postfix-master/uce.html

   1 <html>
   2
   3 <head>
   4
   5 <title> Postfix Configuration - UCE Controls</title>
   6
   7 <META NAME="ROBOTS" CONTENT="NOINDEX,NOFOLLOW">
   8 </head>
   9
  10 <body background="obsolete.gif">
  11
  12 <h1><a href="big-picture.html"><img src="small-picture.gif" width="115" height="45"></a>
  13 Postfix Configuration - UCE Controls</h1>
  14
  15 <hr>
  16
  17 <p> <strong> Note: this web page is no longer maintained. It exists
  18 only to avoid breaking links in web pages that describe earlier
  19 versions of the Postfix mail system. </strong> </p>
  20
  21 <a href="index.html">Up one level</a> | <a href="basic.html">Basic
  22 Configuration</a> | UCE Controls | <a href="rate.html">Rate
  23 Controls</a> | <a href="resource.html">Resource Controls</a> | <a
  24 href="rewrite.html">Address Manipulation </a>
  25
  26 <h2> Introduction</h2>
  27
  28 Postfix offers a variety of parameters that limit the delivery of
  29 unsolicited commercial email (UCE).
  30
  31 <p>
  32
  33 By default, the Postfix <a href="smtpd.8.html">SMTP server</a> will
  34 accept mail only from or to the local network or domain, or to
  35 domains that are hosted by Postfix, so that your system can't be
  36 used as a mail relay to forward bulk mail from random strangers.
  37
  38 <p>
  39
  40 The text in this document describes how you can set up more detailed
  41 anti-UCE policies that prevent delivery of unwanted email altogether,
  42 for example with sendmail-style <b>access</b> lists or with <b>RBL</b>
  43 (real-time blackhole list) name servers.
  44
  45 <p> Unless indicated otherwise, all parameters described here are
  46 in the <b>main.cf</b> file. If you change parameters of a running
  47 Postfix system, don't forget to issue a <b>postfix reload</b>
  48 command.
  49
  50 <ul>
  51
  52 <li> <a href="#header_checks">Header filtering</a>
  53
  54 <p>
  55
  56 <li> <a href="#body_checks">Body filtering</a>
  57
  58 <p>
  59
  60 <li> <a href="#smtpd_client_restrictions">Client hostname/address
  61 restrictions</a>
  62
  63 <p>
  64
  65 <li> <a href="#smtpd_helo_required">Require HELO (EHLO) command </a>
  66
  67 <p>
  68
  69 <li> <a href="#smtpd_helo_restrictions">HELO (EHLO) hostname
  70 restrictions</a>
  71
  72 <p>
  73
  74 <li> <a href="#strict_rfc821_envelopes">Require strict RFC 821-style
  75 envelope addresses </a>
  76
  77 <p>
  78
  79 <li> <a href="#smtpd_sender_restrictions">Sender address restrictions
  80 </a>
  81
  82 <p>
  83
  84 <li> <a href="#smtpd_recipient_restrictions">Recipient address
  85 restrictions</a>
  86
  87 <p>
  88
  89 <li> <a href="#smtpd_etrn_restrictions">ETRN command restrictions</a>
  90
  91 <p>
  92
  93 <li> <a href="#generic">Generic restrictions</a>
  94
  95 <p>
  96
  97 <li> <a href="#additional">Additional UCE control parameters</a>
  98
  99 </ul>
 100
 101 <a name="header_checks">
 102
 103 <h2> Header filtering</h2>
 104
 105 The <b>header_checks</b> parameter restricts what is allowed in
 106 message headers. Patterns are applied to entire logical message
 107 headers, even when a header spans multiple lines of text.
 108
 109 <p>
 110
 111 By default, the same <b>header_checks</b> patterns are used for
 112 primary message headers, for MIME headers (including headers at
 113 the start of multipart body parts), and for the headers at the
 114 beginning of attached email messages.
 115
 116 <p>
 117
 118 <dl>
 119
 120 <dt>Default:
 121
 122 <dd>Allow anything in message headers.
 123
 124 <p>
 125
 126 <dt>Syntax:
 127
 128 <dd>Specify a list of zero or more lookup tables. Whenever a header
 129 matches a table, the action depends on the lookup result:
 130
 131 <p>
 132
 133 <dl>
 134
 135 <dt>REJECT <dd>
 136
 137 <dt>REJECT text... <dd>
 138
 139 Reject the message, log the header and the optional text,
 140 and send the optional text to the originator.
 141
 142 <dt>OK <dd>Skip all further header patterns for this header line.
 143
 144 <dt>IGNORE <dd> Delete the header line from the message.
 145
 146 <dt>WARN <dd>
 147
 148 <dt>WARN text... <dd>
 149
 150 Log (but do not reject) the header with a warning, and log the
 151 optional text.
 152
 153 <dt>HOLD <dd>
 154
 155 <dt>HOLD text... <dd>
 156
 157 Place the message on the <b>hold</b> queue. Mail on hold can be
 158 inspected with the <a href="postcat.1.html">postcat</a> command,
 159 and can be destroyed or taken off hold with the <a
 160 href="postsuper.1.html">postsuper</a> command.
 161 The optional text is logged together with the matched text.
 162
 163 <dt>DISCARD <dd>
 164
 165 <dt>DISCARD text... <dd>
 166
 167 Claim successful delivery and silently discard the message.
 168 The optional text is logged together with the matched text.
 169
 170 <dt>FILTER <i>transport</i>:<i>nexthop</i> <dd>
 171 After the message is queued, send the entire message through
 172 a content filter. This requires different cleanup servers
 173 before and after the filter, with header/body checks turned
 174 off in the second cleanup server. More details about content
 175 filtering are in the Postfix FILTER_README file. This feature
 176 overrides the main.cf <b>content_filter</b> setting.
 177
 178 </dl>
 179
 180 <p>
 181
 182 <i>At present, specifying a header pattern with OK serves no useful
 183 purpose. A rule ending in OK affects only the header being matched.
 184 The next header may still result in a REJECT match, causing the
 185 mail still to be rejected.</i>
 186
 187 </dl>
 188
 189 <p>
 190
 191 <dt>Examples (main.cf):
 192
 193 <dd> <b>header_checks = regexp:/etc/postfix/header_checks</b>
 194
 195 <dd> <b>header_checks = pcre:/etc/postfix/header_checks</b>
 196
 197 <p>
 198
 199 <dt>Example (header_checks):
 200
 201 <dd> <tt>/^to: *friend@public\.com$/ REJECT</tt>
 202
 203 <p>
 204
 205 <a name="body_checks">
 206
 207 <h2> Body filtering</h2>
 208
 209 The <b>body_checks</b> parameter restricts what text is
 210 is allowed in message body lines.
 211
 212 <p>
 213
 214 Note: the message body is matched one line at a time.
 215 There is no multi-line concept as with message headers.
 216
 217 <p>
 218
 219 <dl>
 220
 221 <dt>Default:
 222
 223 <dd>Allow anything in message body lines.
 224
 225 <p>
 226
 227 <dt>Syntax:
 228
 229 <dd>Specify a list of zero or more lookup tables. Whenever a body
 230 line matches a table, the action depends on the lookup result:
 231
 232 <p>
 233
 234 <dl>
 235
 236 <dt>REJECT <dd>
 237
 238 <dt>REJECT text... <dd>
 239
 240 Reject the message, log the body line and the optional text,
 241 and send the optional text to the originator.
 242
 243 <dt>WARN <dd>
 244
 245 <dt>WARN text... <dd>
 246
 247 Log (but do not reject) the body line with a warning, and log the
 248 optional text.
 249
 250 <dt>OK <dd>Skip all further body patterns for this body line.
 251
 252 <dt>IGNORE <dd> Delete the body line from the message.
 253
 254 <dt>HOLD <dd>
 255
 256 <dt>HOLD text... <dd>
 257
 258 Place the message on the <b>hold</b> queue. Mail on hold can be
 259 inspected with the <a href="postcat.1.html">postcat</a> command,
 260 and can be destroyed or taken off hold with the <a
 261 href="postsuper.1.html">postsuper</a> command.
 262 The optional text is logged together with the matched text.
 263
 264 <dt>DISCARD <dd>
 265
 266 <dt>DISCARD text... <dd>
 267
 268 Claim successful delivery and silently discard the message.
 269 The optional text is logged together with the matched text.
 270
 271 <dt>FILTER <i>transport</i>:<i>nexthop</i> <dd>
 272 After the message is queued, send the entire message through
 273 a content filter. This requires different cleanup servers
 274 before and after the filter, with header/body checks turned
 275 off in the second cleanup server. More details about content
 276 filtering are in the Postfix FILTER_README file. This feature
 277 overrides the main.cf <b>content_filter</b> setting.
 278
 279 </dl>
 280
 281 <p>
 282
 283 <i>At present, specifying a pattern with OK serves no useful
 284 purpose. A rule ending in OK affects only the line being matched.
 285 The next line may still result in a REJECT match, causing the
 286 mail still to be rejected.</i>
 287
 288 </dl>
 289
 290 <p>
 291
 292 <dt>Examples (main.cf):
 293
 294 <dd> <b>body_checks = regexp:/etc/postfix/body_checks</b>
 295
 296 <dd> <b>body_checks = pcre:/etc/postfix/body_checks</b>
 297
 298 <p>
 299
 300 <a name="smtpd_client_restrictions">
 301
 302 <h2> Client hostname/address restrictions</h2>
 303
 304 The <b>smtpd_client_restrictions</b> parameter restricts what
 305 clients this system accepts SMTP connections from.
 306
 307 <p>
 308
 309 By default, this restriction is applied when the client sends the
 310 RCPT TO command. In order to have the restriction take effect
 311 as soon as possible, specify <b>smtpd_delay_reject = no</b> in
 312 the Postfix <b>main.cf</b> configuration file. Doing so may cause
 313 unexpected results with poorly implemented client software.
 314
 315 <p>
 316
 317 <dl>
 318
 319 <dt>Default:
 320
 321 <dd><b>smtpd_client_restrictions =</b>
 322
 323 <p>
 324
 325 <dd>Allow SMTP connections from any client.
 326
 327 <p>
 328
 329 <dt>Syntax:
 330
 331 <dd>Specify a list of zero or more restrictions, separated by
 332 whitespace or commas. Restrictions are applied in the order as
 333 specified; the first restriction that matches wins.
 334
 335 <p>
 336
 337 In addition to restrictions that are specific to the client hostname
 338 or IP address, you may list here any restrictions based on the
 339 information passed with the <a href="#smtpd_helo_restrictions">
 340 HELO/EHLO command</a>, on the <a href="#smtpd_sender_restrictions">
 341 sender address </a> or on the <a href="#smtpd_recipient_restrictions">
 342 recipient address</a>.  The HELO/EHLO, sender or recipient restrictions
 343 take effect only if <b>smtpd_delay_reject = yes</b> so that all
 344 restrictions are evaluated after the RCPT TO command.
 345
 346 <p>
 347
 348 <dt>Examples:
 349
 350 <dd> <b>smtpd_client_restrictions = hash:/etc/postfix/access,
 351 reject_rbl_client relays.mail-abuse.org</b> (paid service)
 352
 353 <dd> <b>smtpd_client_restrictions = hash:/etc/postfix/access,
 354 reject_rbl_client relays.ordb.org</b> (free service)
 355
 356 <dd> <b>smtpd_sender_restrictions = hash:/etc/postfix/access,
 357 reject_rhsbl_sender dsn.rfc-ignorant.org</b> (free service)
 358
 359 <dd> <b>smtpd_client_restrictions = permit_mynetworks,
 360 reject_unknown_client</b>
 361
 362 <p>
 363
 364 <dt> Restrictions:
 365
 366 <p>
 367
 368 <dl>
 369
 370 <a name="reject_unknown_client">
 371
 372 <dt> <b>reject_unknown_client</b> <dd> Reject the request when the
 373 client IP address has no PTR (address to name) record in the DNS,
 374 or when the PTR record does not have a matching A (name to address)
 375 record.  The <b>unknown_client_reject_code</b> parameter specifies
 376 the response code to rejected requests (default:  <b>450</b>).
 377
 378 <p>
 379
 380 <a name="permit_mynetworks">
 381
 382 <dt> <b>permit_mynetworks</b> <dd> Permit the request when the
 383 client IP address matches any network listed in <a
 384 href="basic.html#mynetworks"> $mynetworks</a>.
 385
 386 <p>
 387
 388 <a name="reject_rbl_client">
 389
 390 <dt> <b>reject_rbl_client</b> <i>domain.tld</i> <dd> Reject the
 391 request when the reversed client network address is listed with an
 392 A record under <i>domain.tld</i>.
 393
 394 The <b> maps_rbl_reject_code</b> parameter specifies the response
 395 code for rejected requests (default:  <b>554</b>), the <b><a
 396 href="#default_rbl_reply"> default_rbl_reply </a></b> parameter
 397 specifies the default server reply, and the <b><a href="#rbl_reply_maps">
 398 rbl_reply_maps </a></b> parameter specifies tables with server replies
 399 indexed by RBL domain.
 400
 401 <p>
 402
 403 <a name="reject_rhsbl_client">
 404
 405 <dt> <b>reject_rhsbl_client</b> <i>domain.tld</i> <dd> Reject the
 406 request when the client hostname is listed with an A record under
 407 <i>domain.tld</i>.  See above for additional RBL related configuration
 408 parameters.
 409
 410 <p>
 411
 412 <a name="check_client_access">
 413
 414 <dt> <b>check_client_access</b> <i>maptype</i>:<i>mapname</i>
 415
 416 <dt> <i>maptype</i>:<i>mapname</i> <dd> Search the named <a
 417 href="access.5.html">access database</a> for the client hostname, parent
 418 domains, client IP address, or networks obtained by stripping least
 419 significant octets.
 420
 421 <p>
 422
 423 <dt> <b><a href="#permit">permit</a></b>
 424
 425 <dt> <b><a href="#defer">defer</a></b>
 426
 427 <dt> <b><a href="#reject">reject</a></b>
 428
 429 <dt> <b><a href="#warn_if_reject">warn_if_reject</a></b>
 430
 431 <dt> <b><a href="#reject_unauth_pipelining">reject_unauth_pipelining</a></b>
 432
 433 <dd> See generic restrictions.
 434
 435 </dl>
 436
 437 </dl>
 438
 439 <a name="smtpd_helo_required">
 440
 441 <h2> Require HELO (EHLO) command</h2>
 442
 443 The <b>smtpd_helo_required</b> parameter determines if clients must
 444 send a <b>HELO</b> (or <b>EHLO</b>) command at the beginning of an
 445 SMTP session.  Requiring this will stop some UCE software.
 446
 447 <p>
 448
 449 <dl>
 450
 451 <dt>Default:
 452
 453 <dd><b>smtpd_helo_required = no</b>
 454
 455 <p>
 456
 457 <dd>By default, the Postfix <a href="smtpd.8.html">SMTP server</a>
 458 does not require the use of <b>HELO</b> (<b>EHLO</b>).
 459
 460 <p>
 461
 462 <dt>Syntax:
 463
 464 <dd>Specify <b>yes</b> or <b>no</b>.
 465
 466 <p>
 467
 468 <dt>Example:
 469
 470 <dd> <b>smtpd_helo_required = yes</b>
 471
 472 </dl>
 473
 474 <a name="smtpd_helo_restrictions">
 475
 476 <h2> HELO (EHLO) hostname restrictions</h2>
 477
 478 The <b>smtpd_helo_restrictions</b> parameter restricts what hostnames
 479 clients may send with the <b>HELO</b> (<b>EHLO</b>) command.  Some
 480 UCE software can be stopped by being strict here.
 481
 482 <p>
 483
 484 By default, this restriction is applied when the client sends the
 485 RCPT TO command. In order to have the restriction take effect
 486 as soon as possible, specify <b>smtpd_delay_reject = no</b> in
 487 the Postfix <b>main.cf</b> configuration file. Doing so may cause
 488 unexpected results with poorly implemented client software.
 489
 490 <dl>
 491
 492 <dt>Default:
 493
 494 <dd><b>smtpd_helo_restrictions =</b>
 495
 496 <p>
 497
 498 <dd>By default, the Postfix <a href="smtpd.8.html">SMTP server</a>
 499 accepts any garbage in the <b>HELO</b> (<b>EHLO</b>) command. There
 500 is a lot of broken or misconfigured software on the Internet.
 501
 502 <p>
 503
 504 <dt>Syntax:
 505
 506 <dd>Specify a list of zero or more restrictions, separated by
 507 whitespace or commas.  Restrictions are applied in the order as
 508 specified; the first restriction that matches wins.
 509
 510 <p>
 511
 512 In addition to restrictions that are specific to HELO (EHLO) command
 513 parameters, you may list here any restrictions on the <a
 514 href="#smtpd_client_restrictions"> client hostname </a>, <a
 515 href="#smtpd_client_restrictions"> client address </a>, <a
 516 href="#smtpd_sender_restrictions"> sender address </a> or <a
 517 href="#smtpd_recipient_restrictions"> recipient address</a>.  The
 518 sender or recipient restrictions take effect only if <b>smtpd_delay_reject
 519 = yes</b> so that all restrictions are evaluated after the RCPT TO
 520 command.
 521
 522 <p>
 523
 524 <dt>Example:
 525
 526 <dd> <b>smtpd_helo_restrictions = permit_mynetworks,
 527 reject_invalid_hostname</b>
 528
 529 <p>
 530
 531 <dt> Restrictions:
 532
 533 <p>
 534
 535 <dl>
 536
 537 <a name="reject_invalid_hostname">
 538
 539 <dt> <b>reject_invalid_hostname</b> <dd> Reject the request when
 540 the client HELO or EHLO parameter has a bad hostname syntax. The
 541 <b>invalid_hostname_reject_code</b> specifies the response code to
 542 rejected requests (default:  501).
 543
 544 <p>
 545
 546 <a name="reject_unknown_hostname">
 547
 548 <dt> <b>reject_unknown_hostname</b> <dd> Reject the request when
 549 the hostname in the client HELO (EHLO) command has no DNS A or MX
 550 record. The <b>unknown_hostname_reject_code</b> specifies the
 551 response code to rejected requests (default:  <b>450</b>).
 552
 553 <p>
 554
 555 <a name="reject_non_fqdn_hostname">
 556
 557 <dt> <b>reject_non_fqdn_hostname</b> <dd> Reject the request when
 558 the hostname in the client HELO (EHLO) command is not in fully-qualified
 559 domain form, as required by the RFC. The <b>non_fqdn_reject_code</b>
 560 specifies the response code to rejected requests (default:
 561 <b>504</b>).
 562
 563 <p>
 564
 565 <a name="check_helo_access">
 566
 567 <dt> <b>check_helo_access</b> <i>maptype</i>:<i>mapname</i>
 568
 569 <dt> <i>maptype</i>:<i>mapname</i> <dd> Search the named <a
 570 href="access.5.html">access database</a> for the <b>HELO</b> hostname
 571 or parent domains.
 572
 573 <p>
 574
 575 <dt> <b><a href="#permit">permit</a></b>
 576
 577 <dt> <b><a href="#defer">defer</a></b>
 578
 579 <dt> <b><a href="#reject">reject</a></b>
 580
 581 <dt> <b><a href="#warn_if_reject">warn_if_reject</a></b>
 582
 583 <dt> <b><a href="#reject_unauth_pipelining">reject_unauth_pipelining</a></b>
 584
 585 <dd> See generic restrictions.
 586
 587 </dl>
 588
 589 </dl>
 590
 591 <a name="strict_rfc821_envelopes">
 592
 593 <h2> Require strict RFC 821-style envelope addresses </h2>
 594
 595 The <b>strict_rfc821_envelopes</b> parameter controls how tolerant
 596 Postfix is with respect to addresses given in MAIL FROM or RCPT TO
 597 commands. Unfortunately, the widely-used Sendmail program tolerates
 598 lots of non-standard behavior, so a lot of software expects to get
 599 away with it.  Being strict to the RFC not only stops unwanted
 600 mail, it also blocks legitimate mail from poorly-written mail
 601 applications.
 602
 603 <p>
 604
 605 <dl>
 606
 607 <dt> Default:
 608
 609 <dd><b>strict_rfc821_envelopes = no</b>
 610
 611 <p>
 612
 613 <dd>By default, the Postfix <a href="smtpd.8.html">SMTP server</a>
 614 accepts any address form that it can make sense of, including
 615 address forms that contain RFC 822-style comments, or addresses
 616 not enclosed in &lt;&gt;. There is a lot of broken or misconfigured
 617 software out there on the Internet.
 618
 619 <p>
 620
 621 <dt> Example:
 622
 623 <dd><b>strict_rfc821_envelopes = yes</b>
 624
 625 </dl>
 626
 627 <a name="smtpd_sender_restrictions">
 628
 629 <h2> Sender address restrictions</h2>
 630
 631 The <b>smtpd_sender_restrictions</b> parameter restricts what sender
 632 addresses this system accepts in MAIL FROM commands.
 633
 634 <p>
 635
 636 By default, this restriction is applied when the client sends the
 637 RCPT TO command. In order to have the restriction take effect
 638 as soon as possible, specify <b>smtpd_delay_reject = no</b> in
 639 the Postfix <b>main.cf</b> configuration file. Doing so may cause
 640 unexpected results with poorly implemented client software.
 641
 642 <p>
 643
 644 <dl>
 645
 646 <dt> Default:
 647
 648 <dd><b>smtpd_sender_restrictions =</b>
 649
 650 <p>
 651
 652 <dd>By default, the Postfix <a href="smtpd.8.html">SMTP server</a>
 653 accepts any sender address.
 654
 655 <p>
 656
 657 <dt>Syntax:
 658
 659 <dd>Specify a list of zero or more restrictions, separated by
 660 whitespace or commas. Restrictions are applied in the order as
 661 specified; the first restriction that matches wins.
 662
 663 <p>
 664
 665 In addition to restrictions that are specific to sender mail
 666 addresses, you can also specify restrictions based on the information
 667 passed with the <a href="#smtpd_helo_restrictions"> HELO/EHLO
 668 command </a>, on the <a href="#smtpd_client_restrictions"> client
 669 hostname </a> or <a href="#smtpd_client_restrictions"> network
 670 address </a>, or on the <a href="#smtpd_recipient_restrictions">
 671 recipient address </a>.  The recipient restrictions take effect
 672 only if <b>smtpd_delay_reject = yes</b> so that all restrictions
 673 are evaluated after the RCPT TO command.
 674
 675 <p>
 676
 677 <dt> Example:
 678
 679 <dd> <b>smtpd_sender_restrictions = hash:/etc/postfix/access,
 680 reject_unknown_sender_domain</b>
 681
 682 <p>
 683
 684 <dt> Restrictions:
 685
 686 <dl compact>
 687
 688 <a name="reject_unknown_sender_domain">
 689
 690 <dt> <b>reject_unknown_sender_domain</b> <dd> Reject the request
 691 when the sender mail address has no DNS A or MX record. The
 692 <b>unknown_address_reject_code </b> parameter specifies the response
 693 code for rejected requests (default:  <b>450</b>).  The response
 694 is always <b>450</b> in case of a temporary DNS error.
 695
 696 <p>
 697
 698 <a name="reject_rhsbl_sender">
 699
 700 <dt> <b>reject_rhsbl_sender</b> <i>domain.tld</i> <dd> Reject the
 701 request when the sender mail address domain is listed with an A
 702 record under <i>domain.tld</i>.
 703
 704 The <b> maps_rbl_reject_code</b> parameter specifies the response
 705 code for rejected requests (default:  <b>554</b>), the <b><a
 706 href="#default_rbl_reply"> default_rbl_reply </a></b> parameter
 707 specifies the default server reply, and the <b><a href="#rbl_reply_maps">
 708 rbl_reply_maps </a></b> parameter specifies tables with server replies
 709 indexed by RBL domain.
 710 <p>
 711
 712 <a name="check_sender_access">
 713
 714 <dt> <b>check_sender_access</b> <i>maptype</i>:<i>mapname</i>
 715
 716 <dt> <i>maptype</i>:<i>mapname</i> <dd> Search the named <a
 717 href="access.5.html">access database</a> for the sender mail address,
 718 sender domain and parent domain, or <i>localpart</i>@.
 719
 720 <p>
 721
 722 <a name="reject_non_fqdn_sender">
 723
 724 <dt> <b>reject_non_fqdn_sender</b> <dd> Reject the request when
 725 the address in the client MAIL FROM command is not in fully-qualified
 726 domain form. The <b>non_fqdn_reject_code</b> specifies the
 727 response code to rejected requests (default:  <b>504</b>).
 728
 729 <p>
 730
 731 <a name="reject_sender_login_mismatch">
 732
 733 <dt> <b>reject_sender_login_mismatch</b>
 734
 735 <dd> Reject the request when <a href="#smtpd_sender_login_maps">
 736 $smtpd_sender_owner_maps</a> specifies an owner for the MAIL FROM
 737 address, but the client is not (SASL) logged in as that MAIL FROM
 738 address owner; or when the client is (SASL) logged in, but the
 739 client login name doesn't own the MAIL FROM address according to
 740 <a href="#smtpd_sender_login_maps"> $smtpd_sender_login_maps</a>.
 741
 742 <p>
 743
 744 <dt> <b><a href="#permit">permit</a></b>
 745
 746 <dt> <b><a href="#defer">defer</a></b>
 747
 748 <dt> <b><a href="#reject">reject</a></b>
 749
 750 <dt> <b><a href="#warn_if_reject">warn_if_reject</a></b>
 751
 752 <dt> <b><a href="#reject_unauth_pipelining">reject_unauth_pipelining</a></b>
 753
 754 <dd> See generic restrictions.
 755
 756 </dl>
 757
 758 </dl>
 759
 760 <a name="smtpd_recipient_restrictions">
 761
 762 <h2> Recipient address restrictions</h2>
 763
 764 The <b>smtpd_recipient_restrictions</b> parameter restricts what
 765 recipient addresses this system accepts in RCPT TO commands.
 766
 767 <dl>
 768
 769 <dt>Default:
 770
 771 <dd><b>smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination</b>
 772
 773 <p>
 774
 775 <dd>By default, the Postfix <a href="smtpd.8.html">SMTP server</a>
 776 relays mail:
 777
 778 <p>
 779
 780 <ul>
 781
 782 <li>from trusted clients whose IP address matches <a
 783 href="basic.html#mynetworks">$mynetworks</a> to any destination,
 784
 785 <li>from untrusted clients to destinations that match <a
 786 href="#relay_domains"> $relay_domains</a> or a subdomain thereof,
 787 except for addresses that contain sender-specified routing
 788 (<i>user@elsewhere@domain</i>).
 789
 790 </ul>
 791
 792 <p>
 793
 794 In addition to the above, the Postfix <a href="smtpd.8.html">SMTP
 795 server</a> by default accepts mail for which Postfix is the final
 796 destination:
 797
 798 <p>
 799
 800 <ul>
 801
 802 <li>to destinations that match <a
 803 href="basic.html#inet_interfaces">$inet_interfaces</a>,
 804
 805 <li>to destinations that match <a
 806 href="basic.html#mydestination">$mydestination</a>,
 807
 808 <li>to destinations that match <a href="virtual.5.html">$virtual_alias_domains</a>,
 809
 810 <li>to destinations that match <a
 811 href="virtual.8.html">$virtual_mailbox_domains</a>.
 812
 813 </ul>
 814
 815 <p>
 816
 817 <dt>Syntax:
 818
 819 <dd>Specify a list of zero or more restrictions, separated by
 820 whitespace or commas. Restrictions are applied in the order as
 821 specified; the first restriction that matches wins.
 822
 823 <p>
 824
 825 In addition to restrictions that are specific to recipient mail
 826 addresses, you can also specify restrictions based on the <a
 827 href="#smtpd_sender_restrictions"> sender mail address</a>, on the
 828 information passed with the <a href="#smtpd_helo_restrictions">
 829 HELO/EHLO command </a>, and on the <a href="#smtpd_client_restrictions">
 830 client hostname </a> or <a href="#smtpd_client_restrictions">
 831 network address </a>.
 832
 833 <p>
 834
 835 <dt> Example:
 836
 837 <dd> <b>smtpd_recipient_restrictions = permit_mynetworks,
 838 reject_unauth_destination</b>
 839
 840 <p>
 841
 842 <dd><i>Note: you must specify at least one of the following
 843 restrictions: </i><b>reject</b>, <b>defer</b>, <b>defer_if_permit</b>,
 844 <i>or</i> <b>reject_unauth_destination</b>. <i>Postfix will refuse
 845 to receive mail otherwise. </i>
 846
 847 <p>
 848
 849 <dt> Restrictions:
 850
 851 <dl>
 852
 853 <a name="permit_auth_destination">
 854
 855 <dt> <b>permit_auth_destination</b> <dd>
 856 Permit the request when one of the following is true:
 857
 858 <ul>
 859
 860 <li>the resolved destination address matches <a
 861 href="#relay_domains">$relay_domains</a> or a subdomain thereof,
 862 and the address contains no sender-specified routing
 863 (<i>user@elsewhere@domain</i>),
 864
 865 <li>Postfix is the final destination:  any destination that matches
 866 <a href="basic.html#mydestination">$mydestination</a>, <a
 867 href="basic.html#inet_interfaces">$inet_interfaces</a>, <a
 868 href="virtual.5.html">$virtual_alias_domains</a>, or <a
 869 href="virtual.8.html">$virtual_mailbox_domains</a>.
 870
 871 </ul>
 872
 873 <p>
 874
 875 <a name="reject_unauth_destination">
 876
 877 <dt> <b>reject_unauth_destination</b> <dd>
 878 Reject the request unless one of the following is true:
 879
 880 <ul>
 881
 882 <li>the resolved destination address matches <a
 883 href="#relay_domains">$relay_domains</a> or a subdomain thereof,
 884 and the address contains no sender-specified routing
 885 (<i>user@elsewhere@domain</i>),
 886
 887 <li>Postfix is the final destination:  any destination that matches
 888 <a href="basic.html#mydestination">$mydestination</a>, <a
 889 href="basic.html#inet_interfaces">$inet_interfaces</a>, <a
 890 href="virtual.5.html">$virtual_alias_domains</a>, or <a
 891 href="virtual.8.html">$virtual_mailbox_domains</a>.
 892
 893 </ul>
 894
 895 The <b>relay_domains_reject_code</b> parameter specifies the response
 896 code for rejected requests (default:  <b>554</b>).
 897
 898 <p>
 899
 900 <a name="permit_mx_backup">
 901
 902 <dt> <b>permit_mx_backup</b> <dd> Permit the request when the local
 903 mail system is MX host for the resolved destination.
 904 This includes the case that the local mail system is the final
 905 destination.  However, the SMTP server will not forward mail with
 906 addresses that have sender-specified routing information (example:
 907 <i>user@elsewhere@domain</i>),
 908
 909 <p>
 910
 911 Use the optional <a href="#permit_mx_backup_networks">
 912 permit_mx_backup_networks</a> parameter to also require that the
 913 primary MX hosts match a list of network blocks.
 914
 915 <p>
 916
 917 Relevant configuration parameters:  <a
 918 href="#permit_mx_backup_networks">permit_mx_backup_networks</a>,
 919 <a href="basic.html#mydestination"> $mydestination</a>, <a
 920 href="basic.html#inet_interfaces"> $inet_interfaces</a>.
 921
 922 <p>
 923
 924 <dt> <b>check_recipient_access</b> <i>maptype</i>:<i>mapname</i>
 925
 926 <dt> <i>maptype</i>:<i>mapname</i> <dd> Search the named <a
 927 href="access.5.html">access database</a> for the resolved destination
 928 address, recipient domain or parent domain, or <i>localpart</i>@.
 929
 930 <p>
 931
 932 <a name="check_recipient_maps">
 933
 934 <dt> <b>check_recipient_maps</b> <dd> Reject the request
 935 when the recipient address is not listed in one of the following
 936 lookup tables:
 937
 938 <blockquote>
 939
 940 <table border="1">
 941
 942 <tr><th>Recipient domain matches</th> <th>Recipient lookup table</th>
 943
 944 </tr><tr><td><a href="basic.html#mydestination"> $mydestination</a> or
 945 <a href="basic.html#inet_interfaces">$inet_interfaces</a></td>
 946 <td>$local_recipient_maps</td>
 947
 948 </tr><tr><td>$virtual_alias_domains</td> <td>$virtual_alias_maps</td>
 949
 950 </tr><tr><td>$virtual_mailbox_domains</td> <td>$virtual_mailbox_maps</td>
 951
 952 </tr><tr><td>$relay_domains</td> <td>$relay_recipient_maps</td>
 953
 954 </tr></table>
 955
 956 </blockquote>
 957
 958 Note 1: a null $local_recipient_maps or $relay_recipient_maps setting
 959 means that no recipient check is done for the corresponding domains.
 960
 961 <p>
 962
 963 Note 2: Postfix applies an implicit <b>check_recipient_maps</b>
 964 restriction at the end of all recipient restrictions.
 965
 966 <p>
 967
 968 <a name="reject_unknown_recipient_domain">
 969
 970 <dt> <b>reject_unknown_recipient_domain</b> <dd> Reject the request
 971 when the recipient mail address has no DNS A or MX record. The
 972 <b>unknown_address_reject_code </b> parameter specifies the response
 973 code for rejected requests (default:  <b>450</b>).  The response
 974 is always <b>450</b> in case of a temporary DNS error.
 975
 976 <p>
 977
 978 <a name="reject_rhsbl_recipient">
 979
 980 <dt> <b>reject_rhsbl_recipient</b> <i>domain.tld</i> <dd> Reject the
 981 request when the recipient mail address domain is listed with an A
 982 record under <i>domain.tld</i>.
 983
 984 The <b> maps_rbl_reject_code</b> parameter specifies the response
 985 code for rejected requests (default:  <b>554</b>), the <b><a
 986 href="#default_rbl_reply"> default_rbl_reply </a></b> parameter
 987 specifies the default server reply, and the <b><a href="#rbl_reply_maps">
 988 rbl_reply_maps </a></b> parameter specifies tables with server replies
 989 indexed by RBL domain.
 990
 991 <p>
 992
 993 <a name="reject_non_fqdn_recipient">
 994
 995 <dt> <b>reject_non_fqdn_recipient</b> <dd> Reject the request when
 996 the address in the client RCPT TO command is not in fully-qualified
 997 domain form. The <b>non_fqdn_reject_code</b> specifies the
 998 response code to rejected requests (default:  <b>504</b>).
 999
1000 <p>
1001
1002 <dt> <b><a href="#permit">permit</a></b>
1003
1004 <dt> <b><a href="#defer">defer</a></b>
1005
1006 <dt> <b><a href="#reject">reject</a></b>
1007
1008 <dt> <b><a href="#warn_if_reject">warn_if_reject</a></b>
1009
1010 <dt> <b><a href="#reject_unauth_pipelining">reject_unauth_pipelining</a></b>
1011
1012 <dd> See generic restrictions.
1013
1014 </dl>
1015
1016 </dl>
1017
1018 <a name="smtpd_etrn_restrictions">
1019
1020 <h2> ETRN command restrictions</h2>
1021
1022 Not really an UCE restriction, the <b>smtpd_etrn_restrictions</b>
1023 parameter restricts what domains can be specified in ETRN commands,
1024 and what clients can issue ETRN commands.
1025
1026 <dl>
1027
1028 <dt>Default:
1029
1030 <dd><b>smtpd_etrn_restrictions =</b>
1031
1032 <p>
1033
1034 <dd>By default, the Postfix <a href="smtpd.8.html">SMTP server</a>
1035 accepts any ETRN command from any client.
1036
1037 <p>
1038
1039 <dt>Syntax:
1040
1041 <dd>Specify a list of zero or more restrictions, separated by
1042 whitespace or commas. Restrictions are applied in the order as
1043 specified; the first restriction that matches wins.
1044
1045 <p>
1046
1047 In addition to restrictions that are specific to ETRN domain names,
1048 you can also specify restrictions based on the information passed
1049 with the <a href="#smtpd_helo_restrictions"> HELO/EHLO command
1050 </a>, and on the <a href="#smtpd_client_restrictions"> client
1051 hostname </a> or <a href="#smtpd_client_restrictions"> network
1052 address </a>.
1053
1054 <p>
1055
1056 <dt> Example:
1057
1058 <dd> <b>smtpd_etrn_restrictions = permit_mynetworks,
1059 hash:/etc/postfix/etrn_access, reject</b>
1060
1061 <p>
1062
1063 <dt> Restrictions:
1064
1065 <dl>
1066
1067 <a name="check_etrn_access">
1068
1069 <dt> <b>check_etrn_access</b> <i>maptype</i>:<i>mapname</i>
1070
1071 <dt> <i>maptype</i>:<i>mapname</i> <dd> Search the named <a
1072 href="access.5.html">access database</a> for the domain specified
1073 in the ETRN command, or its parent domains. Reject the request if
1074 the result is <b>REJECT</b> <i>text...</i> or "[<b>45</b>]<i>XX
1075 text</i>".  Permit
1076 the request if the result is <b>OK</b> or <b>RELAY</b> or
1077 all-numerical. Otherwise, treat the result as another list of UCE
1078 restrictions.  The <b>access_map_reject_code </b> parameter specifies
1079 the result code for rejected requests (default: <b>554</b>).
1080
1081 <p>
1082
1083 <dt> <b><a href="#permit">permit</a></b>
1084
1085 <dt> <b><a href="#defer">defer</a></b>
1086
1087 <dt> <b><a href="#reject">reject</a></b>
1088
1089 <dt> <b><a href="#warn_if_reject">warn_if_reject</a></b>
1090
1091 <dt> <b><a href="#reject_unauth_pipelining">reject_unauth_pipelining</a></b>
1092
1093 <dd> See generic restrictions.
1094
1095 </dl>
1096
1097 </dl>
1098
1099 <a name="generic">
1100
1101 <h2> Generic restrictions</h2>
1102
1103 The following restrictions can use used for client hostnames or
1104 addresses, for HELO (EHLO) hostnames, for sender mail addresses
1105 and for recipient mail addresses.
1106
1107 <dl>
1108
1109 Restrictions:
1110
1111 <p>
1112
1113 <dl>
1114
1115 <a name="permit">
1116
1117 <dt> <b>permit</b> <dd> Permit the request. This restriction
1118 is useful at the end of a restriction list, to make the default
1119 policy explicit.
1120
1121 <p>
1122
1123 <a name="defer">
1124
1125 <dt> <b>defer</b> <dd> Defer the request. The client is told to
1126 try again later. This restriction is useful at the end of a
1127 restriction list, to make the default policy explicit.
1128
1129 <p>
1130
1131 <a name="reject">
1132
1133 <dt> <b>reject</b> <dd> Reject the request. This restriction
1134 is useful at the end of a restriction list, to make the default
1135 policy explicit. The <b>reject_code</b> configuration parameter
1136 specifies the response code to rejected requests (default:
1137 <b>554</b>).
1138
1139 <p>
1140
1141 <a name="warn_if_reject">
1142
1143 <dt> <b>warn_if_reject</b>
1144 <dd> Change the meaning of the next restriction, so that it logs
1145 a warning instead of rejecting a request (look for logfile records
1146 that contain "reject_warning").  This is useful for testing new
1147 restrictions in a "live" environment without risking unnecessary
1148 loss of mail.
1149
1150 <p>
1151
1152 <a name="reject_unauth_pipelining">
1153
1154 <dt> <b>reject_unauth_pipelining</b> <dd> Reject the request when
1155 the client sends SMTP commands ahead of time without knowing that
1156 Postfix actually supports SMTP command pipelining.  This stops mail
1157 from bulk mail software that improperly uses SMTP command pipelining
1158 to speed up deliveries.
1159
1160 </dl>
1161
1162 </dl>
1163
1164 <a name="additional">
1165
1166 <h2> Additional UCE control parameters</h2>
1167
1168 <dl>
1169
1170 <a name="default_rbl_reply">
1171
1172 <dt> <b>default_rbl_reply</b>
1173
1174 <dd>The default reply template that is used when an SMTP client
1175 request is blocked by a <b>reject_rbl</b> or <b>reject_rhsbl</b>
1176 restriction.  The reply template is subjected to exactly one level
1177 of $name macro substitution as described below. The
1178 <b>smtpd_expansion_filter</b> configuration parameter specifies
1179 the set of characters that are allowed in $name macro expansions.
1180 Characters outside the allowed set are replaced by "_".
1181
1182 <p>
1183
1184 <dl>
1185
1186 <dt>Default:
1187
1188 <dd><b> default_rbl_reply = $rbl_code Service unavailable; $rbl_class [$rbl_what] blocked using $rbl_domain${rbl_reason?; $rbl_reason} </b>
1189
1190 <p>
1191
1192 Instead of the form $<i>name</i> you can also specify ${<i>name</i>}
1193 or $(<i>name</i>).
1194
1195 <p>
1196
1197 <dt>Macro expansion syntax:
1198
1199 <dl>
1200
1201 <dt> $client <dd>  The client hostname and IP address, formatted as
1202 <i>name</i>[<i>address</i>].
1203
1204 <dt> $client_name <dd>  The client hostname, or <b>unknown</b>.
1205
1206 <dt> $client_address <dd>  The client IP address.
1207
1208 <dt> $helo_name <dd>  The hostname given in the HELO or EHLO command,
1209 or the empty string when no HELO or EHLO command was given.
1210
1211 <dt> $sender <dd>  The sender address, or <> in case of the null
1212 address.
1213
1214 <dt> $sender_name <dd>  The sender address localpart, or <> in case
1215 of the null address.
1216
1217 <dt> $sender_domain <dd>  The sender address domain, or the empty
1218 string when no domain is available.
1219
1220 <dt> $recipient <dd>  The recipient address, or <> in case of the
1221 null address.
1222
1223 <dt> $recipient_name <dd>  The recipient address localpart, or <>
1224 in case of the null address.
1225
1226 <dt> $recipient_domain <dd>  The recipient address domain, or the
1227 empty string when no domain is available.
1228
1229 <dt> $rbl_what <dd>  The blacklisted entity: an IP address, a
1230 hostname, a domain name, or an email address whose domain is
1231 blacklisted.
1232
1233 <dt> $rbl_domain <dd>  The RBL domain where $rbl_what is blacklisted
1234 with an A record.
1235
1236 <dt> $rbl_reason <dd>  The reason why $rbl_what is blacklisted, or
1237 the empty string when no information is available.
1238
1239 <dt> $rbl_class <dd>  The blacklisted entity type: Client host,
1240 Helo command, Sender address, or Recipient address.
1241
1242 <dt> $rbl_code <dd>  The numerical server reply code, as specified
1243 with the <b>maps_rbl_reject_code</b> configuration parameter
1244 (default: 554).
1245
1246 <dt> All other text <dd> Copied without change, with the exception
1247 of conditional macro expansion as described below.
1248
1249 </dl>
1250
1251 <p>
1252
1253 Conditional macro expansion syntax:
1254
1255 <dl>
1256
1257 <dt> ${<i>name</i>?<i>text</i>} <dd> expands to <i>text</i> if
1258 $<i>name</i> is not empty.
1259
1260 <dt> ${<i>name</i>:<i>text</i>} <dd> expands to <i>text</i> if
1261 $<i>name</i> is empty.
1262
1263 </dl>
1264
1265 </dl>
1266
1267 </dl>
1268
1269 <p>
1270
1271 <dl>
1272
1273 <a name="permit_mx_backup_networks">
1274
1275 <dt> <b>permit_mx_backup_networks</b>
1276
1277 <dd>Restrict the use of the <a href="#permit_mx_backup">
1278 permit_mx_backup</a> relay control feature to destinations whose
1279 primary MX hosts match a list of network blocks.
1280
1281 <p>
1282
1283 <dl>
1284
1285 <dt>Default:
1286
1287 <dd><b>permit_mx_backup_networks = </b>
1288
1289 <p>
1290
1291 That is, all networks are authorized by default.
1292
1293 <p>
1294
1295 <dt>Syntax:
1296
1297 <dd> Specify a list of network
1298 blocks in CIDR (network/mask) notation, for example:
1299
1300 <p>
1301
1302 <dl>
1303
1304 <dd> <b>permit_mx_backup_networks = 168.100.0.0/16</b>
1305
1306 </dl>
1307
1308 <p>
1309
1310 You can also specify the absolute pathname of a pattern file instead
1311 of listing the patterns in the <b>main.cf</b> file.
1312
1313 </dl>
1314
1315 </dl>
1316
1317 <p>
1318
1319 <dl>
1320
1321 <a name="rbl_reply_maps">
1322
1323 <dt> <b>rbl_reply_maps</b>
1324
1325 <dd> This parameter specifies lookup tables with RBL reply templates
1326 indexed by RBL domain name. If no template is found, the
1327 <a href="#default_rbl_reply"> default_rbl_reply </a> template is
1328 used instead.
1329
1330 <p>
1331
1332 <dl>
1333
1334 <dt>Default:
1335
1336 <dd><b>rbl_reply_maps = </b>
1337
1338 <p>
1339
1340 By default, Postfix always uses the <a href="#default_rbl_reply">
1341 default_rbl_reply </a> template.
1342
1343 <p>
1344
1345 <dt>Syntax:
1346
1347 <dd> Specify zero or more <i>type</i>:<i>name</i> lookup tables,
1348 separated by whitespace and/or commas. For the syntax of the
1349 template reply strings, see the <a href="#default_rbl_reply">
1350 default_rbl_reply </a> parameter description.
1351
1352 </dl>
1353
1354 </dl>
1355
1356 <dl>
1357
1358 <a name="relay_domains">
1359
1360 <dt> <b>relay_domains</b>
1361
1362 <dd> This parameter controls the behavior of the <a
1363 href="#reject_unauth_destination"> reject_unauth_destination</a>
1364 and <a href="#permit_auth_destination"> permit_auth_destination</a>
1365 restrictions that can appear as part of a recipient address
1366 restriction list.
1367
1368 <p>
1369
1370 <dl>
1371
1372 <dt>Default:
1373
1374 <dd><b>relay_domains = <a href="basic.html#mydestination">
1375 $mydestination</a></b>
1376
1377 <p>
1378
1379 <dd>By default, the Postfix <a href="smtpd.8.html">SMTP server</a>
1380 relays mail:
1381
1382 <p>
1383
1384 <ul>
1385
1386 <li>from trusted clients whose IP address matches <a
1387 href="basic.html#mynetworks">$mynetworks</a>,
1388
1389 <li>from untrusted clients to destinations that match <a
1390 href="#relay_domains"> $relay_domains</a> or a subdomain thereof,
1391 except for addresses that contain sender-specified routing
1392 (<i>user@elsewhere@domain</i>).
1393
1394 </ul>
1395
1396 <p>
1397
1398 <dt>Syntax:
1399
1400 <dd> Specify zero or more domain names, <i>/file/name</i> patterns
1401 and/or <i>type</i>:<i>name</i> lookup tables, separated by whitespace
1402 and/or commas.  A <i>/file/name</i> is replaced by its contents;
1403 <i>type</i>:<i>name</i> requests that table lookup is done instead
1404 of string comparison.
1405
1406 </dl>
1407
1408 <p>
1409
1410 A host or destination address matches <b>$relay_domains</b> when
1411 its name or parent domain matches any of the names, files or lookup
1412 tables listed in <b>$relay_domains.</b>
1413
1414 </dl>
1415
1416 <dl>
1417
1418 <a name="smtpd_sender_login_maps">
1419
1420 <dt> <b>smtpd_sender_login_maps</b>
1421
1422 <dd>This parameter specifies ownership of MAIL FROM addresses, as
1423 used by the <a href="#reject_sender_login_mismatch">
1424 reject_sender_login_mismatch</a> sender address restriction.
1425
1426 <p>
1427
1428 <dl>
1429
1430 <dt>Default:
1431
1432 <dd><b>smtpd_sender_login_maps = </b>
1433
1434 <p>
1435
1436 <dt>Syntax:
1437
1438 <dd> Specify zero or more type:name lookup tables, separated by
1439 whitespace and/or commas.  The maps are searched in the
1440 specified order. Regexp tables are allowed.
1441
1442 <p>
1443
1444 Each map entry specifies a sender address and the login name that
1445 owns the address. The search order is:
1446
1447 <p>
1448
1449 <dl>
1450
1451 <dt><i>user@domain owner</i>
1452
1453 <dd>This form has the highest precedence.
1454
1455 <p>
1456
1457 <dt><i>user        owner</i>
1458
1459 <dd>This matches <i>user@site</i> when <i>site</i> is equal to <a
1460 href="basic.html#myorigin"> $myorigin</a>, when <i>site</i> is
1461 listed in <a href="basic.html#mydestination"> $mydestination</a>,
1462 or when it is listed in <a href="basic.html#inet_interfaces">
1463 $inet_interfaces</a>.
1464
1465 <p>
1466
1467 <dt><i>@domain     owner</i>
1468
1469 <dd>This matches every address in the specified domain, and has
1470 the lowest precedence.
1471
1472 </dl>
1473
1474 </dl>
1475
1476 </dl>
1477
1478 <hr>
1479
1480 <a href="index.html">Up one level</a> | <a href="basic.html">Basic
1481 Configuration</a> | UCE Controls | <a href="rate.html">Rate
1482 Controls</a> | <a href="resource.html">Resource Controls</a> | <a
1483 href="rewrite.html">Address Manipulation </a>
1484
1485 </body>
1486
1487 </html>