Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using CentOS with a "Parallels Plesk" installation, a default qmail configuration and want to restrict email traffic to my virtual domain (no incoming/outgoing mail from/to any external domain). How do I configure qmail/plesk to achieve this?

share|improve this question
I am not sure you are giving enough information to really answer the question. Are you strictly looking for a solution at the domain name level (which could be spoofed) or is there something common to incoming/outgoing IP's that would allow "external domains" to be detected based on IP addresses? – Tall Jeff Oct 4 '09 at 13:34
I'm looking for a solution at the domain name level – user21692 Oct 6 '09 at 8:57
up vote 2 down vote accepted

If you want to prevent your server sending outbound mail to anything but local domains, then disable relaying for all.

There will be a 'cdb' control file that your tcpserver reads when it starts qmail-smtpd and it will be setting the environment variable RELAYCLIENT for any network that is permitted to relay to non-local domains. (See tcpserver(1), particularly the -x option, and also tcprules(1) and qmail-smtpd(8) for the RELAYCLIENT environment part.)

(on my vanilla-ish qmail installation that file lives in /service/qmail-smtpd/cdb, and is built from a file /service/qmail-smtpd/tcp using the tcprules command. Remove every occurrence of RELAYCLIENT="", rebuild the cdb file, and no host will be able relay - they will only be able to send email to domains in "/var/qmail/control/rcpthosts". Double-check that only your domains are in that file, too!)

If you want to prevent other servers sending email inbound to you at all (I'm not entirely clear from your original question, or the clarification, whether you're after this bit as well), then in that same control file after all the local networks that previously had RELAYCLIENT set, put a whole new line ":deny" and everyone else will be denied access completely.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.