Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Machine send email for through Postfix 2.11 but today reviewing mail.log file i noticed some Wordpress on machines and as sending email through where sender address is and Obviously they configured Wordpress to authenticate and send email to

The issue here is is responsible of sending email for but not * so the latter are not DKIM signed and obviously are not valid recipient addresses as those domains are not able to recieve email so i would like to reject clients using a from domain address which is not able to receive email like *

I've been looking at the docs but i'm unable to find a neat solution. Does anyone know how can i accomplish that?

Thanks a lot

share|improve this question

You can achieve it with parent_domain_matches_subdomains and smtpd_sender_restrictions. Add the following to your

parent_domain_matches_subdomains =
smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender_blacklists

#/etc/postfix/sender_blacklists      OK     REJECT

Ref: postfix access Readme

share|improve this answer
Clement, thanks a lot for your help but i think i need to find the way to check whether client/from address is reachable or not. I would like to avoid to manually/programatically ban all subdomains and then check that rule on sending. One solution would be to force client/from address to match the login address but i think the best shot is to only allow client/from addresses which are reachable. Do you know how can i accomplish that? Thanks again! – user846226 Mar 22 '14 at 11:17
allowing from addresses which are only reachable. Do you mean something like reject_unknown_sender_domain? – clement Mar 22 '14 at 11:21
No, sender_domain is going to be reachable as long as it has an A or CNAME RR but it doesn't mean servers unders MX RR accept email for those RR. I mean, may be reachable but MX RR may only accept email for and not * I would like to make sure domains used on client/from addresses have an MX RR accepting email. – user846226 Mar 22 '14 at 11:31
Then you have to use reject_unverified_sender – clement Mar 22 '14 at 11:37
up vote 0 down vote accepted

EDIT: Removing warn_if_rejected solved the problem. Stupid mistake!! :D

In order to avoid from/sender address spoofing i'm trying without success the following settings:

The following policies are added to the existing ones at smtpd_sender_restrictions statement:

warn_if_reject reject_unlisted_sender,
warn_if_reject reject_authenticated_sender_login_mismatch

I also added the following table in order let Postfix know when the sender login mismatches:

## Optional lookup table with the SASL login names that own sender (MAIL FROM) addresses.
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/

$ cat /etc/postfix/

query=SELECT FROM `users` AS u WHERE = '%s' AND u.enabled IS TRUE

While the previous setup seems to work fine i'm suffering a small issue which breaks it all. Right now Postfix rejects email spoofing based on the owner of the from/sender address but after passing the email to amavisd-new in order to get the content scanned, when amavisd-new injects the email back to Postfix i don't know why Postfix finally send the email. I imagine, somewhere probably in, some restrictions get overriden but i'm unable to find the bug.

Here's the mail.log where to check how it is first rejected then delivered.

Here's just in case an edit is needed

$ postconf |grep mail_version mail_version = 2.11.0

$ postconf -n

I hope someone can give some bits of help.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.