2

By default, my Postfix allow relay emails sent to my domain (domain1.com) or only for password auth clients or for 'myhostname' addresses. This is regular situation for most of mail servers.

If I setup connector in Exchange Online to send outbound emails via my postfix, clients (for example, Outlook) normally send email, using Exchange credentials, and Exchange service forward sent email to my postfix.

main.cf:

relay_domains = domain1.com
...
smtpd_relay_restrictions =
        reject_non_fqdn_recipient,
        reject_non_fqdn_sender,
        reject_unknown_recipient_domain,
        reject_unknown_sender_domain,
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_unauth_destination,
        reject_invalid_hostname,
        reject_unverified_sender,
        reject_unknown_client_hostname,
        reject_unknown_helo_hostname,
        defer_unauth_destination

Postfix will deny with "454 4.7.1 Relay access denied" code:

Anonymous TLS connection established from mail-ve1eur122p0672.outbound.protection.outlook.com[213.199.154.150]: TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)
NOQUEUE: reject: RCPT from mail-ve1eur122p0672.outbound.protection.outlook.com[213.199.154.150]: 454 4.7.1 <external123@partner.org>: Relay access denied; from=<my@domain1.com> to=<external123@partner.org> proto=ESMTP helo=<EUR03-VE1-obe.outbound.protection.outlook.com>
disconnect from mail-ve1eur122p0672.outbound.protection.outlook.com[213.199.154.150]

It's normal, because host 've1eur122p0672.outbound.protection.outlook.com' isn't in myhostname and this host not uses smtp-auth.

I tried:

smtpd_relay_restrictions =
        reject_non_fqdn_recipient,
        reject_non_fqdn_sender,
        reject_unknown_recipient_domain,
        reject_unknown_sender_domain,
        permit_mynetworks,
        permit_sasl_authenticated,
        check_client_access hash:/etc/postfix/trusted_servers,
        reject_unauth_destination,
        reject_invalid_hostname,
        reject_unverified_sender,
        reject_unknown_client_hostname,
        reject_unknown_helo_hostname,
        defer_unauth_destination

And:

# less /etc/postfix/trusted_servers
.outbound.protection.outlook.com OK

# postmap /etc/postfix/trusted_servers

But without result.

Is it possible to allow postfix accept relaing mails from *.outbound.protection.outlook.com to any domains, but for others allow only password auth?

Improve this question
1
smtpd_client_restrictions = 
       check_client_access hash:/etc/postfix/trusted_servers

Not smtpd_relay_restrictions section. Please read: http://www.postfix.org/postconf.5.html#check_client_access

Improve this answer
  • Not sure you are right. – Marvin Oct 18 '17 at 13:32
  • option 'smtpd_client_restrictions' permit all by default. There is no need to allow additional servers. – Marvin Oct 18 '17 at 13:40
  • smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_reverse_client_hostname, reject_unknown_client_hostname, permit – Marvin Oct 18 '17 at 13:41
  • if I change: relay_domains = domain1.com,gmail.com every can relay email from postfix to gmail without auth! – Marvin Oct 18 '17 at 13:42
  • As for me, changes must be in "smtpd_recipient_restrictions" or "smtpd_relay_restrictions". – Marvin Oct 18 '17 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.