I would like to host mail services for some domains. I have succesfully setup postfix to consult sql for those virtual domains. What I would like to do is:
For connections on 25:
1. Deny relaying (only deliver to recipients of my virtual domains)
2. Leave tls optional, but offer auth only if client does tls
3. Accept only non-blacklisted clients (e.g restrict XBL+SBL+PBL from spamhaus)
or clients that do tls and auth (“friend mail servers” that are setup to authenticate with me with auth and tls)
For connections on 587:
1. Enforce tls and auth
2. Permit relaying.
3. Accept only non-blacklisted clients (blacklists like above but leave out PBL checking)
A.I know of the postfix options for the above , but I cant find how to differentiate them based on the listening port.
B.Will I run into widely known problems with supposedly legit clients with the above policy?
I am new to mail server setup, sorry for any meaningless question/assupmtion (please point it). Thanks.
/etc/postfix/main.cfyou will add/change
so that by default TLS is available (but optional).
Then, in your
/etc/postfix/master.cfyou will override it for port 587 (the
submissionport) by overriding the parameter:
submission inet n - n - - smtpd -o smtpd_tls_security_level=encrypt
This requires TLS for all submission (port 587) connections.
As for denying relaying, this is the default; relaying is allowed only for authenticated users, and IP addresses you specify in
Finally you can add blacklists in
main.cf by appending to
or whatever blacklists you wish. These should appear near the end of the list, just before the final
One last thing. For more ideas on how to prevent spam, see Fighting Spam – What can I do as an: Email Administrator, Domain Owner, or User?
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.