I want to reject emails to my postfix server based on more than one criteria, specifically I want to block emails from Russian email addresses (or that contain Cyrillic characters, but this I suspect is harder) that are addressed to two specific recipients (but not if addressed to others).

I feel this should be straightforward especially since the 'mail from' and 'rcpt to' addresses are both supplied right at the start of the smtp negotiation. But I can't find a way to do this with postfix, and am not sure if I need some add-on package (milter?).


Add in a restriction class. For example:

smtpd_recipient_restrictions =
    check_recipient_access hash:/etc/postfix/recipient_access

smtpd_restriction_classes = no_russians
no_russians = check_sender_access pcre:/etc/postfix/no_russians

recipient1@mydomain.com     no_russians
recipient2@mydomain.com     no_russians

/\.ru$/ REJECT
  • Thank you, this is the best solution for my specific situation I think, except that the 'no russians =' line should not be indented. I have it working now! Instead of smtpd_recipient_restrictions it is also possible to use smtpd_relay_restrictions if this is more appropriate. – gogoud Sep 30 '15 at 10:43

Basically copy/pasting from http://code.metager.de/source/xref/postfix-debian/examples/smtpd-policy/greylist.pl#257 and adapting as we go, here is a simple Perl script to implement no_ru.pl as a simple check_policy_service script. See http://www.postfix.org/SMTPD_POLICY_README.html for how to hook it in.

Untested, YMMV, etc. You probably need to use and perhaps initialize a few facilities like syslog -- try this from the command line first.

# Unbuffer standard output.
select((select(STDOUT), $| = 1)[0]);

# Receive a bunch of attributes, evaluate the policy, send the result.
%attr = ();
$ru_sender = $ru_rcpt = 0;
while (<STDIN>) {
  if (/^\s*sender=.*\.ru\n/i) {
     $ru_sender = 1;
  } elsif (/^\s*recipient=.*\.ru$/i) {
     $ru_rcpt = 1;
  } elsif ($_ eq "\n") {
    if ($verbose) {
      syslog $syslog_priority, "ru_sender %i, ru_rcpt %i", $ru_sender, $ru_rcpt;
    $action = ($ru_sender && $ru_rcpt) ? "reject" : "dunno";
    syslog $syslog_priority, "Action: %s", $action if $verbose;
    print STDOUT "action=$action\n\n";
    %attr = ();
  } else {
    syslog $syslog_priority, "warning: ignoring garbage: %.100s", $_;
  • Thanks for this worked-through suggestion. This type of approach might be really good in some more complex instances but the use of smtpd_restriction_classes as suggested by prabbide seems to me more elegant in this case. I may come back to your code in the future though! – gogoud Sep 30 '15 at 10:46

Have a look at the smtpd_recipient_restrictions and smtpd_sender_restrictions directives. Using those you can configure hash maps containing the filters you desire.

smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender_access

.ru                       REJECT
someone@domain.com        REJECT

See also http://www.postfix.org/ADDRESS_VERIFICATION_README.html and http://www.postfix.org/SMTPD_ACCESS_README.html

  • but as I understand it this will 'OR' the restrictions not 'AND' them. That is, it will reject all emails from '.ru' regardless of recipient and all emails from someone@domain.com - I want to reject emails from '.ru' but only if addresses to two specific recipients. – gogoud Sep 22 '15 at 7:55
  • Sorry, misread your question. Have a look at Postfix Access Policy Delegation at postfix.org/SMTPD_POLICY_README.html. You can use it to extend basic filtering with more complex policies written in Perl. – Lambert Sep 22 '15 at 8:03
  • This is probably a way of doing it, but very complicated (not least because I would have to learn Perl...) - do you know of an easier way? – gogoud Sep 22 '15 at 11:20
  • You can use a number of other scripting languages. What would you prefer? The linked document from @Lambert's comment is fairly detailed; what you are asking should not be very hard. – tripleee Sep 28 '15 at 4:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.