1

I would like to setup my Postfix following way:

  1. Allow to send email only by authenticated users on any email address (authentication is working now)
  2. Allow to receive messages only to the limited number of users (preferrably specified in /etc/postfix/virtual, but I can add any other required file)

Actually I have only following restrictions in main.cf:

relayhost =
relay_domains = $mydestination
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination,permit
smtpd_sender_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_non_fqdn_sender,reject_unknown_sender_domain,permit

virtual_alias_maps = hash:/etc/postfix/virtual

alias_database = hash:/etc/postfix/aliases, hash:/etc/aliases

Content of /etc/postfix/virtual file aimed to collect all mail from specified virtual user to existing local one:

admin@mysite.com      postfix
feedback@mysite.com   postfix
abuse@mysite.com      postfix
webmaster@mysite.com  postfix

As I understand smtpd_recipient_restrictions value reject_unauth_destination should be enough, but when I turn it on I cannot send emails to any external system - postfix says Relay access denied. I cannot get how to fix it.

UPD: Finally I placed 'paranoid-style' record:

smtpd_recipient_restrictions =
        permit_sasl_authenticated,
        permit_mynetworks,
#       permit,
        reject_unauth_destination,
        reject
Improve this question

2 Answers 2

Reset to default
1

When you added reject_unauth_destination to smtpd_recipient_restrictions, did you remember/know that Postfix evaluates those values from left to right? If you put it

smtpd_recipient_restrictions = reject_unauth_destination,permit_sasl_authenticated...

it will reject everything.

Put it last on the list, it should work.

Improve this answer
4
  • Nope, it still not working: I can send email from address "spam@spam.com" to any external address. I would not to be open for spammers.
    – Alex G.P.
    Jul 31, 2013 at 6:25
  • Are you trying this from your localhost? permit_mynetworks makes everything allowed from your server itself, but if you try from some external address not contained in the allowed networks, it should fail as expected.
    – Janne Pikkarainen
    Jul 31, 2013 at 6:32
  • "it will reject everything." - you are wrong. postfix will receive mail for domains matches $mydestination, $inet_interfaces, $proxy_interfaces, $virtual_alias_domains or $virtual_mailbox_domains
    – ALex_hha
    Jul 31, 2013 at 7:20
  • @JannePikkarainen brilliant! I did not know about permit_mynetworks finally I removed this record also.
    – Alex G.P.
    Jul 31, 2013 at 7:34
0 
smtpd_recipient_restrictions =
        permit_sasl_authenticated,
#       permit_mynetworks,
#       permit,
        reject_unauth_destination,
        reject

It wouldn't work. Other mail servers will be unable send mail to you. You must at least add permit_auth_destination. I think the best solution would be the following

mynetworks = 127.0.0.0/8
smtpd_recipient_restrictions =
   permit_mynetworks,            
   permit_sasl_authenticated,
   permit_auth_destination,
   reject
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.