you could check it within the ruleset:
      # recipient count limit 3 per hour per client
      id=RCPT01 ;  protocol_state==END-OF-MESSAGE ;  client_address!=
         action=rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)

So, if you use "check_policy_service inet:" in smtpd_data_restrictions instead, it will work. Hope so.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.