By default, my Postfix allow relay emails sent to my domain (domain1.com) or only for password auth clients or for 'myhostname' addresses. This is regular situation for most of mail servers.
If I setup connector in Exchange Online to send outbound emails via my postfix, clients (for example, Outlook) normally send email, using Exchange credentials, and Exchange service forward sent email to my postfix.
main.cf:
relay_domains = domain1.com
...
smtpd_relay_restrictions =
reject_non_fqdn_recipient,
reject_non_fqdn_sender,
reject_unknown_recipient_domain,
reject_unknown_sender_domain,
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
reject_invalid_hostname,
reject_unverified_sender,
reject_unknown_client_hostname,
reject_unknown_helo_hostname,
defer_unauth_destination
Postfix will deny with "454 4.7.1 Relay access denied" code:
Anonymous TLS connection established from mail-ve1eur122p0672.outbound.protection.outlook.com[213.199.154.150]: TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)
NOQUEUE: reject: RCPT from mail-ve1eur122p0672.outbound.protection.outlook.com[213.199.154.150]: 454 4.7.1 <external123@partner.org>: Relay access denied; from=<my@domain1.com> to=<external123@partner.org> proto=ESMTP helo=<EUR03-VE1-obe.outbound.protection.outlook.com>
disconnect from mail-ve1eur122p0672.outbound.protection.outlook.com[213.199.154.150]
It's normal, because host 've1eur122p0672.outbound.protection.outlook.com' isn't in myhostname and this host not uses smtp-auth.
I tried:
smtpd_relay_restrictions =
reject_non_fqdn_recipient,
reject_non_fqdn_sender,
reject_unknown_recipient_domain,
reject_unknown_sender_domain,
permit_mynetworks,
permit_sasl_authenticated,
check_client_access hash:/etc/postfix/trusted_servers,
reject_unauth_destination,
reject_invalid_hostname,
reject_unverified_sender,
reject_unknown_client_hostname,
reject_unknown_helo_hostname,
defer_unauth_destination
And:
# less /etc/postfix/trusted_servers
.outbound.protection.outlook.com OK
# postmap /etc/postfix/trusted_servers
But without result.
Is it possible to allow postfix accept relaing mails from *.outbound.protection.outlook.com to any domains, but for others allow only password auth?