I'm using Postfix 2.7.1 (can't change to a newer version for the moment) and it's running fine, with the exception that is allowing to relay mail from the internal network even if the specified sender is not from the domain served by Postfix.

In other words, if my domain is mydomain.com, any computer on my local network is allowed to send emails to any other domain using bogusaccount@anotherdomain.com as the sender's email address, how can I stop this?

I have this in main.cf:

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

I've tried to restrict mynetworks to only localhost or change the order in smtpd_recipient_restrictions to this:

smtpd_recipient_restrictions = reject_unauth_destination, permit_mynetworks, permit_sasl_authenticated

but the result is that none of the users on the network can send emails.

Thanks in advance for your help!

  • What shows up in your logs when you restrict mynetworks to just localhost and internal users send email? – NickW Jan 29 '14 at 12:53
  • I got 'relay access denied' – tvs Jan 29 '14 at 12:55
  • Which is correct, what you may want to do is look at postfix.org/postconf.5.html#smtpd_sender_login_maps sender login maps, where you create a file that maps sasl logins to authorized senders. Users will have to use sasl authorization to send though. – NickW Jan 29 '14 at 13:01

If you are having issues with people sending with "unofficial" or bogus accounts, the smtpd_sender_login_maps option is what you need. It will take the SASL login name, and check the file/DB/regex to see if the From: name is valid, and either relay, or deny. You will have to create the mappings, but that's the only work involved.


I'm assuming you want to send emails out, as long as they are from your domain as the sender address.

smtpd_sender_restrictions = reject_unknown_sender_domain, reject_unlisted_sender, check_sender_access hash:/etc/postfix/localdomain, reject

/etc/postfix/localdomain :

mydomain.com      OK

In localdomain you can also add any compromised accounts which come up:

passwdguessed@mydomain.com    550 Account compromised

Don't forget to run postmap on localdomain file since it is a hashed file reference.

  • this solution actually does NOT work, as it prevents to receive any emails from the outside, even if the recipient is a valid user. – tvs Jan 30 '14 at 11:26
  • I recommend running a second postfix for SMTP and using this type of control. That is, a dedicated postfix instance for MX, and another for SMTP. It provides more granular control, and if the above solution is applied on the SMTP instance, it works well to deal with compromised accounts. – labradort Mar 14 '14 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.