I have configured Policyd v2 (cluebringer) to apply quota on msg count for SASL and non-SASL users. It is easy in policyd [1]. However I don't know how to configure postfix (2.7.1). Right now I have this (non important rules removed):

smtpd_recipient_restrictions    =
    check_policy_service inet:,
    reject_rbl_client zen.spamhaus.org,

check_policy_service must be before permit_sasl_authentificated to be able to check on SASL users (because permit_sasl_authentificated returns OK and no other permissions are checked after it).

But having it here means, that it would count every incoming email attempt in quota - regardless if it will be accepted by postfix or not (because greylist/blacklist and reject_unauth_destination are after check_policy_service). So all rejected spam would count on recipient users' quota.

How is it possible to have policyd be invoked for both SASL incoming email and for non-SASL email which is accepted for server?

1]: http://lists.policyd.org/pipermail/users_lists.policyd.org/2012-October/004002.html

  • Why cant you add all reject restrictions first, followed by check_policy_service followed by permit clauses? – clement Jul 9 '14 at 10:59
  • 1
    For example reject_unauth_destination (rejects all mail for which postfix is not final destination) must be after permit_sasl_authenticated otherwise SASL auth would not work. – Marki555 Jul 9 '14 at 11:49
  • I suggest you to upgrade postfix to version 2.10. This version has feature smtpd_relay_restriction to separate permit_sasl and check policy – masegaloeh Jul 9 '14 at 13:44

In case of Postfix version 2.10 or newer, you can try to solved those problem by using smtpd_relay_restriction feature. Snippet from postfix documentation explains how to use them properly.

Relay policy is specified under smtpd_relay_restrictions, and the spam blocking policy under smtpd_recipient_restrictions.

Then your configuration should like this

smtpd_relay_restriction = 

smtpd_recipient_restrictions =
    reject_rbl_client zen.spamhaus.org,
    check_policy_service inet:
  • Will this call policyd before rejecting email by spamhaus? I want to avoid that. I just want to invoke policyd only for otherwise accepted emails (SASL or non-SASL), so that I can enforce quotas on them. – Marki555 Jul 16 '14 at 19:58
  • In that case, just reorder to smtpd_recipient_restrictions = reject_rbl_client zen.spamhaus.org, check_policy_service inet: ` – masegaloeh Jul 16 '14 at 20:02

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.