Recipient address restrictions
The smtpd_recipient_restrictions parameter restricts what recipient addresses this system accepts in RCPT TO commands.
Default:
smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination
By default, the Postfix SMTP server relays mail:
* from trusted clients whose IP address matches $mynetworks to any destination,
* from untrusted clients to destinations that match $relay_domains or a subdomain thereof, except for addresses that contain sender-specified routing (user@elsewhere@domain).
In addition to the above, the Postfix SMTP server by default accepts mail for which Postfix is the final destination:
* to destinations that match $inet_interfaces,
* to destinations that match $mydestination,
* to destinations that match $virtual_alias_domains,
* to destinations that match $virtual_mailbox_domains.
Syntax:
Specify a list of zero or more restrictions, separated by whitespace or commas. Restrictions are applied in the order as specified; the first restriction that matches wins.
In addition to restrictions that are specific to recipient mail addresses, you can also specify restrictions based on the sender mail address, on the information passed with the HELO/EHLO command , and on the client hostname or network address .
Example:
smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination
Note: you must specify at least one of the following restrictions: reject, defer, defer_if_permit, or reject_unauth_destination. Postfix will refuse to receive mail otherwise.
Restrictions:
permit_auth_destination
Permit the request when one of the following is true:
* the resolved destination address matches $relay_domains or a subdomain thereof, and the address contains no sender-specified routing (user@elsewhere@domain),
* Postfix is the final destination: any destination that matches $mydestination, $inet_interfaces, $virtual_alias_domains, or $virtual_mailbox_domains.
reject_unauth_destination
Reject the request unless one of the following is true:
* the resolved destination address matches $relay_domains or a subdomain thereof, and the address contains no sender-specified routing (user@elsewhere@domain),
* Postfix is the final destination: any destination that matches $mydestination, $inet_interfaces, $virtual_alias_domains, or $virtual_mailbox_domains.
The relay_domains_reject_code parameter specifies the response code for rejected requests (default: 554).
permit_mx_backup
Permit the request when the local mail system is MX host for the resolved destination. This includes the case that the local mail system is the final destination. However, the SMTP server will not forward mail with addresses that have sender-specified routing information (example: user@elsewhere@domain),
Use the optional
permit_mx_backup_networksparameter to also require that the primary MX hosts match a list of network blocks.
Relevant configuration parameters: permit_mx_backup_networks, $mydestination, $inet_interfaces.
check_recipient_access maptype:mapname
maptype:mapname
Search the named access database for the resolved destination address, recipient domain or parent domain, or localpart@.
check_recipient_maps
Reject the request when the recipient address is not listed in one of the following lookup tables:
- Recipient domain matches---------------------> Recipient lookup table
$mydestination or
$inet_interfaces ------------------------------------> $local_recipient_maps
$virtual_alias_domains----------------------------> $virtual_alias_maps
$virtual_mailbox_domains ------------------------> $virtual_mailbox_maps
$relay_domains-------------------------------------> $relay_recipient_maps