Postfix Sender Restrictions on Subdomains (Debian 12, Postfix 3.7.11)
Introduction
In this article, we will discuss how to configure Postfix to apply sender restrictions for subdomains on Debian 12 with Postfix 3.7.11. We will cover the key concepts, subtopics, and provide detailed steps with code examples.
Prerequisites
- Postfix version: 3.7.11
- Operating system: Debian 12
Configuring Sender Restrictions for Subdomains
Postfix provides several restrictions that can be applied to the sender of an email. However, applying these restrictions to subdomains can be tricky. Here's how to do it:
Step 1: Create a Transport Map File
Create a transport map file in the following location:
/etc/postfix/transport
Add the following lines to the file:
example.com smtpd_sender_restrictions=
example.com_subdomain smtpd_sender_restrictions=check_sender_access hash:/etc/postfix/sender_access
This configuration creates two different sender restriction rules: one for the main domain (example.com) and another for the subdomain (example.com_subdomain).
Step 2: Create the Sender Access File
Create a sender access file in the following location:
/etc/postfix/sender_access
Add the following lines to the file:
# permit_mynetworks
# permit_sasl_authenticated
# reject_unauth_destination
# reject_unknown_sender_domain
# reject_unlisted_sender
# reject_unlisted_recipient
# reject_unverified_sender
# reject_unverified_recipient
# reject_rbl_client zen.spamhaus.org
# reject_rbl_client bl.spamcop.net
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client bl.spamcounter.net
# reject_rbl_client cbl.abuseat.org
# reject_rbl_client sbl.spamhaus.org
# reject_rbl_client bl.spamassassin.org
# reject_rbl_client dnsbl-1.uceprotect.net
# reject_rbl_client dnsbl-2.uceprotect.net
# reject_rbl_client dnsbl-3.uceprotect.net
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.spamcop.net
# reject_rbl_client dnsbl.spamhaus.org
# reject_rbl_client dnsbl.spamhaus.org.eu
# reject_rbl_client dnsbl.njabl.org
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client dnsbl.blackhole.org
# reject_rbl_client dnsbl.dronebl.org
# reject_rbl_client dnsbl.sp