Postfix: Allow Unlisted Senders for Specific IPs

Configuring Postfix to allow unlisted senders only for a specific IP address or application involves using Postfix’s rich set of configuration parameters and policies. Here’s a detailed guide on how to set this up:

Overview

Postfix, by default, may reject emails from unlisted senders to avoid spam and unauthorized access. However, you can configure exceptions based on specific IP addresses or applications. This can be achieved by setting up appropriate access control rules and using Postfix’s smtpd_recipient_restrictions.

Steps to Allow Unlisted Senders for a Specific IP or Application

1. Edit the Postfix Main Configuration File:
   Open the main.cf file, typically located in /etc/postfix/:

   sudo nano /etc/postfix/main.cf

2. Configure Access Control:
   You need to set up access control that allows certain IP addresses to bypass restrictions. This can be done by defining a client access table. Add the following lines to main.cf:

   smtpd_client_restrictions =
       check_client_access hash:/etc/postfix/allowed_clients,
       permit

This tells Postfix to check incoming client connections against a list in /etc/postfix/allowed_clients.

3. Create the Access List:
   Create the file /etc/postfix/allowed_clients and specify the IP address or hostname that should be allowed to send email even if the sender is unlisted. For example:

   sudo nano /etc/postfix/allowed_clients

Add the specific IP address or hostname of the application:

   192.168.1.100 OK

This line allows the IP address 192.168.1.100 to bypass the unlisted sender restriction.

4. Build the Hash Table:
   Convert the access list into a format Postfix can use by running:

   sudo postmap /etc/postfix/allowed_clients

This command creates a allowed_clients.db file which Postfix uses to apply the rules.

5. Adjust Recipient Restrictions:
   You may need to adjust smtpd_recipient_restrictions to ensure unlisted senders from the allowed IP can bypass other restrictions. Add or modify the following line in main.cf:

   smtpd_recipient_restrictions =
       check_client_access hash:/etc/postfix/allowed_clients,
       reject_unlisted_sender,
       permit_mynetworks,
       permit_sasl_authenticated,
       reject_unauth_destination

• check_client_access hash:/etc/postfix/allowed_clients: Applies the custom access list.
• reject_unlisted_sender: Rejects senders that are not listed, except those allowed in the access list.
• permit_mynetworks: Permits connections from the server’s own network.
• permit_sasl_authenticated: Permits authenticated clients.
• reject_unauth_destination: Rejects mail to recipients that are not served by this Postfix instance.

6. Reload Postfix:
Apply the configuration changes by reloading Postfix:

   sudo systemctl reload postfix

Additional Considerations

• Security: Be cautious when allowing unlisted senders, as it could potentially open up your server to abuse if misconfigured. Ensure that only trusted IPs or applications are added to the access list.
• Monitoring: Regularly monitor your mail logs (/var/log/mail.log or /var/log/maillog) to ensure that only the intended clients are taking advantage of this exception.
• Testing: Before applying these settings in a production environment, test them thoroughly to ensure they work as expected and do not introduce security vulnerabilities.

Example Scenario

Let’s say you have an application on 192.168.1.100 that needs to send emails through your Postfix server, but it uses a sender address that is not listed in your relay_domains or mydestination.

By following the steps above, you can configure Postfix to allow emails from 192.168.1.100 without rejecting them due to unlisted senders.

1. Main Configuration (/etc/postfix/main.cf):

   smtpd_client_restrictions = check_client_access hash:/etc/postfix/allowed_clients, permit
   smtpd_recipient_restrictions = check_client_access hash:/etc/postfix/allowed_clients, reject_unlisted_sender, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

2. Access List (/etc/postfix/allowed_clients):

   192.168.1.100 OK

3. Rebuild the Hash Table:

   sudo postmap /etc/postfix/allowed_clients

4. Reload Postfix:

   sudo systemctl reload postfix

This setup ensures that only the IP 192.168.1.100 can send emails without being restricted by the unlisted sender check, while other IPs will continue to be subject to normal security checks.

Conclusion

By using Postfix’s powerful configuration options, you can finely control how your mail server handles different clients and senders, allowing exceptions for specific trusted IPs or applications. This flexibility is crucial for integrating with various systems while maintaining security and reliability.