3

By default, my Postfix allow relay emails sent to my domain (domain1.com) or only for password auth clients or for 'myhostname' addresses. This is regular situation for most of mail servers.

If I setup connector in Exchange Online to send outbound emails via my postfix, clients (for example, Outlook) normally send email, using Exchange credentials, and Exchange service forward sent email to my postfix.

main.cf:

relay_domains = domain1.com
...
smtpd_relay_restrictions =
        reject_non_fqdn_recipient,
        reject_non_fqdn_sender,
        reject_unknown_recipient_domain,
        reject_unknown_sender_domain,
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_unauth_destination,
        reject_invalid_hostname,
        reject_unverified_sender,
        reject_unknown_client_hostname,
        reject_unknown_helo_hostname,
        defer_unauth_destination

Postfix will deny with "454 4.7.1 Relay access denied" code:

Anonymous TLS connection established from mail-ve1eur122p0672.outbound.protection.outlook.com[213.199.154.150]: TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)
NOQUEUE: reject: RCPT from mail-ve1eur122p0672.outbound.protection.outlook.com[213.199.154.150]: 454 4.7.1 <external123@partner.org>: Relay access denied; from=<my@domain1.com> to=<external123@partner.org> proto=ESMTP helo=<EUR03-VE1-obe.outbound.protection.outlook.com>
disconnect from mail-ve1eur122p0672.outbound.protection.outlook.com[213.199.154.150]

It's normal, because host 've1eur122p0672.outbound.protection.outlook.com' isn't in myhostname and this host not uses smtp-auth.

I tried:

smtpd_relay_restrictions =
        reject_non_fqdn_recipient,
        reject_non_fqdn_sender,
        reject_unknown_recipient_domain,
        reject_unknown_sender_domain,
        permit_mynetworks,
        permit_sasl_authenticated,
        check_client_access hash:/etc/postfix/trusted_servers,
        reject_unauth_destination,
        reject_invalid_hostname,
        reject_unverified_sender,
        reject_unknown_client_hostname,
        reject_unknown_helo_hostname,
        defer_unauth_destination

And:

# less /etc/postfix/trusted_servers
.outbound.protection.outlook.com OK

# postmap /etc/postfix/trusted_servers

But without result.

Is it possible to allow postfix accept relaing mails from *.outbound.protection.outlook.com to any domains, but for others allow only password auth?

1 Answer 1

0
smtpd_client_restrictions = 
       check_client_access hash:/etc/postfix/trusted_servers

Not smtpd_relay_restrictions section. Please read: http://www.postfix.org/postconf.5.html#check_client_access

15
  • Not sure you are right.
    – Marvin
    Oct 18, 2017 at 13:32
  • option 'smtpd_client_restrictions' permit all by default. There is no need to allow additional servers.
    – Marvin
    Oct 18, 2017 at 13:40
  • smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_reverse_client_hostname, reject_unknown_client_hostname, permit
    – Marvin
    Oct 18, 2017 at 13:41
  • if I change: relay_domains = domain1.com,gmail.com every can relay email from postfix to gmail without auth!
    – Marvin
    Oct 18, 2017 at 13:42
  • As for me, changes must be in "smtpd_recipient_restrictions" or "smtpd_relay_restrictions".
    – Marvin
    Oct 18, 2017 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.