On Sat, Sep 19, 2020 at 09:09:15PM -0400, Alex wrote:
> I have a postfix-3.5.6 system on fedora32 that accepts mail for a
> domain (example.com) just using $mydestination and
> smtpd_recipient_restrictions with check_recipient_access. Now I'd like
> to add a catch-all for another domain (vexample.com) using
> virtual_alias_domains and having a problem.
>
> Mail is being rejected with Recipient address rejected:
>
> Sep 19 20:40:26 propemail postfix/smtpd[503632]: NOQUEUE: reject: RCPT
> from ns3.example.com[107.155.111.2]: 554 5.7.1 <[email protected]>:
> Recipient address rejected: Access denied;
> from=<[email protected]> to=<[email protected]> proto=ESMTP
> helo=<arcade.mydomain.com>
Presenting the restrictions in a readable layout is part of
communicating the configuration clearly:
> smtpd_recipient_restrictions =
> hash:/etc/postfix/bad_recipients,
> permit_mynetworks,
> permit_sasl_authenticated,
> reject_non_fqdn_recipient,
> reject_non_fqdn_sender,
> reject_unauth_destination reject_unknown_sender_domain,
> reject_unknown_recipient_domain,
> check_client_access hash:/etc/postfix/client_checks,
> check_sender_access hash:/etc/postfix/sender_checks,
> check_recipient_access pcre:/etc/postfix/local_recip_map,
> reject
Had you done that, you might have paused to consider which recipients
this is configured to permit. After eliminating reject-only rules and
"bad_recipients" (which really should be preceded by
"check_recipient_access", for clarity), and rules that don't look at the
recipient address, you're left with:
> smtpd_recipient_restrictions =
> permit_mynetworks,
> permit_sasl_authenticated,
> check_recipient_access pcre:/etc/postfix/local_recip_map,
> reject
That should make the issue clear.
--
Viktor.
