I need to allow some domains to get into my postfix mail server. As far as I know this can be done by using Regular Expressions (regexp) in Postfix. I also know that there are attributes which postfix uses to "parse" mails. One of these is "check_sender_access". This one is used to apply Regular expressions on it and filter/control if the mail is REJECTED or PERMITTED. The thing is I want to know what "check_sender_access" catches from the mail in plain text. I want to know, if "check_sender_access" behaves as a variable, what is within it at the time the mail is analized.

For instance, this is the header of a mail (in plain text):

Return-Path: notification+kr43fak5xrms22rr@facebookmail.com
Received: from ms3.domain.com (LHLO ms3.domain.com) ( by
  ms3.domain.com with LMTP; Thu, 2 Mar 2017 03:00:08 -0500 (CST)
Received: from localhost (localhost.localdomain [])
     by ms3.domain.com (Postfix) with ESMTP id E8E8F17CED60
     for <leila@domain.com>; Thu,  2 Mar 2017 03:00:04 -0500 (CST)
X-Spam-Flag: YES
X-Spam-Score: 7.017
X-Spam-Level: *******

Using this plain text, I want to know which part of the text above is the check_sender_access. Even if it's possible to make some echo check_sender_access > dumpfile. As far as I know "main.cf" (postfix's configuration file) doesn't allows batch commands (echo, grep, for, if,...). If so PLEASE tell me how.

To resume, I want to kinda debug/trace the proccess by knowing every time the value an attribute such as check_sender_access gets (in plain text if possible).

Cause: I used a regular expresion to allow a specific domain but this never worked. However, using the command: postmap -q "domain.com" regexp:/etc/postfix/regexp/checkDomain this returns me a decision according the regular expression into the checkDomain file. This means the regular expression is working with a "domain.net" string as a test, for instance "gmail.com" is validated correctly.

I think the error could be: 1- The mail is rejected before postfix reaches the line when the check_sender_access part is checked. 2- The regular expression is validating an unexpected line (an entire header instead of a single "gmail.com" or an IP address).

Free software can be very customizable but it's also primitive for certain things. For instance, I can't see the "check_sender_access" creation (route) as a attribute or function.

This is the official info for check_sender_access . Thanks for stopping by and let me know if more info is needed.


When sending an email via SMTP, the sender begins by issuing the MAIL FROM: address command. The address here should be the sender's email address, and is what check_sender_access refers to and matches against. When the mail is delivered to you, your server takes this address and places it at the top of the email where it becomes the Return-Path header.

Thus, in your example email, the address being checked by check_sender_access is notification+kr43fak5xrms22rr@facebookmail.com

Keep in mind that this is trivial to forge.

  • After reading your answer and watching this table at the bottom (postfix.org/SMTPD_ACCESS_README.html#danger) I realized I was committing a concept error. The table really explain every part in the mail and which attribute is related to. Altough my other doubt is how to use both batch code and postfix code (I guess it's called lazy function). Thanks for your early reply and sorry for asking without doing a deeper research.
    – Ophion
    Mar 15 '17 at 20:33
  • Maybe this is not correct but I'd like to ask you another question in this comment. What if the email has several RCPT TO information (more than one)? Will Postfix distinguish/evaluate among all of them (RCPTs) and apply the regular expressions? We already know MAIL FROM (check_sender_access) will be always one email address, but it's not the case for the RCPT TO block. To resume: Will postfix check on every email address in the RCPT TO block? Thanks in advance.
    – Ophion
    Mar 16 '17 at 12:49
  • 1
    When there are multiple recipients, RCPT TO: is repeated with one address per command. I don't know enough about postfix's handling, but I would assume that each address would be checked against a relevant filter and if one RCPT TO address fails, it stops delivering just that one copy and the addresses that passed the filter will continue.
    – DerfK
    Mar 16 '17 at 16:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.