Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to setup my Postfix following way:

  1. Allow to send email only by authenticated users on any email address (authentication is working now)
  2. Allow to receive messages only to the limited number of users (preferrably specified in /etc/postfix/virtual, but I can add any other required file)

Actually I have only following restrictions in main.cf:

relayhost =
relay_domains = $mydestination
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination,permit
smtpd_sender_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_non_fqdn_sender,reject_unknown_sender_domain,permit

virtual_alias_maps = hash:/etc/postfix/virtual

alias_database = hash:/etc/postfix/aliases, hash:/etc/aliases

Content of /etc/postfix/virtual file aimed to collect all mail from specified virtual user to existing local one:

admin@mysite.com      postfix
feedback@mysite.com   postfix
abuse@mysite.com      postfix
webmaster@mysite.com  postfix

As I understand smtpd_recipient_restrictions value reject_unauth_destination should be enough, but when I turn it on I cannot send emails to any external system - postfix says Relay access denied. I cannot get how to fix it.

UPD: Finally I placed 'paranoid-style' record:

smtpd_recipient_restrictions =
        permit_sasl_authenticated,
        permit_mynetworks,
#       permit,
        reject_unauth_destination,
        reject
share|improve this question

2 Answers 2

up vote 1 down vote accepted

When you added reject_unauth_destination to smtpd_recipient_restrictions, did you remember/know that Postfix evaluates those values from left to right? If you put it

smtpd_recipient_restrictions = reject_unauth_destination,permit_sasl_authenticated...

it will reject everything.

Put it last on the list, it should work.

share|improve this answer
    
Nope, it still not working: I can send email from address "spam@spam.com" to any external address. I would not to be open for spammers. –  Alex G.P. Jul 31 '13 at 6:25
    
Are you trying this from your localhost? permit_mynetworks makes everything allowed from your server itself, but if you try from some external address not contained in the allowed networks, it should fail as expected. –  Janne Pikkarainen Jul 31 '13 at 6:32
    
"it will reject everything." - you are wrong. postfix will receive mail for domains matches $mydestination, $inet_interfaces, $proxy_interfaces, $virtual_alias_domains or $virtual_mailbox_domains –  ALex_hha Jul 31 '13 at 7:20
    
@JannePikkarainen brilliant! I did not know about permit_mynetworks finally I removed this record also. –  Alex G.P. Jul 31 '13 at 7:34
smtpd_recipient_restrictions =
        permit_sasl_authenticated,
#       permit_mynetworks,
#       permit,
        reject_unauth_destination,
        reject

It wouldn't work. Other mail servers will be unable send mail to you. You must at least add permit_auth_destination. I think the best solution would be the following

mynetworks = 127.0.0.0/8
smtpd_recipient_restrictions =
   permit_mynetworks,            
   permit_sasl_authenticated,
   permit_auth_destination,
   reject
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.