Put reject_unknown_recipient_domain
in smtpd_recipient_restrictions
before permit_mynetworks
, permit_sasl_authenticated
, and/or permit_tls_clientcerts
.
If reject_unknown_sender_domain
is missing from the config, or if permit_*
appears before reject_unknown_sender_domain
then postfix will allow all client senders matching the permit rule to send email without the recipient domain being checked. Postfix will accept the incoming mail, queue it, and only notice the domain doesn't exist when it attempts to deliver it....and then bounce the message.
If reject_unknown_sender_domain
appears first, then it is checked for all clients, whether they match a permit_*
rule or not, and the email is rejected with a 5xx code.
In postfix, the order of rules is always significant.
Example:
If you have the following in main.cf
:
smtpd_recipient_restrictions = check_sender_access hash:/etc/postfix/junk,
check_client_access hash:/etc/postfix/junk,
check_helo_access hash:/etc/postfix/junk,
reject_unauth_pipelining,
permit_tls_clientcerts,
permit_sasl_authenticated,
permit_mynetworks
add reject_unknown_recipient_domain
somewhere before the permit
lines, e.g.:
smtpd_recipient_restrictions = check_sender_access hash:/etc/postfix/junk,
check_client_access hash:/etc/postfix/junk,
check_helo_access hash:/etc/postfix/junk,
reject_unauth_pipelining,
reject_unknown_recipient_domain,
permit_tls_clientcerts,
permit_sasl_authenticated,
permit_mynetworks
If you don't already have a smtpd_recipient_restrictions
rule, add one like:
smtpd_recipient_restrictions = reject_unauth_pipelining,
reject_unknown_recipient_domain,
permit_mynetworks
You should, however, do some more research on configuring postfix.