I have setup Postfix with a list of blacklisted recipients, so that the Postfix server should not relay mail to them (smtpd_recipient_access parameter in main.cf).

The addresses are properly listed in a file with a REJECT at the end of each line. I did the standard step to create the database hash (postmap hash:/etc/postfix/recipient_access).

I can test that the mails get rejected by using for example:

postmap -q blacklisted_addr@example.com hash:/etc/postfix/recipient_access

And I get the reply: REJECT as expected.

All addresses in the blacklist file are non-local, i.e. they aren't covered by the "mydestinations" variable.

However, using Thunderbird to send the mail via that Postfix SMTP server simply sends the mail to blacklisted addresses with no reject. I would guess some other relay config I have might get this mail relayed despite my blacklist match, but cannot find the problem.

Config parameters which I believe would be relevant are:

mydestination = $myhostname, localhost, localhost.localdomain, localhost.$myhostname
relay_domains = $mydestination, proxy:ldap:/etc/postfix/ldap/relay_domains.cf
relayhost =
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_end_of_data_restrictions = check_policy_service inet:
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks,permit_sasl_authenticated, check_helo_access pcre:/etc/postfix/helo_access.pcre
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, check_recipient_access hash:/etc/postfix/recipient_access, check_policy_service inet:, check_policy_service inet:, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname
smtpd_reject_unlisted_recipient = yes
smtpd_reject_unlisted_sender = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = no

If other parameters could be relevant, I can post the entire config

  • 2
    First condition (permit_sasl_authenticated) allows acces for authenticated clients. If your thunderbird authenticates to your smtp server, you don't reach the blacklist.
    – Dan
    Feb 14, 2015 at 16:10
  • Thanks @Dan. I experimented with this and yes, you are right. What I was missing is that the SEQUENCE of that parameter list is important. This is not covered anywhere in Postfix documentation
    – nepdev
    Feb 14, 2015 at 20:00
  • @Dan, could you post the comment above to answer section so nepdev can accept it? We don't want to leave this question in unanswered pool
    – masegaloeh
    Feb 14, 2015 at 22:08
  • 1
    nepdev, looks like this page was official documentation that you are looking for
    – masegaloeh
    Feb 14, 2015 at 22:28

1 Answer 1


Restrictions specified in restriction lists such as smtpd_helo_restrictions, smtpd_recipient_restrictions etc. are applied in the order as specified; the first restriction that matches wins.

Since your smtp_recipient_restrictions has permit_sasl_authenticated as first condition and check_recipient_access somewhere down the road, any authenticated client is allowed and not checked agains the later.

You may also want to read http://www.postfix.org/SMTPD_ACCESS_README.html


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.