I have set up a default smart host/relay for all external mail as follows:


relayhost = []:587

However, I want recipients with specific MX (n.b. *google.com) to be sent directly, without using the relayhost, so I did:


smtpd_recipient_restrictions =
  check_recipient_mx_access pcre:/etc/postfix/mxtransport


/google\.com$/ FILTER smtp:
/googlemail\.com$/i FILTER smtp:

This is working as it should for a single recipient. If mail is addressed to multiple recipients (using To:/Cc:/Bcc:) and some of the specified recipients satisfy the mxtransport rule and some do not, Postfix sends mail to ALL recipients ignoring the default relayhost definition. For example, if I send email to joe.doe@gmail.com, Postfix correctly sets the filter and sends mail directly without using smarthost. However, if I send mail to multiple recipients containing joe.doe@outlook.com, joe.doe@gmail.com, it would still assume I want to skip smarthost for ALL recipients.

Is it possible to have different transport per recipient when multiple recipients are specified?


No, it isn't possible, because smtpd_recipient_restrictions is evaluated while the message is being received, so only one result can apply to the entire message. Normally you'd use transport maps for this, but that can only lookup based on the recipient domain, not on the recipient domain's MX records.

  • Well, it's a pity and seems like incorrect implementation on the Postfix side. IMHO, it should apply rules in smtpd_recipient_restrictions per recipient (for cases when mail is addressed to multiple recipients), and remember the FILTER applied via check_recipient_mx_access per recipient as well. – Locojohn Nov 22 '20 at 1:14
  • I'm sure a PR would be considered. Note, however, that the primary purpose of smtpd_recipient_restrictions is to accept/reject a message, and SMTP has no way to selectively reject a single recipient from a delivery attempt -- fail one recipient, the whole SMTP delivery attempt fails. – womble Nov 29 '20 at 23:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.