So I have a Postfix server that authenticates users against an LDAP directory.

This works great so far, but one of the mail adresses should be allowed to set another sender address.

All users on that server already are limited to send with their login adress, e.g. john@example.com is only allowed to send with that exakt mail adress.

The only exeption should be one adress, admin@example.com, which should be allowed to send with any sender address(not limited to example.com).

Is this possible?


You can achieve this with Postfix Restriction Classes. You can add restriction classes as shown below.

smtpd_restriction_classes = restrictive, permissive
restrictive = reject_sender_login_mismatch
permissive = permit
smtpd_sender_restrictions =  check_sender_access regexp:/etc/postfix/admin_only
smtpd_sender_login_maps = hash:/etc/postfix/sender_maps

/^admin@example.com$/  permissive
/^/                    restrictive

user@example.com  user@example.com

Here reject_sender_login_mismatch restriction will not be applicable for admin@example.com user. The above configuration is using hash lookup table for smtpd_sender_login_maps. You can use LDAP or any other lookup table of your choice. Hope that helps.

Ref: Postfix Docs

  • So what exactly is the permissive/restrictive for? And what happens, if an account is not listed in either of the maps? – Izzy Jun 11 '14 at 16:11
  • You can call restrictive/permissive as names of restriction classes you have. I updated the answer to use regexp lookup type for check_sender_access. So you need not add all your email addresses in /etc/postfix/admin_only. For this logic to work, smtpd_sender_login_maps should be proper. More about it here – clement Jun 11 '14 at 17:28
  • Beware: This allows any user one to send with admin address, instead of allowing the admin user to send with any address – Marcel Klehr Jul 16 at 13:17
  • The correct restriction would be check_sasl_access in smtpd_client_restrictions – Marcel Klehr Jul 16 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.