Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running Postfix 2.1.7 on Debian Squeeze.

I've setup a redirection based on a sender using sender restrictions.

/etc/postfix/sender_access:

domaintoredirect.com            REDIRECT virtual-user@this-server.com

/etc/postfix/main.cf:

smtpd_recipient_restrictions = 
    reject_non_fqdn_recipient, check_recipient_access hash:/etc/postfix/access, check_recipient_access hash:/etc/postfix/access_lindalane
    permit_mynetworks, reject_unauth_destination,
    reject_non_fqdn_sender, check_sender_access hash:/etc/postfix/sender_access,
    reject_non_fqdn_hostname, reject_invalid_helo_hostname, check_helo_access hash:/etc/postfix/helo_access,
    reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, permit

virtual_alias_domains = hash:/etc/postfix/virtual_domains
virtual_alias_maps = hash:/etc/postfix/virtual, regexp:/etc/postfix/regexp_virtual

virtual-user@this-server.com is a virtual user on this server, defined in /etc/postfix/virtual:

virtual-user@this-server.com          user

So, I send an email to the server from user@domaintoredirect.com (to user@original-address.com), and an undeliverable report gets returned to user@domaintoredirect.com:

<virtual-user@this-server.com> (expanded from <user@original-address.com>): User unknown in virtual alias table

Sending directly to virtual-user@this-server.com works perfectly.

If I change the redirected destination an email address NOT hosted on this server, it also works fine.

Is something occurring during the redirect process if the destination is on the same host that prevents the destination address from being checked against the virtual aliases?

Here's the full postconf -n if needed:

# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
disable_vrfy_command = yes
inet_interfaces = all
mailbox_command = /usr/lib/dovecot/deliver
mailbox_size_limit = 0
message_size_limit = 20480000
mydestination = internet.example.com, localhost.example.com, , localhost
myhostname = internet.example.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relay_domains = 
relayhost = 
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_data_restrictions = reject_unauth_pipelining, permit
smtpd_helo_required = yes
smtpd_recipient_restrictions = reject_non_fqdn_recipient, check_recipient_access hash:/etc/postfix/access, permit_mynetworks, reject_unauth_destination,    reject_non_fqdn_sender, check_sender_access hash:/etc/postfix/sender_access,    reject_non_fqdn_hostname, reject_invalid_helo_hostname, check_helo_access hash:/etc/postfix/helo_access,    reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, permit
smtpd_sasl_auth_enable = no
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/certs/example.com.2014.chain
smtpd_tls_key_file = /etc/ssl/private/example.com.key.insecure.pem
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
virtual_alias_domains = hash:/etc/postfix/virtual_domains
virtual_alias_maps = hash:/etc/postfix/virtual, regexp:/etc/postfix/regexp_virtual
share|improve this question
    
If you want to redirect your mail, then sender_access should be "domaintoredirect.com REDIRECT virtual-user@this-server.com" and i didnt get how "domaintoredirect.com virtual-user@this-server.com" is working –  clement Mar 5 at 6:36
    
Sorry. That was a typo in the question. I indeed have redirect, and it is working for external addresses. –  jaydisc Mar 5 at 10:55
    
Maybe you should have check_sender_access before permit_mynetworks, as if they match your mynetworks, all the other checks will be skipped. –  NickW Mar 5 at 11:00

1 Answer 1

In your smtpd_recipient_restrictions you list permit_mynetworks before check_sender_access, as restrictions which return OK short circuit the other checks, meaning that the redirect will never be evaluated for your internal clients.

share|improve this answer
    
But the check_sender_access is triggering. The message is redirected. The problem is that the REDIRECTED message is not passing through the virtual_alias_maps. –  jaydisc Mar 5 at 23:00
    
Have you considered a catch-all alias instead? –  NickW Mar 6 at 9:21
    
But a catch-all would still have to be defined in the virtual_aliases, and that's the part it's not reaching. But regardless, a catch-all is a pretty drastic, spam-attracting measure that I would not be interested in pursuing. For now, I've just redirected it to a gmail address which forwards it back. I just want to remove that additional, unnecessary hop. –  jaydisc Mar 6 at 23:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.