Some of my customers implemented commercial software that violate email-RFCs such that we have had to relax our header checks. In consequence, we receive more spam.


  • I know the domains (customer.com) and IP-addresses (a.b.c.d/C) these emails come from

Kind request for help:

  • Is it possible to setup one Postfix (2.11) instance on Linux such that:
    • It applies only some header checks for emails from .*@customer.com
    • But applies all header checks for all other email sources?

I thought of a combination of mynetworks that includes the subnet a.b.c.d/C in smtpd_recipient_restrictions -- allowing all these messages through -- and simultaneously avoid an open-relay with smtpd_relay_restrictions.

However, this has not worked out as expected.

Any idea or help is highly appreciated.

Thanks in advance.



For the current issue, I solved the problem by prepending REDIRECTs to header_checks as follows:

/^received: from.*customer.com.*by mail.own.com.*for.*luke@own.*/
  REDIRECT myself@own.org

This works so far as neeeded.

Irrespective thereof, I am still looking for a postfix configuration that would turn this text-based setting into an IP-Address-Range based forwarding rule....



  • 1
    Running a separate smtpd server on a port other than 25 say 2525 for customer.com users is one option. What is your current non-working postifx config? Please post your postconf -n to help you fix it. – clement May 26 '14 at 14:14

Setup a second postfix instance listening on a different port and configure it identical to existing instance except relaxing the header_checks (and the different listening smtpd port), then redirect at network level tcp connections from the customer server's IP to the new instance. Also at the firewall level refuse incoming connections to the new port from everyone except the customer IP.

If running a modern Linux distribution, redirecting traffic from a certain IP address coming into tcp port 25 to another tcp port can be done with a netfilter rule like this:

root@email:~# $(which iptables) -t nat -I PREROUTING -i $incoming_interface -p tcp -s $customer_ip --dport 25 -j REDIRECT --to $second_postfix_listening_port

Since you are running a recent postfix version, you can migrate the existing setup into a postmulti configuration that eases creating additional instances (for example you will not need to create additional init scripts, all instances will be started/stopped by the single postfix init script when running a postmulti configuration).

Please leave questions in the comments if you need additional help on postmulti.

  • Thanks for your feedback! A really good idea. I am gonna try postmulti -- never done before.... In case I get stuck, I dare asking in a comment again. Thanks, Luke – luke Oct 1 '14 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.