Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I setup Postfix so that it will only receive emails from specific domains?

There's a specific email account on my server that I would only like to be able to receive emails relayed from txt.att.net, text.wireless.alltel.com, and mms.alltel.net. Any other emails relayed to this account should get bounced back to the sender.

share|improve this question
    
This sounds more like you want to relay those emails...not receive them? –  Greeblesnort Sep 4 '09 at 2:55
2  
BTW, don't accept-and-bounce mail. reject it instead. if there's a DSN to be sent, then that's up to the sending server to deal with, not yours. otherwise your MTA will be a back-scatter sourrce. –  cas Sep 6 '09 at 7:06

2 Answers 2

up vote 5 down vote accepted

It depends how you want to restrict it. I'm not sure whether those are the mail relays you're talking about or the sending addresses.

Sending addresses

You can use the check_sender_access directive within an appropiate smtpd_*_restrictions. It's normally best practice to apply all sender, host checks etc. within the recipient restrictions (i.e. after the client has sent 'RCPT To:' )

e.g. to allow only mail from senders @gmail.com and @hotmail.com ...

set smtpd_recipient_restrictions to the following:

smtpd_recipient_restrictions =
    check_sender_access hash:/etc/postfix/access,
    reject

Now /etc/postfix/access should be of the form:

gmail.com OK
hotmail.com OK

use postmap hash:/etc/postfix/access to create the hash table.

Relay hostname or IP

smtpd_recipient_restrictions =
    check_client_access hash:/etc/postfix/client_access,
    reject

The format of client_access is similar:

host.name.of.system.com  OK
ip.addr.of.system        OK

Reading your logs

The following is a full excerpt from my mail.log for an example message. I picked a message and got the queue id - 31AF4761F3. It will be in the headers of the mail as well as your mail log file.

$ grep 31AF4761F3 /var/log/mail.log
Sep  4 09:30:38 cutoffs postfix/smtpd[7912]: 31AF4761F3: client=russian-caravan.cloud9.net[w.x.y.z]
Sep  4 09:30:38 cutoffs postfix/cleanup[7915]: 31AF4761F3: message-id=<007B93C54F154113B36026A22D5E0106@gaby>
Sep  4 09:30:38 cutoffs postfix/qmgr[19172]: 31AF4761F3: from=<owner-postfix-users@postfix.org>, size=4225, nrcpt=1 (queue active)
Sep  4 09:30:39 cutoffs postfix/pipe[7916]: 31AF4761F3: to=<XXXX@XXXX>, relay=spamassassin, delay=1.4, delays=0.19/0.01/0/1.3, dsn=2.0.0, status=sent (delivered via spamassassin service)
Sep  4 09:30:39 cutoffs postfix/qmgr[19172]: 31AF4761F3: removed

You can see in the first line, we have client=russian-caravan.cloud9.net (which is the mail server that sends mail for the postfix mailing list) and the IP address is in brackets. You can use the hostname or the IP in the access file but remember if they have multiple mail relays or ever change their mail relays, you'll need to figure that out.

share|improve this answer
    
Thank you Phil for the concise response. What is the best way to discover the domains of the relay servers for the given messages? –  user19327 Sep 4 '09 at 5:41
    
@fatboy: Based on my understanding of what you want, the "Relay hostname or IP" method is not what you want, and you should use the "Sending Addresses" method Phil suggested first. –  womble Sep 4 '09 at 7:18
    
Womble - Maybe you can clear this up for me; if I restrict it based on the sending address, couldn't someone just spoof an email and send it to my servers (i.e. they send me a message from jim@hotmail.com even though that's not their account)? That is why I was leaning towards using the relay hostname/ip method; since these are text messaging servers relaying me an email (i.e. you texted jim@mydomain.com from your AT&T phone) I can assume that the originator is a valid account (in this case, a cell phone customer of AT&T). –  user19327 Sep 4 '09 at 7:51
    
Yes, anyone can pretty much impersonate any sender in that scenario (SPF can mitigate against this - note I said mitigate not solve - in certain circumstances. Either way, sounds like you want the mail relays. The answer as to what hostnames or IP you want is in your maillog (/var/log/mail.log or /var/log/maillog normally) I've edited the question to show some of these. –  Philip Reynolds Sep 4 '09 at 8:37

phil's answer is good except for one detail. don't use "OK" on the RHS of /etc/postfix/access or /etc/postfix/client_access. that makes your mail server a partial open relay for anyone claiming to be sending mail from @gmail.com or @hotmail.com (access) or for the particular hosts allowed in client_access. this goes beyond just allowing them to send mail to specific users on your system, it allows them to relay mail to any user on any system through yours.

instead, use "permit_auth_destination". that allows them to send to your local domains, or to any that you are configured to relay for, but NOT to any arbitary domain.

e.g.

/etc/postfix/access:

gmail.com     permit_auth_destination
hotmail.com   permit_auth_destination

/etc/postfix/client_access:

host.name.of.system.com  permit_auth_destination
ip.addr.of.system        permit_auth_destination

even if everything else is perfectly configured, using "OK" in postfix access rules is a bad habit to get into. sometimes you really need it, but by default your habit should be to use "permit_auth_destination" instead.

share|improve this answer
    
btw, one of the reasons why it's important to use permit_auth_destination instead of OK is that it avoids the risk of mistakes in some other part of your postfix config suddenly turning your mail server into an open relay. –  cas Sep 6 '09 at 7:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.