I'd like to deploy a new (postfix) email service for my domain (example.com) to:

  1. allow sending email to ANY domain ONLY if the sender (our cloud applications instances) is authenticated (e.g. by SMTP password)
  2. allow our users to reply to received emails at: support@example.com
  3. allow us to be notified of undeliverable email: mailerrors@example.com
  4. relay email addressed to *@example.com to our Google Apps email host (which must also be able to directly receive email destined for example.com)

... in order to avoid daily sending limits for our Google Apps email host.

Is it possible to configure both authenticated and unauthenticated access to a postfix server?

Or should I use postmulti?


My thinking was, configure postfix so that,

  • if a password is provided email, new mail is sent directly to the destination.
  • if a password is not provided:
    • relay any messages addressed to example.com to our Google service
    • reject all other messages.
  • (and also: register the server in the example.com's MX record, in addition to the Google Apps servers, so that our sent mail with *@example.com From/ReplyTo header fields are accepted by destination spambots.)

From what I see, postfix configuration for the above case is straightforward if I have two postfix servers:

  • A: password required SMTP server to
  • B: passwordless relay that sends example.com address mail to our Google Apps service

However, I think these need to be co-hosted (since destination servers match the IP address of the sending server with the MX record, but the MX record must also point to B).

Sould I use postmulti to co-host these differently configured servers and block access to the "A" server behind within a firewall and on a non-standard port?

Or is there some other postfix config magic to do what I want?

  • Umm... I'm not sure what do you want. You should breakdown the problem one by one. (1) Where does MX record for example.com will be point to? postfix or GApps? (2) Where is the final destination for email intended example.com? postfix or GApps? – masegaloeh Dec 10 '14 at 5:27
  • The final destination is GApps. The postfix server needs to forward mail to the GApps server. Both GApps and the postfix server can send mail from example.com. As a result I think I need to register both servers in the MX record. Although the postfix server is not the desired destination for incoming mail, I believe it needs to be registered in the MX record so that servers it sends mail to can verify that the *@example.com From and ReplyTo header match the senders IP in the MX records for example.com. Its possible to register multiple MX records, correct? – user14645 Dec 10 '14 at 17:09
  • I believe it needs to be registered in the MX record so that servers it sends mail to can verify that the *@example.com. NO. MX record just needed for incoming email. The activity that you described was outgoing email. For outgoing one you should setup SPF record. – masegaloeh Dec 12 '14 at 2:45
  • "To verify that the sending server is an authorized email server, the receiving email server tries to find an MX record that correlates to the sender’s domain. If it cannot find one, it assumes that the email is spam and rejects it." watchguard.com/help/docs/wsm/xtm_11/en-US/… – user14645 Dec 12 '14 at 23:38
  • 1
    They will use SPF record to determine that an IP Address was authorized to sending email behalf on a domain. For example if spf record of example.com is and, then both IP was trusted – masegaloeh Dec 18 '14 at 22:53

Based on the comments above, looks like you confused about the MX record. Usually, MX record was used to determine where I (mail server) should send outgoing email intended to particular domain.

When a remote server receive an email, they would perform sender identification. For example server would check SPF record of sender domain to determine that an IP address authorized to send behalf of a domain.

So, you don't need point MX server to all IP address of outgoing mail server. Many big providers do this.

  • They have several IP address to handle outgoing email. You can view it in their SPF record
  • They have several IP address to handle incoming email. You can view it in their MX record

And yes, they have different IP address to handle incoming and outgoing email.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.