Postfix / smtpd_relay_restrictions. How to allow relay from third party smtp server to any domains (but not open relay!)

Question

By default, my Postfix allow relay emails sent to my domain (domain1.com) or only for password auth clients or for 'myhostname' addresses. This is regular situation for most of mail servers.

If I setup connector in Exchange Online to send outbound emails via my postfix, clients (for example, Outlook) normally send email, using Exchange credentials, and Exchange service forward sent email to my postfix.

main.cf:

relay_domains = domain1.com
...
smtpd_relay_restrictions =
        reject_non_fqdn_recipient,
        reject_non_fqdn_sender,
        reject_unknown_recipient_domain,
        reject_unknown_sender_domain,
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_unauth_destination,
        reject_invalid_hostname,
        reject_unverified_sender,
        reject_unknown_client_hostname,
        reject_unknown_helo_hostname,
        defer_unauth_destination

Postfix will deny with "454 4.7.1 Relay access denied" code:

Anonymous TLS connection established from mail-ve1eur122p0672.outbound.protection.outlook.com[213.199.154.150]: TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)
NOQUEUE: reject: RCPT from mail-ve1eur122p0672.outbound.protection.outlook.com[213.199.154.150]: 454 4.7.1 <external123@partner.org>: Relay access denied; from=<my@domain1.com> to=<external123@partner.org> proto=ESMTP helo=<EUR03-VE1-obe.outbound.protection.outlook.com>
disconnect from mail-ve1eur122p0672.outbound.protection.outlook.com[213.199.154.150]

It's normal, because host 've1eur122p0672.outbound.protection.outlook.com' isn't in myhostname and this host not uses smtp-auth.

I tried:

smtpd_relay_restrictions =
        reject_non_fqdn_recipient,
        reject_non_fqdn_sender,
        reject_unknown_recipient_domain,
        reject_unknown_sender_domain,
        permit_mynetworks,
        permit_sasl_authenticated,
        check_client_access hash:/etc/postfix/trusted_servers,
        reject_unauth_destination,
        reject_invalid_hostname,
        reject_unverified_sender,
        reject_unknown_client_hostname,
        reject_unknown_helo_hostname,
        defer_unauth_destination

And:

# less /etc/postfix/trusted_servers
.outbound.protection.outlook.com OK

# postmap /etc/postfix/trusted_servers

But without result.

Is it possible to allow postfix accept relaing mails from *.outbound.protection.outlook.com to any domains, but for others allow only password auth?

Answer 1

smtpd_client_restrictions = 
       check_client_access hash:/etc/postfix/trusted_servers

Not smtpd_relay_restrictions section. Please read: http://www.postfix.org/postconf.5.html#check_client_access