The postfix manpage says you can specify an action for unverified_recipient_tempfail_action. But I can't specify permit:

fatal: bad configuration: unverified_recipient_tempfail_action = permit

So my only options are reject, defer or defer_if_permit?

I use recipient address verification for my fallback MX server, which should not defer incoming mails (because if I want incoming mails to be deferred in case the primary goes down, I wouldn't have a backup MX at all, so that the messages are deferred at the incoming SMTP server).

But now, when the verify-cache has expired or the cache doesn't have an entry yet for the user in question, it will defer the request, defeating the purpose of a backup MX server.

So how do I make it so that when the primary goes down, it will accept all mail?


I should add that this mail server also acts as the incoming mail server for a web hosting server managed by Plesk (control panel). Plesk doesn't have spam filtering (except for extra cost), so I set up another virtual machine that does the incoming mail and spam filtering for that host. I use recipient address verification to avoid the mailqueue filling up with bounce mails (and to properly reject the request when the user does not exist, and not accept and bounce later, avoiding backscatter mail).

But I also want to use that incoming mail server as backup MX for certain domains (using the relay transport to avoid delivery loops). I guess for those domains, I don't need reject_unverified_recipient. Would it be enough to insert permit_mx_backup into smtpd_recipient_restrictions (before reject_unverified_recipient)?

On the other hand, I still think it makes sense to use recipient address verification during periods the primary host is not down: this avoids backscatter mail (mail bounced to (fake) senders because of spam sent to non-existing users).

In any case, for either use of the incoming mail server, it is not possible to create recipient maps. One reason is that users create e-mail addresses dynamically on the Plesk machine and the other is that the domains for which we are backup MX are not under our control, so we don't know which users there are.


Setting unverified_recipient_tempfail_action to 'permit' would functionally be identical to not performing the unverified recipient check in the first place, so you would simply want to remove reject_unverified_recipient from your smtpd_recipient_restrictions.

One option is to stop using address verification for your backup MX and instead populate your "relay_domains" and "relay_recipient_maps" so that your backup MX has a complete list of all valid addresses on your primary server. Essentially address verification is trying to do that for you dynamically, with the down side being the exact circumstance you describe. It can't know what it doesn't know, so it defers the mail. Full relay_recipient_maps eliminate this need and will deliver the functionality you are looking for.

Backup MX servers are so heavily abused and cause such headaches that I've opted for a solution external to postfix - specifically I've written lightweight daemon's that sit on my secondary MX and actively monitor the primary MX server - if it can talk to the primary MX then it makes sure port 25 is blocked on it's host firewall (thus "turning off" secondary) and only opens that port up if it detects that the primary is unavailable. I also ensure that they have the relay_recipient_maps setup on them so they are fully functional when they need to actually turn on.

  • I edited my question to add some more detail. BTW, I like your port 25 block daemon :). Too bad I can't use it because the server doesn't just backup one primary MX. – Halfgaar Jun 4 '11 at 8:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.