Enable postfix DSN for SASL authenticated users?

Question

It seems that I can turn on Delivery Status notifications for all users, or just users on the local network. Is there a way to turn DSN on for our employees only, regardless of where they are? ie. If an employee sends mail out (with SASL authentication) they get a bounce/defer/success notice, but other people sending mail to our system don't?

The man page says:

Use the smtpd_discard_ehlo_keyword_address_maps feature if you wish to allow DSN requests from trusted clients but not from random strangers

And gives the example:

/etc/postfix/main.cf:
    smtpd_discard_ehlo_keyword_address_maps = 
        cidr:/etc/postfix/esmtp_access

/etc/postfix/esmtp_access:
    # Allow DSN requests from local subnet only
    192.168.0.0/28      silent-discard
    0.0.0.0/0           silent-discard, dsn
    ::/0                silent-discard, dsn

But I don't want to base it on subnet, I want to enable DSN for either A. users who authenticate with SASL -OR- B. users who have a @ourdomain.com mailbox on the system (our employees)

Is there a way to do this?

Ubuntu 10.04/Postfix 2.7.0

Answer 1

Unfortunately, I don' think this is possible (yet).

Answer 2

Postfix does not yet support advertising DSN extension after AUTH command. There is however a workaround; in my setup Postfix listens on ports 25 (standard SMTP) and 587 (submission SMTP). SMTP servers (MTAs) use port 25, for which DSN can be disabled via master.cf by adding smtpd_discard_ehlo_keywords to its daemon:

smtp       inet  n       -       n       -       -       smtpd
    -o smtpd_discard_ehlo_keywords=silent-discard,dsn
submission inet  n       -       n       -       -       smtpd
    -o smtpd_sasl_auth_enable=yes

Please note that security-wise this solution is flawed - DSN is still widely available - unless other security measures that limit access to daemon on port 587 are taken.

Source: https://marc.info/?l=postfix-users&m=146903470927680&w=2