Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I stop Postfix from accepting mail to local-users @ my-FQDN from the outside world?

$ hostname -f

Postfix is accepting mail to any-local-user at my-FQDN. So we'll use as the example local user I want to stop receiving mail for from the outside world.

I have a pretty basic Postfix/Dovecot/SASL/LDA setup, but let me share some of the details.

  • Receive mail for virtual local domains/users on :25
  • Virtual users send mail on :587 authenticated via Dovecot SASL

I've tried reversing users in /etc/aliases and Postfix's, but no luck. I've run newaliases and postmap after updating them.



I think I have FOUR* (updated) choices left...

  1. In postfix/, mess with mydestination. I'm pretty sure I need to keep my FQDN here, so I don't think removing it is a good option. EDIT: Yes, although removing your FQDN from mydestination disables the outside world from sending mail to local users, this is not the proper way to disable it because that hoses other things.
  2. In postfix/, is there a setting for smtpd_recipient_restrictions to disable this? I can't find one in the docs.
  3. Hope that someone reads this who knows the right way.

Here is the relevant part of my Postfix

myhostname =
mydomain =
mydestination = $myhostname, localhost.$mydomain, localhost

smtpd_recipient_restrictions =

Here is the relevant part of my Postfix

submission inet n       -       -       -       -       smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_recipient_restrictions=

P.S. Here is the HowTo I took a lot of my setup from: VirtualUserFlatFilesPostfix

share|improve this question
up vote 0 down vote accepted

You mention smtp_recipient_restrictions, have you actually tried adding the line check_recipient_access hash:/etc/postfix/recipient_access?

Place it as the first line before reject_unknown_recipient_domain, then in /etc/postfix/recipient_access add the line: REJECT

(don't forget to postmap /etc/postfix/recipient_access)

BTW, the postmaster address should always be available, but I have never seen an RFC that said that root had to be available, although I haven't read every single RFC that relates to SMTP.

share|improve this answer
I have no doubt that this will work, but there's something else fundamentally wrong with my setup. – Jeff Jul 8 '13 at 15:25
What would that be exactly? You don't want to accept mail ? – NickW Jul 8 '13 at 15:29
I think the problem is my smtpd_recipient_restrictions=...,permit in my My understanding of postmaster is that RFC wants it to be available at the localdomain level, not my.fqdn. I could be wrong about that, however. To answer your question, I don't want to receive any mail at my.fqdn. – Jeff Jul 8 '13 at 15:44
Your postmaster address should be available on all domains, as it is the contact for malfunctions/problems, etc. This is one of the RFCs listing the ones that should be available : – NickW Jul 8 '13 at 15:48
RFC 822 lists more info, but this should be of more interest to you: This standard specifies a single, reserved mailbox address (local-part) which is to be valid at each site. the local-part means to the left of the @ – NickW Jul 8 '13 at 15:51

Just remove $myhostname from mydestination and restart postfix

share|improve this answer
thanks, I m not the OP but had the same question, and i m sure your answer, even if short, is the best one ! – neofutur Oct 26 '14 at 19:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.