My employer has given me an email address, me@myemployersdomain.com. My employer's outgoing mail server only allows connections from inside their network (rather like an ISP who insists you connect through them to use their smtp server). So when I pop out to the cafe for lunch and an email from my boss arrives on my phone, I can't respond to it until I get back to the office. Also, I can't respond to work emails when I'm travelling or working in the field.

I'm not allowed to reconfigure the main mail server, but I have a small separate Postfix server which I can control. I have a number of virtual domains set up on there, and I added myemployersdomain.com as an additional virtual domain, and me@myemployersdomain.com as a virtual user. This works, and I can send outgoing mail through this server to anywhere in the world, EXCEPT to other users on myemployersdomain.com (which is all I really want).

When I try to send to otheruser@myemployersdomain.com I get

NOQUEUE: reject: RCPT from... 550 5.1.1 ... Recipient address rejected: User unknown in virtual mailbox table

The Postfix server thinks it controls all of myemployersdomain.com, and if I don't set up a virtual user for the recipient on this domain, then it doesn't allow it. I can make the error go away by setting a catchall alias in the virtual file

@myemployersdomain.com me@myemployersdomain.com

but of course all the email I send then comes straight back to me!

I tried setting the transport file to relay all mail for myemployersdomain.com through, say, gmail like this:

example.com  :
myemployersdomain.com smtp:[smtp.gmail.com]:587

but it makes no difference. (The relaying works as expected for recipient addresses on other (external) domains, but for this virtual domain, Postfix doesn't allow you to get as far as this - the 5.1.1 error comes first.)

Is it possible to configure Postfix to send mail destined for a locally-defined virtual domain out into the big wide internet and let DNS sort it out?

2 Answers 2


If you set up your secondary machine as a backup server, you'll need a few settings.

relay_domains= myemployersdomain.com

You will also be using your transport_maps like this:

myemployersdomain.com relay:[the.actual.server]

Then you would (as Falcon says) need the relay_recipient_maps with either a wildcard entry, or an entry for you, and your boss.

Then I'd set up TLS encrypted SASL authorizaion, and allow only users who authenticate to send.

smtpd_relay_restrictions = permit_sasl_authenticated, reject


  • Brilliant. That does exactly what I want. The only other thing I had to do was remove myemployersdomain.com from the virtual-mailbox-domains list. It's now working. Thank you Nick. Nov 26, 2014 at 14:02
  • Yeah, good point, glad you got it going :)
    – NickW
    Nov 26, 2014 at 14:10

The whole point of the domain part of the email address is that it indicates which set of SMTP servers is responsible for delivery of mail for the whole domain. Put another way: you cannot subdivide domains like that.

However, it sounds like what you really want to do (besides circumventing policy, but this is an interesting question theoretically so I'm answering it anyway) is just relay mail.

In that case, you should have it relay all the mail it sees, as long as the user is authenticated. I believe you can set it up to not have a local domain at all. After all, I assume you don't actually want to have your relay MTA accept delivery of mail, and thus have two inboxes with the same address. That would just be confusing.

If you tell it to relay everything, it will send it out to whatever is in the MX record for the destination domain, which I think is what you want.

This is best accomplished by setting no local domain. That setup is common for relay MTAs that are used for virus and spam filtering, for instance.

I do recall there being a feature called relay_recipient_maps, but I don't think that is the right approach in this use case.

  • Thank you Falcon - that's very helpful. You are quite correct; I'm not interested in incoming mail on this server, and yes, I just want it to go where the MX record points. Relaying was the answer. Thanks to your help and Nick's I've got this working now. Nov 26, 2014 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.