Domain – Postfix relay mails from a single domain and IP

domainemailpostfixsmtp

we have an Mdaemon server which redirects outbound mails to an external basic Postfix relayer. We have configured firewall rules (in front of postfix server) to accept smtp requests only from the public IP of the Mdaemon primary mail server. We also has configured this IP in main.cf mynetworks parameters.

mynetworks = 127.0.0.0/8 <public IP Mdaemon SVR>/32

We noticed that we were receiving mails with From=anyuser@anydomain bounced from the primary mail server and want to accept only requests with FROM=users@mydomain and reject the rest. We have read about it and the simplier way seems to be using smtpd_recipient_restrictions so we did,

  1. At main.cf added

    smtpd_recipient_restrictions = permit_mynetworks, check_sender_access hash:/etc/postfix/sender_access reject_unauth_destination

  2. Created /etc/postfix/sender_access
    mydomain OK

  3. postmap /etc/postfix/sender_access and postfix reload

However we keep getting logs accepting mails from other domains,

postfix/smtpd[27967]: connect from unknown[Public IP MDaemon]
postfix/smtpd[27967]: EBC3826081: client=unknown[Public IP MDaemon]
postfix/cleanup[27970]: EBC3826081: message-id=etPan.6d56418c.db552cb5.527d@server.local
postfix/qmgr[27675]: EBC3826081: from=otheruser@otherdomain, size=33492, nrcpt=1 (queue active)
postfix/smtpd[27967]: disconnect from unknown[Public Ip Maemon]
postfix/smtp[27971]: EBC3826081: to=<oneuser@onedomain>, ..., status=sent (250 Ok, message saved <Message-ID: etPan.6d56418c.db552cb5.527d@server.local>)

or sometimes is rejected by antispammers (blacklist, greylists,..).

So, we will be grateful if you could help us to make this work, and any suggestion to secure this environment will be welcome.

Best Answer

I'm not sure I really understood what you are asking for, but this answer might help you understanding what's going on :

According to the logs you provided, you receive mail from the MDaemon server.

Since you put his IP in mynetworks, mail will automatically be accepted. No further processing will be done, especially /etc/postfix/sender_access won't be checked.

Put an IP adresse in mynetworks only if you really trust all mail originating from it, blindly.

Related Topic