Hi, On Sat, Sep 19, 2020 at 9:45 PM Viktor Dukhovni <[email protected]> wrote: > > On Sat, Sep 19, 2020 at 09:09:15PM -0400, Alex wrote: > > > I have a postfix-3.5.6 system on fedora32 that accepts mail for a > > domain (example.com) just using $mydestination and > > smtpd_recipient_restrictions with check_recipient_access. Now I'd like > > to add a catch-all for another domain (vexample.com) using > > virtual_alias_domains and having a problem. > > > > Mail is being rejected with Recipient address rejected: > > > > Sep 19 20:40:26 propemail postfix/smtpd[503632]: NOQUEUE: reject: RCPT > > from ns3.example.com[107.155.111.2]: 554 5.7.1 <[email protected]>: > > Recipient address rejected: Access denied; > > from=<[email protected]> to=<[email protected]> proto=ESMTP > > helo=<arcade.mydomain.com> > > Presenting the restrictions in a readable layout is part of > communicating the configuration clearly: > > > smtpd_recipient_restrictions = > > hash:/etc/postfix/bad_recipients, > > permit_mynetworks, > > permit_sasl_authenticated, > > reject_non_fqdn_recipient, > > reject_non_fqdn_sender, > > reject_unauth_destination reject_unknown_sender_domain, > > reject_unknown_recipient_domain, > > check_client_access hash:/etc/postfix/client_checks, > > check_sender_access hash:/etc/postfix/sender_checks, > > check_recipient_access pcre:/etc/postfix/local_recip_map, > > reject > > Had you done that, you might have paused to consider which recipients > this is configured to permit. After eliminating reject-only rules and > "bad_recipients" (which really should be preceded by > "check_recipient_access", for clarity), and rules that don't look at the > recipient address, you're left with:
The missing "check_recipient_access" was a typo. I didn't even realize it would work without it. > > smtpd_recipient_restrictions = > > permit_mynetworks, > > permit_sasl_authenticated, > > check_recipient_access pcre:/etc/postfix/local_recip_map, > > reject But this doesn't account for the catch-all for the vexample.com domain. Are you saying that because of the reject, the virtual map is never processed? For testing, I had the following in /etc/postfix/virtual: /etc/postfix/virtual: [email protected] alex thinking that an email from [email protected] would be delivered to 'alex' but that is what produced the Recipient Access error above. It may be the processing order that I don't understand here.
