I've a Postfix server running for my own email and everything works fine. While I was upgrading the machine and decided to review the security settings / read and implement some best practices online and most online tutorials tell me to set smtpd_client_restrictions under main.cf similarly to this:

smtpd_client_restrictions = 
    reject_rbl_client zen.spamhaus.org,
    reject_rbl_client bl.spamcop.net,
    reject_rbl_client cbl.abuseat.org

And at the same time I also see people setting the submission service under master.cf as:

submission inet  n       -       y       -       -       smtpd
 -o smtpd_client_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_mynetworks,permit_sasl_authenticated,reject

My question: Why does the smtpd_client_restrictions under submission ends with reject and under main.cf nobody recommends ending the list with reject? Aren't they just the same thing according to the docs:

-o name=value (short form) Override the named main.cf configuration parameter. The parameter value can refer to other parameters as $name etc., just like in main.cf. See postconf(5) for syntax. http://www.postfix.org/master.5.html


Restrictions are applied in the order as specified; the first restriction that matches wins. http://www.postfix.org/postconf.5.html#smtpd_client_restrictions

If "the first restriction that matches wins" rule really applies won't ending it with reject would cause it to be impossible to send email at all?

Thank you.

  • 1
    You have permit_ parameters. Those might match. – Michael Hampton Feb 11 '18 at 22:48
  • @MichaelHampton so If permit_sasl_authenticated checks no further restrictions will be tested? – TCB13 Feb 12 '18 at 0:41
  • That's correct. – Michael Hampton Feb 12 '18 at 0:44
  • @MichaelHampton so do you think that smtpd_client_restrictions, smtpd_sender_restrictions, smtpd_relay_restrictions should all have reject as the last check in main.cf? – TCB13 Feb 12 '18 at 0:47

It's redundant. If you reach the end and haven't matched anything, the default is reject anyway. But having it there makes that explicit for people who don't know what the default is.

  • Hmm... I was under the impression that the default is permit because of this: "The end of each list is equivalent to a PERMIT result" postfix.org/SMTPD_ACCESS_README.html – TCB13 Feb 12 '18 at 1:51
  • 1
    Well, that's confusing. Elsewhere in the docs it states that reject is the default. Maybe you'd better be explicit. I don't trust the docs anymore. :) – Michael Hampton Feb 12 '18 at 2:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.