Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Machine mail.domain.com send email for domain.com through Postfix 2.11 but today reviewing mail.log file i noticed some Wordpress on machines wordpress.domain.com and blog.domain.com as sending email through mail.domain.com where sender address is user@wordpress.domain.com and user@blog.domain.com. Obviously they configured Wordpress to authenticate and send email to mail.domain.com.

The issue here is mail.domain.com is responsible of sending email for domain.com but not *.domain.com so the latter are not DKIM signed and obviously are not valid recipient addresses as those domains are not able to recieve email so i would like to reject clients using a from domain address which is not able to receive email like *.domain.com.

I've been looking at the docs http://www.postfix.org/postconf.5.html but i'm unable to find a neat solution. Does anyone know how can i accomplish that?

Thanks a lot

share|improve this question

2 Answers 2

You can achieve it with parent_domain_matches_subdomains and smtpd_sender_restrictions. Add the following to your main.cf

parent_domain_matches_subdomains =
smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender_blacklists

domain.com      OK
.domain.com     REJECT

Ref: postfix access Readme

share|improve this answer
Clement, thanks a lot for your help but i think i need to find the way to check whether client/from address is reachable or not. I would like to avoid to manually/programatically ban all subdomains and then check that rule on sending. One solution would be to force client/from address to match the login address but i think the best shot is to only allow client/from addresses which are reachable. Do you know how can i accomplish that? Thanks again! –  user846226 Mar 22 '14 at 11:17
allowing from addresses which are only reachable. Do you mean something like reject_unknown_sender_domain? –  clement Mar 22 '14 at 11:21
No, sender_domain is going to be reachable as long as it has an A or CNAME RR but it doesn't mean servers unders MX RR accept email for those RR. I mean, foo.mydomain.com may be reachable but mydomain.com MX RR may only accept email for mydomain.com and not *.mydomain.com I would like to make sure domains used on client/from addresses have an MX RR accepting email. –  user846226 Mar 22 '14 at 11:31
Then you have to use reject_unverified_sender –  clement Mar 22 '14 at 11:37
up vote 0 down vote accepted

EDIT: Removing warn_if_rejected solved the problem. Stupid mistake!! :D

In order to avoid from/sender address spoofing i'm trying without success the following settings:

The following policies are added to the existing ones at smtpd_sender_restrictions statement:

warn_if_reject reject_unlisted_sender,
warn_if_reject reject_authenticated_sender_login_mismatch

I also added the following table in order let Postfix know when the sender login mismatches:

## Optional lookup table with the SASL login names that own sender (MAIL FROM) addresses.
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql_sender_login_maps.cf

$ cat /etc/postfix/mysql_sender_login_maps.cf

query=SELECT u.email FROM `users` AS u WHERE u.email = '%s' AND u.enabled IS TRUE

While the previous setup seems to work fine i'm suffering a small issue which breaks it all. Right now Postfix rejects email spoofing based on the owner of the from/sender address but after passing the email to amavisd-new in order to get the content scanned, when amavisd-new injects the email back to Postfix i don't know why Postfix finally send the email. I imagine, somewhere probably in master.cf, some restrictions get overriden but i'm unable to find the bug.

Here's the mail.log https://gist.github.com/anonymous/2cb8736aa2baeef7dbd8 where to check how it is first rejected then delivered.

Here's master.cf just in case an edit is needed https://gist.github.com/sibok/7d10c8d267170f4deb43

$ postconf |grep mail_version mail_version = 2.11.0

$ postconf -n https://gist.github.com/sibok/b3c8208d3fae7d696e3f

I hope someone can give some bits of help.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.