Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have configured Policyd v2 (cluebringer) to apply quota on msg count for SASL and non-SASL users. It is easy in policyd [1]. However I don't know how to configure postfix (2.7.1). Right now I have this (non important rules removed):

smtpd_recipient_restrictions    =
    check_policy_service inet:,

check_policy_service must be before permit_sasl_authentificated to be able to check on SASL users (because permit_sasl_authentificated returns OK and no other permissions are checked after it).

But having it here means, that it would count every incoming email attempt in quota - regardless if it will be accepted by postfix or not (because greylist/blacklist and reject_unauth_destination are after check_policy_service). So all rejected spam would count on recipient users' quota.

How is it possible to have policyd be invoked for both SASL incoming email and for non-SASL email which is accepted for server?


share|improve this question
Why cant you add all reject restrictions first, followed by check_policy_service followed by permit clauses? – clement Jul 9 '14 at 10:59
For example reject_unauth_destination (rejects all mail for which postfix is not final destination) must be after permit_sasl_authenticated otherwise SASL auth would not work. – Marki555 Jul 9 '14 at 11:49
I suggest you to upgrade postfix to version 2.10. This version has feature smtpd_relay_restriction to separate permit_sasl and check policy – masegaloeh Jul 9 '14 at 13:44

In case of Postfix version 2.10 or newer, you can try to solved those problem by using smtpd_relay_restriction feature. Snippet from postfix documentation explains how to use them properly.

Relay policy is specified under smtpd_relay_restrictions, and the spam blocking policy under smtpd_recipient_restrictions.

Then your configuration should like this

smtpd_relay_restriction = 

smtpd_recipient_restrictions =
    check_policy_service inet:
share|improve this answer
Will this call policyd before rejecting email by spamhaus? I want to avoid that. I just want to invoke policyd only for otherwise accepted emails (SASL or non-SASL), so that I can enforce quotas on them. – Marki555 Jul 16 '14 at 19:58
In that case, just reorder to smtpd_recipient_restrictions = reject_rbl_client, check_policy_service inet: ` – masegaloeh Jul 16 '14 at 20:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.