646 lines
27 KiB
CFEngine3
646 lines
27 KiB
CFEngine3
# $NetBSD: sample-smtpd.cf,v 1.3 2003/03/08 19:43:58 perry Exp $
|
|
#
|
|
# DO NOT EDIT THIS FILE. EDIT THE MAIN.CF FILE INSTEAD. THE STUFF
|
|
# HERE JUST SERVES AS AN EXAMPLE.
|
|
#
|
|
# This file contains example settings of Postfix configuration parameters
|
|
# that control the SMTP server program.
|
|
|
|
# REJECTING MAIL FOR UNKNOWN LOCAL USERS
|
|
#
|
|
# The local_recipient_maps parameter specifies optional lookup tables
|
|
# with all names or addresses of users that are local with respect
|
|
# to $mydestination and $inet_interfaces.
|
|
#
|
|
# If this parameter is defined, then the SMTP server will reject
|
|
# mail for unknown local users. This parameter is defined by default.
|
|
#
|
|
# To turn off local recipient checking in the SMTP server, specify
|
|
# local_recipient_maps = (i.e. empty).
|
|
#
|
|
# The default setting assumes that you use the default Postfix local
|
|
# delivery agent for local delivery. You need to update the
|
|
# local_recipient_maps setting if:
|
|
#
|
|
# - You define $mydestination domain recipients in files other than
|
|
# /etc/passwd, /etc/aliases, or the $virtual_alias_maps files.
|
|
# For example, you define $mydestination domain recipients in
|
|
# the $virtual_mailbox_maps files.
|
|
#
|
|
# - You redefine the local delivery agent in master.cf.
|
|
#
|
|
# - You redefine the "local_transport" setting in main.cf.
|
|
#
|
|
# - You use the "luser_relay", "mailbox_transport", or "fallback_transport"
|
|
# feature of the Postfix local delivery agent (see sample-local.cf).
|
|
#
|
|
# Details are described in the LOCAL_RECIPIENT_README file.
|
|
#
|
|
# Beware: if the Postfix SMTP server runs chrooted, you probably have
|
|
# to access the passwd file via the proxymap service, in order to
|
|
# overcome chroot restrictions. The alternative, having a copy of
|
|
# the system passwd file in the chroot jail is just not practical.
|
|
#
|
|
# The right-hand side of the lookup tables is conveniently ignored.
|
|
# In the left-hand side, specify a bare username, an @domain.tld
|
|
# wild-card, or specify a user@domain.tld address.
|
|
#
|
|
#local_recipient_maps =
|
|
#local_recipient_maps = unix:passwd.byname $alias_maps
|
|
local_recipient_maps = proxy:unix:passwd.byname $alias_maps
|
|
|
|
# The unknown_local_recipient_reject_code specifies the SMTP server
|
|
# response code when a recipient domain matches $mydestination or
|
|
# $inet_interfaces, while $local_recipient_maps is non-empty and the
|
|
# recipient address or address local-part is not found.
|
|
#
|
|
# The default setting is 550 (reject mail) but it is safer to start
|
|
# with 450 (try again later) until you are certain that your
|
|
# local_recipient_maps settings are OK.
|
|
#
|
|
#unknown_local_recipient_reject_code = 450
|
|
unknown_local_recipient_reject_code = 550
|
|
|
|
# REJECTING UNKNOWN RELAY USERS
|
|
#
|
|
# The relay_recipient_maps parameter specifies optional lookup tables
|
|
# with all addresses in the domains that match $relay_domains.
|
|
#
|
|
# If this parameter is defined, then the SMTP server will reject
|
|
# mail for unknown relay users. This feature is off by default.
|
|
#
|
|
# The right-hand side of the lookup tables is conveniently ignored.
|
|
# In the left-hand side, specify an @domain.tld wild-card, or specify
|
|
# a user@domain.tld address.
|
|
#
|
|
#relay_recipient_maps = hash:/etc/postfix/relay_recipients
|
|
|
|
#
|
|
# SENDER ANTI-SPOOFING
|
|
#
|
|
|
|
# The smtpd_sender_login_maps parameter specifies the (SASL) login
|
|
# name that owns a sender (MAIL FROM) address.
|
|
#
|
|
# Specify zero or more maptype:mapname entries. Maps are created with
|
|
# postmap(1) or with equivalent means. The maps are searched in the
|
|
# specified order. Regexp tables are allowed.
|
|
#
|
|
# Each map entry specifies a sender address and the login name that
|
|
# owns the address. The search order is:
|
|
#
|
|
# 1) user@domain owner
|
|
#
|
|
# This form has the highest precedence.
|
|
#
|
|
# 2) user owner
|
|
#
|
|
# This matches user@site when site is equal to $myorigin, when site
|
|
# is listed in $mydestination, or when it is listed in $inet_interfaces.
|
|
#
|
|
# 3) @domain owner
|
|
#
|
|
# This matches every address in the specified domain, and has the
|
|
# lowest precedence.
|
|
#
|
|
#smtpd_sender_login_maps =
|
|
|
|
#
|
|
# MISCELLANEOUS
|
|
#
|
|
|
|
# The disable_vrfy_command parameter allows you to disable the SMTP
|
|
# VRFY command. This stops some techniques used by spammers to harvest
|
|
# email addresses.
|
|
#
|
|
#disable_vrfy_command = no
|
|
|
|
# The smtpd_banner parameter specifies the text that follows the 220
|
|
# status code in the SMTP greeting banner. Some people like to see
|
|
# the mail version advertised. By default, Postfix shows no version.
|
|
#
|
|
# You MUST specify the $myhostname at the start of the text.
|
|
#
|
|
#smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
|
|
smtpd_banner = $myhostname ESMTP $mail_name
|
|
|
|
# The smtpd_etrn_restrictions parameter restricts what clients are
|
|
# allowed to issue the ETRN command.
|
|
#
|
|
# The Postfix ETRN command accepts only destinations that are eligible
|
|
# for the Postfix "fast flush" service. See the sample-flush.cf file
|
|
# for details.
|
|
#
|
|
# The default is to allow ETRN from any host. The following restrictions
|
|
# are available:
|
|
#
|
|
# reject_unknown_client: reject the request if the client hostname is unknown.
|
|
# permit_mynetworks: permit if the client address matches $mynetworks.
|
|
# check_client_access maptype:mapname
|
|
# look up client name, parent domains, client address,
|
|
# or networks obtained by stripping octets.
|
|
# Skip this lookup table if the result is DUNNO.
|
|
# Reject the ETRN command if the result is REJECT text... or "[45]xx text"
|
|
# Permit the ETRN command if the result is OK or all numerical.
|
|
# reject_rbl_client domain.tld: reject if the reverse client network
|
|
# address is listed in an A record under domain.tld.
|
|
# reject_rhsbl_client domain.tld: reject if the client hostname is listed
|
|
# in an A record under domain.tld.
|
|
# reject: reject the request. Place this at the end of a restriction.
|
|
# permit: permit the request. Place this at the end of a restriction.
|
|
# warn_if_reject: next restriction logs a warning instead of rejecting.
|
|
#
|
|
# You may also list any helo or client restrictions here (see below).
|
|
#
|
|
smtpd_etrn_restrictions =
|
|
|
|
# The smtpd_history_flush_threshold specifies how many lines the SMTP
|
|
# server command history is allowed to contain before it is flushed
|
|
# to postmaster upon receipt of EHLO, RSET, or end of DATA.
|
|
#
|
|
smtpd_history_flush_threshold = 100
|
|
|
|
# The smtpd_noop_commands parameter specifies a list of commands that
|
|
# the Postfix SMTP server replies to with "250 Ok", without doing any
|
|
# syntax checks and without changing state. This list overrides any
|
|
# commands built into the Postfix SMTP server.
|
|
#
|
|
smtpd_noop_commands =
|
|
|
|
# The smtpd_recipient_limit parameter restricts the number of recipients
|
|
# that the SMTP server accepts per message delivery.
|
|
#
|
|
smtpd_recipient_limit = 1000
|
|
|
|
# The smtpd_timeout parameter limits the time to send an SMTP server
|
|
# response and to receive an SMTP client request.
|
|
#
|
|
# Note: if you set SMTP timeouts to large values you must update the
|
|
# global ipc_timeout parameter as well. See sample-misc.cf for details.
|
|
#
|
|
# Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
# The default time unit is s (seconds).
|
|
#
|
|
smtpd_timeout = 300s
|
|
|
|
# The strict_rfc821_envelopes configuration parameter controls whether
|
|
# the Postfix SMTP server requires that MAIL FROM and RCPT TO addresses
|
|
# are specified within <>, and that MAIL FROM and RCPT TO addresses
|
|
# do not contain RFC822-style comments or phrases. It's great to
|
|
# stop SPAM mailers. But it also trips up broken peecee clients.
|
|
#
|
|
# By default, Postfix SMTPD allows RFC822 syntax in MAIL FROM and RCPT TO.
|
|
#
|
|
strict_rfc821_envelopes = no
|
|
|
|
#
|
|
# TARPIT CONTROLS
|
|
#
|
|
|
|
# The smtpd_error_sleep_time parameter specifies the time in seconds
|
|
# the SMTP server waits before sending a 4xx or 5xx SMTP server error
|
|
# response. This prevents naive clients from going into an error -
|
|
# disconnect - connect - error loop.
|
|
#
|
|
smtpd_error_sleep_time = 1s
|
|
|
|
# The smtpd_soft_error_limit parameter specifies an error count lower
|
|
# limit. When an SMTP client has made this number of errors within
|
|
# a session, the server waits error_count seconds before responding
|
|
# to any client request.
|
|
#
|
|
smtpd_soft_error_limit = 10
|
|
|
|
# The smtpd_hard_error_limit parameter specifies an error count upper
|
|
# limit. The SMTP server disconnects after an SMTP client makes this
|
|
# number of errors within a session.
|
|
#
|
|
smtpd_hard_error_limit = 20
|
|
|
|
#
|
|
# UCE RESTRICTIONS
|
|
#
|
|
|
|
# The mynetworks parameter specifies the list of "trusted" SMTP
|
|
# clients that have more privileges than "strangers".
|
|
#
|
|
# In particular, "trusted" SMTP clients are allowed to relay mail
|
|
# through Postfix. See the smtpd_recipient_restrictions parameter
|
|
# in file sample-smtpd.cf.
|
|
#
|
|
# You can specify the list of "trusted" network addresses by hand
|
|
# or you can let Postfix do it for you (which is the default).
|
|
#
|
|
# By default (mynetworks_style = subnet), Postfix "trusts" SMTP
|
|
# clients in the same IP subnetworks as the local machine.
|
|
#
|
|
# Specify "mynetworks_style = class" when Postfix should "trust" SMTP
|
|
# clients in the same IP class A/B/C networks as the local machine.
|
|
# Don't do this with a dialup site - it would cause Postfix to "trust"
|
|
# your entire provider's network. Instead, specify an explicit
|
|
# mynetworks list by hand, as described below.
|
|
#
|
|
# Specify "mynetworks_style = host" when Postfix should "trust"
|
|
# only the local machine.
|
|
#
|
|
#mynetworks_style = class
|
|
mynetworks_style = subnet
|
|
#mynetworks_style = host
|
|
|
|
# Alternatively, you can specify the mynetworks list by hand, in
|
|
# which case Postfix ignores the mynetworks_style setting.
|
|
#
|
|
# Specify an explicit list of network/netmask patterns, where the
|
|
# mask specifies the number of bits in the network part of a host
|
|
# address.
|
|
#
|
|
# You can also specify the absolute pathname of a pattern file instead
|
|
# of listing the patterns here. Specify type:table for table-based lookups
|
|
# (the value on the table right-hand side is not used).
|
|
#
|
|
#mynetworks = 168.100.189.0/28, 127.0.0.0/8
|
|
#mynetworks = $config_directory/mynetworks
|
|
#mynetworks = hash:/etc/postfix/network_table
|
|
|
|
# The smtpd_client_restrictions parameter specifies optional restrictions
|
|
# on SMTP client host names and addresses.
|
|
#
|
|
# The default is to allow connections from any host. The following
|
|
# restrictions are available:
|
|
#
|
|
# reject_unknown_client: reject the request if the client hostname is unknown.
|
|
# permit_mynetworks: permit if the client address matches $mynetworks.
|
|
# check_client_access maptype:mapname
|
|
# look up client name, parent domains, client address,
|
|
# or networks obtained by stripping octets.
|
|
# Skip this lookup table if the result is DUNNO.
|
|
# Reject the SMTP client if the result is REJECT text... or "[45]xx text"
|
|
# Discard the message if the result is DISCARD text...
|
|
# Hold the message in the queue if the result is HOLD text...
|
|
# Release mail "on hold" with the postsuper(1) command.
|
|
# Filter the message if the result is FILTER transport:nexthop.
|
|
# Permit the SMTP client if the result is OK or all numerical.
|
|
# reject_rbl_client domain.tld: reject if the reversed client IP address
|
|
# is listed in an A record under domain.tld.
|
|
# reject_rhsbl_client domain.tld: reject if the client hostname is listed
|
|
# in an A record under domain.tld.
|
|
# reject: reject the request. Place this at the end of a restriction.
|
|
# permit: permit the request. Place this at the end of a restriction.
|
|
# warn_if_reject: next restriction logs a warning instead of rejecting.
|
|
#
|
|
# Restrictions are applied in the order as specified; the first
|
|
# restriction that matches wins.
|
|
#
|
|
# You may also list any helo, sender or recipient restrictions here.
|
|
# These will have effect only when smtpd_delay_reject=yes, so that all
|
|
# restrictions are evaluated at the time of the RCPT TO command.
|
|
#
|
|
# Specify a list of restrictions, separated by commas and/or whitespace.
|
|
# Continue long lines by starting the next line with whitespace.
|
|
#
|
|
#smtpd_client_restrictions = permit_mynetworks, reject_unknown_client
|
|
smtpd_client_restrictions =
|
|
|
|
# The smtpd_helo_required parameter optionally turns on the requirement
|
|
# that SMTP clients must introduce themselves at the beginning of an
|
|
# SMTP session.
|
|
#
|
|
#smtpd_helo_required = yes
|
|
smtpd_helo_required = no
|
|
|
|
# The smtpd_helo_restrictions parameter specifies optional restrictions
|
|
# on what SMTP clients can send in SMTP HELO and EHLO commands.
|
|
#
|
|
# The default is to permit everything. The following restrictions
|
|
# are available:
|
|
#
|
|
# permit_mynetworks: permit if the client address matches $mynetworks.
|
|
# reject_invalid_hostname: reject HELO hostname with bad syntax.
|
|
# reject_unknown_hostname: reject HELO hostname without DNS A or MX record.
|
|
# reject_non_fqdn_hostname: reject HELO hostname that is not in FQDN form
|
|
# check_helo_access maptype:mapname
|
|
# look up HELO hostname or parent domains.
|
|
# Skip this lookup table if the result is DUNNO.
|
|
# Reject the HELO command if the result is REJECT text... or "[45]xx text"
|
|
# Discard the message if the result is DISCARD text...
|
|
# Hold the message in the queue if the result is HOLD text...
|
|
# Release mail "on hold" with the postsuper(1) command.
|
|
# Filter the message if the result is FILTER transport:nexthop.
|
|
# Permit the HELO command if the result is OK or all numerical.
|
|
# reject: reject the request. Place this at the end of a restriction.
|
|
# permit: permit the request. Place this at the end of a restriction.
|
|
# warn_if_reject: next restriction logs a warning instead of rejecting.
|
|
#
|
|
# Restrictions are applied in the order as specified; the first
|
|
# restriction that matches wins.
|
|
#
|
|
# You may also list any client, sender or recipient restrictions here.
|
|
# Sender and recipient restrictions will have effect only when
|
|
# smtpd_delay_reject=yes, so that all restrictions are evaluated at
|
|
# the time of the RCPT TO command.
|
|
#
|
|
# Specify a list of restrictions, separated by commas and/or whitespace.
|
|
# Continue long lines by starting the next line with whitespace.
|
|
#
|
|
#smtpd_helo_restrictions = permit_mynetworks, reject_invalid_hostname
|
|
#smtpd_helo_restrictions = permit_mynetworks, reject_unknown_hostname
|
|
smtpd_helo_restrictions =
|
|
|
|
# The smtpd_sender_restrictions parameter specifies optional restrictions
|
|
# on sender addresses that SMTP clients can send in MAIL FROM commands.
|
|
#
|
|
# The default is to permit any sender address. The following
|
|
# restrictions are available:
|
|
#
|
|
# permit_mynetworks: permit if the client address matches $mynetworks.
|
|
# reject_unknown_sender_domain: reject sender domain without A or MX record.
|
|
# reject_rhsbl_sender domain.tld: reject sender domain name if it is listed
|
|
# in an A record under domain.tld.
|
|
# check_sender_access maptype:mapname
|
|
# look up sender address, parent domain, or localpart@.
|
|
# Skip this lookup table if the result is DUNNO.
|
|
# Reject the sender if the result is REJECT text... or "[45]xx text"
|
|
# Discard the message if the result is DISCARD text...
|
|
# Hold the message in the queue if the result is HOLD text...
|
|
# Release mail "on hold" with the postsuper(1) command.
|
|
# Filter the message if the result is FILTER transport:nexthop.
|
|
# Permit the sender if the result is OK or all numerical.
|
|
# reject_sender_login_mismatch: reject if $smtpd_sender_login_maps specifies
|
|
# a MAIL FROM address owner, but the client is not (SASL) logged in as
|
|
# that MAIL FROM address owner; or if the client is (SASL) logged in, but
|
|
# the client login name doesn't own the MAIL FROM address according to
|
|
# $smtpd_sender_login_maps (see above).
|
|
# reject_non_fqdn_sender: reject sender address that is not in FQDN form
|
|
# reject: reject the request. Place this at the end of a restriction.
|
|
# permit: permit the request. Place this at the end of a restriction.
|
|
# warn_if_reject: next restriction logs a warning instead of rejecting.
|
|
#
|
|
# Restrictions are applied in the order as specified; the first
|
|
# restriction that matches wins.
|
|
#
|
|
# You may also list any helo, client or recipient restrictions here.
|
|
# Recipient restrictions will have effect only when smtpd_delay_reject=yes,
|
|
# so that all restrictions are evaluated at the time of the RCPT TO
|
|
# command.
|
|
#
|
|
# Specify a list of restrictions, separated by commas and/or whitespace.
|
|
# Continue long lines by starting the next line with whitespace.
|
|
#
|
|
#smtpd_sender_restrictions = reject_unknown_sender_domain
|
|
#smtpd_sender_restrictions = reject_unknown_sender_domain, hash:/etc/postfix/access
|
|
smtpd_sender_restrictions =
|
|
|
|
# The smtpd_recipient_restrictions parameter specifies restrictions on
|
|
# recipient addresses that SMTP clients can send in RCPT TO commands.
|
|
#
|
|
# By default, Postfix relays mail
|
|
# - from "trusted" clients (IP address matches $mynetworks) to any destination,
|
|
# - from "untrusted" clients to destinations that match $relay_domains
|
|
# or subdomains thereof, except addresses with sender-specified routing.
|
|
# The default relay_domains value is $mydestination.
|
|
#
|
|
# In addition to the above, the Postfix SMTP server by default accepts mail
|
|
# that Postfix is final destination for:
|
|
# - destinations that match $inet_interfaces,
|
|
# - destinations that match $mydestination
|
|
# - destinations that match $virtual_alias_domains,
|
|
# - destinations that match $virtual_mailbox_domains.
|
|
# These destinations do not need to be listed in $relay_domains.
|
|
#
|
|
# The following restrictions are available (* is part of default setting):
|
|
#
|
|
# *permit_mynetworks: permit if the client address matches $mynetworks.
|
|
# reject_unknown_sender_domain: reject sender domain without A or MX record.
|
|
# reject_rhsbl_recipient domain.tld: reject recipient domain name if it is
|
|
# listed in an A record under domain.tld.
|
|
# permit_auth_destination: permit mail
|
|
# - to destinations matching $inet_interfaces, $mydestination,
|
|
# $virtual_alias_domains, or $virtual_mailbox_domains.
|
|
# - to destinations matching $relay_domains or subdomain thereof,
|
|
# except for addresses with sender-specified routing.
|
|
# reject_unauth_destination: reject mail unless it is sent
|
|
# - to destinations matching $inet_interfaces, $mydestination,
|
|
# $virtual_alias_domains, or $virtual_mailbox_domains.
|
|
# - to destinations matching $relay_domains or subdomain thereof,
|
|
# except for addresses with sender-specified routing.
|
|
# reject_unauth_pipelining: reject mail from improperly pipelining spamware
|
|
# permit_mx_backup: accept mail for sites that list me as MX host.
|
|
# Use the optional permit_mx_backup_networks parameter to also
|
|
# require that the primary MX hosts match a list of network blocks.
|
|
# reject_unknown_recipient_domain: reject domains without A or MX record.
|
|
# check_recipient_access maptype:mapname
|
|
# look up recipient address, parent domain, or localpart@.
|
|
# Skip this lookup table if the result is DUNNO.
|
|
# Reject the recipient if the result is REJECT text... or "[45]xx text"
|
|
# Discard the message if the result is DISCARD text...
|
|
# Hold the message in the queue if the result is HOLD text...
|
|
# Release mail "on hold" with the postsuper(1) command.
|
|
# Filter the message if the result is FILTER transport:nexthop.
|
|
# Permit the recipient if the result is OK or all numerical.
|
|
# reject_non_fqdn_recipient: reject recipient address that is not in FQDN form
|
|
# reject: reject the request. Place this at the end of a restriction.
|
|
# permit: permit the request. Place this at the end of a restriction.
|
|
# warn_if_reject: next restriction logs a warning instead of rejecting.
|
|
#
|
|
# Restrictions are applied in the order as specified; the first
|
|
# restriction that matches wins.
|
|
#
|
|
# You may also list any helo, client or sender restrictions here.
|
|
#
|
|
# Specify a list of restrictions, separated by commas and/or whitespace.
|
|
# Continue long lines by starting the next line with whitespace.
|
|
#
|
|
# NOTE: YOU MUST SPECIFY AT LEAST ONE OF THE FOLLOWING RESTRICTIONS
|
|
# OTHERWISE POSTFIX REFUSES TO RECEIVE MAIL:
|
|
# reject, defer, defer_if_permit, reject_unauth_destination
|
|
#
|
|
smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination
|
|
|
|
#
|
|
# ADDITIONAL UCE CONTROLS
|
|
#
|
|
|
|
# The allow_untrusted_routing parameter controls if Postfix will
|
|
# forward mail with sender-specified routing (user[@%!]remote[@%!]site)
|
|
# from untrusted clients to destinations that are blessed by the
|
|
# relay_domains parameter.
|
|
#
|
|
# By default, untrusted clients are not allowed to specify routing.
|
|
# This closes a nasty open relay loophole where a backup MX host can
|
|
# be tricked into forwarding junk mail to a primary MX host which
|
|
# then spams it out to the world.
|
|
#
|
|
# This parameter also controls if non-local addresses with sender-specified
|
|
# routing can match Postfix access tables. By default, such addresses
|
|
# cannot match Postfix access tables, because the address is ambigous.
|
|
#
|
|
allow_untrusted_routing = no
|
|
|
|
# The relay_domains parameter restricts what destination domains (and
|
|
# subdomains thereof) this system will relay mail to.
|
|
#
|
|
# These domains are routed to the delivery agent specified with the
|
|
# relay_transport parameter setting.
|
|
#
|
|
# By default, Postfix relays mail
|
|
# - from trusted clients whose IP address matches $mynetworks,
|
|
# - from any client to destinations that match $relay_domains or
|
|
# subdomains thereof, except addresses with sender-specified routing.
|
|
# The default relay_domains value is $mydestination.
|
|
#
|
|
# In addition to the above, the Postfix SMTP server by default accepts mail
|
|
# that Postfix is final destination for:
|
|
# - destinations that match $inet_interfaces,
|
|
# - destinations that match $mydestination
|
|
# - destinations that match $virtual_alias_domains,
|
|
# - destinations that match $virtual_mailbox_domains.
|
|
# These destinations do not need to be listed in $relay_domains.
|
|
#
|
|
# Specify a list of hosts or domains, /file/name patterns or type:name
|
|
# lookup tables, separated by commas and/or whitespace. Continue
|
|
# long lines by starting the next line with whitespace. A file name
|
|
# is replaced by its contents; a type:name table is matched when a
|
|
# (parent) domain appears as lookup key.
|
|
#
|
|
# NOTE: Postfix will not automatically forward mail for domains that
|
|
# list this system as their primary or backup MX host. See the
|
|
# permit_mx_backup restriction, in the description of the
|
|
# smtpd_recipient_restrictions parameter.
|
|
#
|
|
relay_domains = $mydestination
|
|
|
|
# The relay_recipient_maps parameter specifies optional lookup tables
|
|
# with all addresses in the domains that match $relay_domains.
|
|
#
|
|
# If this parameter is defined, then the SMTP server will reject
|
|
# mail to unknown relay users. This feature is off by default.
|
|
#
|
|
#relay_recipient_maps = hash:/etc/postfix/relay_recipients
|
|
|
|
#
|
|
# RESPONSE CODES
|
|
#
|
|
|
|
# The access_map_reject_code parameter specifies the SMTP server
|
|
# response code when a client violates an access map restriction.
|
|
#
|
|
# Do not change this unless you have a complete understanding of RFC 821.
|
|
#
|
|
access_map_reject_code = 550
|
|
|
|
# The default_rbl_reply parameter specifies the SMTP server response
|
|
# when an SMTP client request is rejected by a reject_rbl or reject_rhsbl
|
|
# restriction.
|
|
#
|
|
# The template is subject to exactly one level of $name substitution:
|
|
#
|
|
# $client: client hostname and IP address, formatted as name[address].
|
|
# $client_name: client hostname or unknown.
|
|
# $client_address: client IP address.
|
|
# $helo_name: hostname given in HELO or EHLO command or empty string.
|
|
# $sender: sender address or <> in case of the null address.
|
|
# $sender_name: sender address localpart or <> in case of the null address.
|
|
# $sender_domain: sender address domain or empty string.
|
|
# $recipient: recipient address or <> in case of the null address.
|
|
# $recipient_name: recipient address localpart or <> in case of null address.
|
|
# $recipient_domain: recipient address domain or empty string.
|
|
# $rbl_what: the entity that is blacklisted (an IP address, a hostname,
|
|
# a domain name, or an email address whose domain was blacklisted).
|
|
# $rbl_reason: reason why $rbl_what is blacklisted or empty string.
|
|
# $rbl_domain: RBL domain where $rbl_what is blacklisted.
|
|
# $rbl_class: the blacklisted entity type: Client host, Helo command,
|
|
# Sender address, or Recipient address.
|
|
# $rbl_code: numerical server reply code, as specified with the
|
|
# maps_rbl_reject_code configuration parameter.
|
|
#
|
|
# The smtpd_expansion_filter configuration parameter controls what
|
|
# characters may appear in $name expansions.
|
|
#
|
|
# Instead of $name you can also specify ${name} or $(name).
|
|
#
|
|
# Conditional expansion:
|
|
#
|
|
# ${name?text} expands to `text' if $name is not empty.
|
|
# ${name:text} expands to `text' if $name is empty.
|
|
#
|
|
default_rbl_reply = $rbl_code Service unavailable; $rbl_class [$rbl_what]
|
|
blocked using $rbl_domain${rbl_reason?; $rbl_reason}
|
|
|
|
# The defer_code parameter specifies the SMTP server response code
|
|
# when an SMTP client request is rejected by the "defer" restriction.
|
|
#
|
|
# Do not change this unless you have a complete understanding of RFC 821.
|
|
#
|
|
defer_code = 450
|
|
|
|
# The invalid_hostname_reject_code parameter specifies the SMTP server
|
|
# response when a client violates the reject_invalid_hostname anti-UCE
|
|
# restriction.
|
|
#
|
|
# Do not change this unless you have a complete understanding of RFC 821.
|
|
#
|
|
invalid_hostname_reject_code = 501
|
|
|
|
# The maps_rbl_reject_code parameter specifies the SMTP server response
|
|
# when an SMTP client request is blocked by a reject_rbl or reject_rhsbl
|
|
# restriction.
|
|
#
|
|
# Do not change this unless you have a complete understanding of RFC 821.
|
|
#
|
|
maps_rbl_reject_code = 550
|
|
|
|
# The rbl_reply_maps parameter specifies tables with RBL response
|
|
# templates, indexed by RBL domain name. By default, Postfix uses
|
|
# the default template as specified with the default_rbl_reply
|
|
# configuration parameter. See there for a discussion of the syntax
|
|
# of RBL reply templates.
|
|
#
|
|
rbl_reply_maps =
|
|
|
|
# The reject_code parameter specifies the SMTP server response code
|
|
# when an SMTP client matches a reject restriction.
|
|
#
|
|
# Do not change this unless you have a complete understanding of RFC 821.
|
|
#
|
|
reject_code = 550
|
|
|
|
# The relay_domains_reject_code parameter specifies the SMTP server
|
|
# response when a client attempts to violate the mail relay policy.
|
|
#
|
|
# Do not change this unless you have a complete understanding of RFC 821.
|
|
#
|
|
relay_domains_reject_code = 550
|
|
|
|
# The smtpd_expansion_filter parameter specifies what characters are
|
|
# allowed in $name expansions of RBL reply templates. Characters not
|
|
# in the allowed set are replaced by "_". Use C like escapes to
|
|
# specify special characters such as whitespace.
|
|
#
|
|
# This parameter is not subjected to the usual main.cf macro expansion.
|
|
#
|
|
smtpd_expansion_filter = \t\40!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~
|
|
|
|
# The unknown_address_reject_code parameter specifies the SMTP server
|
|
# response when a client violates the reject_unknown_sender_domain
|
|
# or reject_unknown_recipient_domain restrictions.
|
|
#
|
|
# Do not change this unless you have a complete understanding of RFC 821.
|
|
#
|
|
unknown_address_reject_code = 450
|
|
|
|
# The unknown_client_reject_code parameter specifies the SMTP server
|
|
# response when a client without address to name mapping violates
|
|
# the reject_unknown_client restriction.
|
|
#
|
|
# Do not change this unless you have a complete understanding of RFC 821.
|
|
#
|
|
unknown_client_reject_code = 450
|
|
|
|
# The unknown_hostname_reject_code parameter specifies the SMTP server
|
|
# response when a client violates the reject_unknown_hostname
|
|
# restriction.
|
|
#
|
|
# Do not change this unless you have a complete understanding of RFC 821.
|
|
#
|
|
unknown_hostname_reject_code = 450
|