Conﬁguring And Securing Your Postfix Mail Relay Policy

Postﬁx’s relaying policy (allowing users to send mail through the mail server) is dictated by default via the mynetworks parameter. The mynetworks parameter tells Postﬁx what networks or speciﬁc hosts are trusted by Postﬁx to allow mail to be sent through the mail server to any destination based on this trust. When the mynetworks parameter has been set, you can then use the variable to explicitly tell Postﬁx the networks that your installation trusts.

Figure shows an example setup for your always-connected corporate mail server. You can see where the mynetworks parameter comes into use. By default, the mynetworks parameter contains your localhost network (127.0.0.0/8) and your network connections that have been conﬁgured in your system.
In this example, you can see the Postﬁx server in the DMZ (demilitarized zone) on an IP address of 192.168.0.4/24. Your internal network is in the subnet of 10.0.0.0/24. Given Postﬁx’s default mynetworks parameter, the 10.0.0.0/24 network will not be allowed to relay mail through Postﬁx because it is not part of the Postﬁx server’s network. To remedy this, you need to add the 10.0.0.0/24 network to the mynetworks clause:
mynetworks = 127.0.0.0/8, 192.168.0.0/24, 10.0.0.0/24

This entry now allows relaying from localhost, the DMZ network, and also your internal network.
When mynetworks has been conﬁgured, the parameter smtpd_recipient_restrictions actually allows the relaying to take place. As you can see from the default main.cf conﬁguration we talked about before, this parameter has two objectives:
■ To allow all relays from machines that are in mynetworks

■ To deny all other relays using the reject_unauth_destination(reject all unauthorized connections) clause

Postﬁx also allows relaying to any domains listed in relay_domains. This parameter, by default, contains whatever is in the $mydomain parameter, which by default is your machine’s conﬁgured domain. If you use the default setting, any untrusted sender (not in mynetworks) can relay mail through Postﬁx to any user at $mydomain. It should be obvious why this is the default, as this would mean that Postﬁx would accept mail for the domain it is hosting.