To replace the sender address in Postfix based on the destination, you must configure
sender_canonical_maps in
main.cf and define the mapping rules in a separate lookup table file. This technique rewrites the envelope sender (MAIL FROM) to match a specific domain or address, ensuring that bounces are handled correctly by your designated mail server rather than the original client application.
Understanding Sender Rewriting
When an email is sent through Postfix, it typically carries two distinct addresses: the envelope sender and the header From address. The envelope sender is used for delivery status notifications (DSNs) and bounce messages. If your application sends mail with a local hostname or an invalid domain as the envelope sender, those bounces will be lost or cause errors. By using canonical maps, Postfix intercepts the outgoing message and substitutes the sender address with a value you define, usually matching your primary domain or a dedicated no-reply address.
This process does not alter the visible "From" header in the email body, which remains under the control of the sending application. It strictly modifies the SMTP transaction parameters. This distinction is critical because spam filters often check the consistency between the envelope sender and the header From address. Mismatches can lead to emails being flagged as suspicious. Therefore, aligning the envelope sender with a valid, authenticated domain improves deliverability.
For more details on managing envelope addresses, see
Change Postfix Sender Envelope MAIL FROM Address To Match Return Path Header Email For Multiple Domains.
Configuring main.cf
The first step involves editing the main configuration file located at
/etc/postfix/main.cf. You need to enable the canonical maps feature by adding or modifying the following parameter:
sender_canonical_maps = regexp:/etc/postfix/sender_canonical
Using
regexp: allows for flexible pattern matching, which is often more practical than static hash maps when dealing with multiple subdomains or varying username formats. However, if you prefer exact matches, you can use
hash: instead. When using
hash:, you must ensure the map file is compiled into a database format using
postmap. With
regexp:, Postfix reads the text file directly, making debugging easier.
After adding this line, save the file. Ensure there are no syntax errors by running
postfix check. This command validates the configuration without restarting the service immediately, allowing you to catch typos early.
Creating the Canonical Map File
Next, create the file referenced in the previous step, such as
/etc/postfix/sender_canonical. This file contains the rules that dictate how Postfix should rewrite addresses. The format for regular expressions is straightforward: the left side is the pattern to match, and the right side is the replacement string.
For example, to replace any sender address ending in
@localhost with
[email protected], add the following line:
/@localhost$/ [email protected]
If you want to replace all senders from a specific user, such as
user1, regardless of the domain, you might use:
/^user1@/ [email protected]
You can define multiple rules in this single file. Postfix processes them in order, applying the first match it finds. It is important to note that these rules apply to the envelope sender only. If you also need to rewrite the header From address, you would need to use
header_checks or a different mechanism like
smtp_header_checks, but that is a separate configuration concern.
After editing the file, you do not need to compile it if you are using
regexp:. If you switched to
hash:, run
sudo postmap /etc/postfix/sender_canonical to generate the
.db file.
Applying Changes
Once the configuration and map files are updated, restart the Postfix service to apply the changes. On most Linux distributions, this is done using systemd:
sudo systemctl restart postfix
Verify that the service is running without errors by checking the status:
sudo systemctl status postfix
To test the configuration, send a test email from the account you wish to rewrite. Use a tool like
sendmail or a simple Python script to trigger an email. Check the mail log (
/var/log/mail.log) to see if the sender address was successfully rewritten. Look for lines indicating
rewrite or
canonical operations.
If the rewrite is not working, ensure that the permissions on the map file allow Postfix to read it. The file should be readable by the
postfix user. Additionally, verify that the regular expression syntax is correct. A common mistake is forgetting to escape special characters or using incorrect anchors.
For troubleshooting local delivery issues that might interfere with sender rewriting, refer to
Troubleshooting Postfix: Local Delivery despite External Agent Configuration.
Common Pitfalls
One frequent issue is conflicting rules. If you have both
sender_canonical_maps and
recipient_canonical_maps defined, ensure they do not interfere with each other. Also, remember that canonical maps are applied before the message is queued for delivery. If you have transport maps or relay settings that depend on the original sender address, rewriting it may affect routing.
Another pitfall is ignoring SPF records. If you rewrite the sender address to a domain that does not authorize your mail server's IP address via SPF, receiving servers may reject the email. Always ensure that the target domain has proper DNS records configured for the new sender address.
Frequently Asked Questions
Does this change the visible From header?
No,
sender_canonical_maps only affects the envelope sender (MAIL FROM) used during the SMTP transaction. The visible "From" header in the email body remains unchanged unless you explicitly configure
header_checks to modify it separately.
Can I use hash maps instead of regex?
Yes, you can use
hash: maps for exact matches. However, you must run
postmap to create the database file after every change to the source file. Regex maps are generally preferred for dynamic environments because they do not require recompilation and support pattern matching.
What happens if no rule matches?
If the sender address does not match any rule in the canonical map file, Postfix leaves the address unchanged. The original envelope sender is preserved and used for delivery and bounce handling.
Will this fix SPF failures?
Not necessarily. While rewriting the sender to a domain you control helps, you must also ensure that the domain's SPF record includes your mail server's IP address. Without proper SPF alignment, receiving servers may still reject the mail due to authentication failures.
How do I debug why my rewrite isn't working?
Check
/var/log/mail.log for entries related to
rewrite or
canonical. Use
postconf -n to verify that
sender_canonical_maps is set correctly in the active configuration. Also, validate your regex patterns using online tools or by testing them against sample addresses manually.