1

I'd like to configure postfix to relay mail from certain sender addresses only. Postfix should relay mail to different relayhosts(/smarthosts) (Gmail, AOL, ...) dependent on the sender's address ("MAIL FROM:").

So far, my current configuration works as follows:

  • Users authenticate on postfix for mail relay in general. If they cannot authenticate, no relay is possible. Note that this authentication is different from the authentication for the relayhosts.

  • Dependent on the sender's address ("MAIL FROM:"), a certain relayhost is selected (smtp_sender_dependent_authentication, sender_dependent_relayhost_maps, smtp_sasl_password_maps). This also works fine.

  • However, if the user can authenticate, and has a sender address not covered in sender_dependent_relayhost_maps, postfix tries to directly relay the mail - which often does not work due to IP address restrictions (blacklists).


My question is now: how to reject mail that would have been relayed directly (without smarthost), i.e., where the sender's address is not listed in sender_dependent_relayhost_maps? Any hints how to achieve this?

  • What shows the log?, you can configure it to show more verbose output. In master.cf file append one or more -v options to selected daemon and execute command postfix reload. smtp inet n - n - - smtpd -v – Juan Botero Sep 4 '18 at 23:57
  • The log show that it is working as described: If the sender's address matches an address in the sender_dependent_relayhost_maps, then the log shows maps_find: smtp_sasl_password_maps: hash:/etc/postfix/sasl_passwd.hash: ADDRESS = USER:PASS. Otherwise, a direct connection is established, but the relay is rejected from the smarthost: refused to talk to me: SMARTHOST ESMTP Service not available 554-No SMTP service 554-IP address is black listed – user236012 Sep 5 '18 at 0:10
  • Currently, there are no technical problem with postfix. What I'm looking for is some hint how to change the configuration in order to get in a new 'feature' - namely rejecting mail for relay with an unknown sender's address (i.e., which is not listed in smtp_sasl_password_maps). – user236012 Sep 5 '18 at 0:18
1

You would need some limiting test before permit_sasl_authenticated. A prerequisite for this would be having separated smtpd on port 25 for incoming mail and another smtpd for submission on port 587. Otherwise this limitation would cause incoming mail to be rejected as it won't pass the test. Then, remove the permit_sasl_authenticated from the port 25 altogether, and add the test to your submission configuration in master.cf.

  • To answer your question literally, check_sender_access would be a suitable test, whitelisting all the domains listed in sender_dependent_relayhost_maps and rejecting mail for the rest.

    check_sender_access type:table

    Search the specified access(5) database for the MAIL FROM address, domain, parent domains, or localpart@, and execute the corresponding action.

    This can be added to either smtpd_sender_restrictions or smtpd_recipient_restrictions.

  • What would do the same, but further prevent users from using each other's addresses is using reject_sender_login_mismatch. This needs an additional smtpd_sender_login_maps table, but if your virtual_alias_maps entries are already formed as address@example.com username, you can use the same file and the allowed sender addresses are automatically updated whenever you update your virtual aliases database with postmap. An example of such submission configuration in the master.cf:

    submission inet n - - - - smtpd
    # Other parameters
      -o smtpd_sender_login_maps=hash:/etc/postfix/virtual
      -o smtpd_sender_restrictions=reject_sender_login_mismatch
      -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    # Other parameters
    
  • Thanks for your answer. I read some further documentation, and found reject_authenticated_sender_login_mismatch - wouldn't that do all the stuff you mentioned in your answer (allowing incoming mail, submission of mail/for relay from authenticated users only and to specfied relayhosts only), but without having to open a submission port? The restriction should be put before permit_sasl_authenticated on the smtpd_recipient_restrictions parameter. Or did I miss something? – user236012 Sep 5 '18 at 22:04
  • Nicely spotted! If you wish to use port 25 for both, reject_authenticated_sender_login_mismatch is your choice. Using different port for submission has some advantages: you can have totally different set of settings for authenticated users, and avoid the limitations for port 25 in many consumer grade internet connections. – Esa Jokinen Sep 6 '18 at 2:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.