Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have postfix installed and configured so that only authenticated user can relay. If I test it with telnet this seems to work

 root@mx3:/var/log# telnet localhost smtp
 Connected to localhost.
 Escape character is '^]'.
 220 ESMTP Postfix (Debian/GNU)
 250-SIZE 10240000
 250 DSN
 250 2.1.0 Ok
 554 5.7.1 <>: Relay access denied

But I can still use mailx without authentication. Also with php's mail

echo "test" | mailx -s test

May 16 10:58:21 mx3 postfix/pickup[10232]: D9634C00B1: uid=0
from=<root> May 16 10:58:21 mx3 postfix/cleanup[10273]: D9634C00B1:
message-id=<> May 16 10:58:21 mx3
postfix/qmgr[10233]: D9634C00B1: from=<>, size=275, nrcpt=1
(queue active) May 16 10:58:22 mx3 postfix/smtp[10274]: D9634C00B1:
to=<>,[]:25, delay=0.68,
delays=0.11/0.01/0.48/0.08, dsn=2.0.0, status=sent (250 2.0.0 Ok:
queued as BCA917F9A7) May 16 10:58:22 mx3 postfix/qmgr[10233]:
D9634C00B1: removed

This is my config:

myhostname = 
mydomain =
myorigin = $mydomain
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination =, localhost, localhost.localdomain 
relayhost = 
mynetworks = [::ffff:]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_recipient_restrictions = permit_sasl_authenticated,reject_unauth_destination,check_relay_domains

Any idea how I can prevent people sending email without authenticating?

share|improve this question

1 Answer 1

up vote 6 down vote accepted

You've set your server up to require authentication when the mail is sent using SMTP. However, when you're using mailx, you're bypassing SMTP and injecting the mail directly. The same goes for the php script - it's not using SMTP, it's using the local mail agent on the local machine. Usually you do want that agent to be able to send mail, since it's the program used by e.g. cron to send information about problems occurring on the server.

As far as I know you can't require authentication from mails sent using sendmail/postdrop/mailx, but you can restrict who is allowed to use it, using authorized_submit_users. Default there is "anyone", you can replace it with a list of username or a lookup. So if you want root to be able to send mails (which is certainly recommended!), but nobody else, the line would be

 authorized_submit_users = root

There's more information at the postfix docs

share|improve this answer
Awesomeness! I added an exclude list. authorized_submit_users = !/etc/postfix/exclude, static:all. Thanks a lot Jenny! – Chris May 16 '13 at 9:57
Glad I could help! – Jenny D May 16 '13 at 9:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.