Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is the problem: From any IP address not belonging to your mail server:

telnet 25  

mail from: <>
rcpt to: <>
This is spam.  Buy my stuff.

I'm using Postfix. I'm having a problem finding a solution to requiring SMTP-AUTH for email claiming to be from

Googling around, this guy has identified the same problem (where I cut-n-paste with some modifications) the above example from:

This link gets close to a solution but it has a side effect of requiring SMTP-AUTH for mail not from For mail not claiming to be from, I would do the usual RBL and Spam filtering.

In short, I want to reject mail to local domains ( from outside/unauthenticated clients claiming to be from local domains (

This is what I tried: I've tried both permit and reject as the default. Here is exact excerpt from my

smtpd_recipient_restrictions = reject_unauth_pipelining,
                           check_recipient_access pgsql:/etc/postfix/,
                           check_sender_access pgsql:/etc/postfix/,
                           (reject and permit both tried here)
share|improve this question
up vote 2 down vote accepted

I would try something like this:


smtpd_sender_restrictions =
    check_sender_access hash:/etc/postfix/access_table,

/etc/postfix/access_table:        REJECT You're not me!

The theory is this:

If they've authenticated already, they trigger the permit_sasl_authenticated rule and are allowed through. If they're not authenticated, it bumps along to the check_sender_access rule. If the sender domain matches "" the sender is rejected. (So unauthed + MAIL FROM "" = reject.) If it's any other domain, it continues on to the rest of your rules.

NOTE: This is untested. I would stick a warn_if_reject in front of that check_sender_access rule before trying it on a production system.

share|improve this answer
makes sense! But you didn't try it? – innaM Aug 6 '09 at 18:55
I've tried this - see the 2nd link I provided in my original question. The side effect of doing this is that mail from domains not claiming to be mydomain gets rejected also which I don't want to happen. – Kilo Aug 6 '09 at 19:03
That depends on what you further tests you list after the check_sender_access test. If you look at the way I structured it, the default is permit. So if they're not SASL auth'd and they're not rejected by check_sender_access, the connection is allowed. – Insyte Aug 6 '09 at 19:06
I updated my post to include what I tried. This gives 554 5.7.1 <>: Sender address rejected: Access denied With and without SMTP-AUTH. In my SQL table I have exactly as you have above. – Kilo Aug 6 '09 at 21:30
I found the error in my ways. I was updating smtpd_recipient_restrictions instead of smtpd_sender_restrictions. Additionally, I had the order reversed between: check_sender_access hash:/etc/postfix/access_table, permit_sasl_authenticated when it should be as you've shown: permit_sasl_authenticated, check_sender_access hash:/etc/postfix/access_table Thanks for the help!!!! – Kilo Aug 6 '09 at 21:44

On one server, where I have postfix with Dovecot with auth data in MySQL I did the following in

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.