1 # ACCESS(5) ACCESS(5) 2 # 3 # NAME 4 # access - Postfix SMTP server access table 5 # 6 # SYNOPSIS 7 # postmap /etc/postfix/access 8 # 9 # postmap -q "string" /etc/postfix/access 10 # 11 # postmap -q - /etc/postfix/access <inputfile 12 # 13 # DESCRIPTION 14 # This document describes access control on remote SMTP 15 # client information: host names, network addresses, and 16 # envelope sender or recipient addresses; it is implemented 17 # by the Postfix SMTP server. See header_checks(5) or 18 # body_checks(5) for access control on the content of email 19 # messages. 20 # 21 # Normally, the access(5) table is specified as a text file 22 # that serves as input to the postmap(1) command to create 23 # an indexed file for fast lookup. 24 # 25 # Execute the command "postmap /etc/postfix/access" to 26 # rebuild a default-type indexed file after changing the 27 # text file, or execute "postmap type:/etc/postfix/access" 28 # to specify an explicit type. 29 # 30 # The default indexed file type is configured with the 31 # default_database_type parameter. Depending on the platform 32 # this may be one of lmdb:, cdb:, hash:, or dbm: (without 33 # the trailing ':'). 34 # 35 # When the table is provided via other means such as NIS, 36 # LDAP or SQL, the same lookups are done as for ordinary 37 # indexed files. Managing such databases is outside the 38 # scope of Postfix. 39 # 40 # Alternatively, the table can be provided as a regu- 41 # lar-expression map where patterns are given as regular 42 # expressions, or lookups can be directed to a TCP-based 43 # server. In those cases, the lookups are done in a slightly 44 # different way as described below under "REGULAR EXPRESSION 45 # TABLES" or "TCP-BASED TABLES". 46 # 47 # CASE FOLDING 48 # The search string is folded to lowercase before database 49 # lookup. As of Postfix 2.3, the search string is not case 50 # folded with database types such as regexp: or pcre: whose 51 # lookup fields can match both upper and lower case. 52 # 53 # TABLE FORMAT 54 # The input format for the postmap(1) command is as follows: 55 # 56 # pattern action 57 # When pattern matches a mail address, domain or host 58 # address, perform the corresponding action. 59 # 60 # blank lines and comments 61 # Empty lines and whitespace-only lines are ignored, 62 # as are lines whose first non-whitespace character 63 # is a `#'. 64 # 65 # multi-line text 66 # A logical line starts with non-whitespace text. A 67 # line that starts with whitespace continues a logi- 68 # cal line. 69 # 70 # EMAIL ADDRESS PATTERNS IN INDEXED TABLES 71 # With lookups from indexed files such as DB or DBM, or from 72 # networked tables such as NIS, LDAP or SQL, patterns are 73 # tried in the order as listed below: 74 # 75 # user@domain 76 # Matches the specified mail address. 77 # 78 # domain.tld 79 # Matches domain.tld as the domain part of an email 80 # address. 81 # 82 # The pattern domain.tld also matches subdomains, but 83 # only when the string smtpd_access_maps is listed in 84 # the Postfix parent_domain_matches_subdomains con- 85 # figuration setting. 86 # 87 # .domain.tld 88 # Matches subdomains of domain.tld, but only when the 89 # string smtpd_access_maps is not listed in the Post- 90 # fix parent_domain_matches_subdomains configuration 91 # setting. 92 # 93 # user@ Matches all mail addresses with the specified user 94 # part. 95 # 96 # Note: lookup of the null sender address is not possible 97 # with some types of lookup table. By default, Postfix uses 98 # <> as the lookup key for such addresses. The value is 99 # specified with the smtpd_null_access_lookup_key parameter 100 # in the Postfix main.cf file. 101 # 102 # EMAIL ADDRESS EXTENSION 103 # When a mail address localpart contains the optional recip- 104 # ient delimiter (e.g., user+foo@domain), the lookup order 105 # becomes: user+foo@domain, user@domain, domain, user+foo@, 106 # and user@. 107 # 108 # HOST NAME/ADDRESS PATTERNS IN INDEXED TABLES 109 # With lookups from indexed files such as DB or DBM, or from 110 # networked tables such as NIS, LDAP or SQL, the following 111 # lookup patterns are examined in the order as listed: 112 # 113 # domain.tld 114 # Matches domain.tld. 115 # 116 # The pattern domain.tld also matches subdomains, but 117 # only when the string smtpd_access_maps is listed in 118 # the Postfix parent_domain_matches_subdomains con- 119 # figuration setting. 120 # 121 # .domain.tld 122 # Matches subdomains of domain.tld, but only when the 123 # string smtpd_access_maps is not listed in the Post- 124 # fix parent_domain_matches_subdomains configuration 125 # setting. 126 # 127 # net.work.addr.ess 128 # 129 # net.work.addr 130 # 131 # net.work 132 # 133 # net Matches a remote IPv4 host address or network 134 # address range. Specify one to four decimal octets 135 # separated by ".". Do not specify "[]" , "/", lead- 136 # ing zeros, or hexadecimal forms. 137 # 138 # Network ranges are matched by repeatedly truncating 139 # the last ".octet" from a remote IPv4 host address 140 # string, until a match is found in the access table, 141 # or until further truncation is not possible. 142 # 143 # NOTE: use the cidr lookup table type to specify 144 # network/netmask patterns. See cidr_table(5) for 145 # details. 146 # 147 # net:work:addr:ess 148 # 149 # net:work:addr 150 # 151 # net:work 152 # 153 # net Matches a remote IPv6 host address or network 154 # address range. Specify three to eight hexadecimal 155 # octet pairs separated by ":", using the compressed 156 # form "::" for a sequence of zero-valued octet 157 # pairs. Do not specify "[]", "/", leading zeros, or 158 # non-compressed forms. 159 # 160 # A network range is matched by repeatedly truncating 161 # the last ":octetpair" from the compressed-form 162 # remote IPv6 host address string, until a match is 163 # found in the access table, or until further trunca- 164 # tion is not possible. 165 # 166 # NOTE: use the cidr lookup table type to specify 167 # network/netmask patterns. See cidr_table(5) for 168 # details. 169 # 170 # IPv6 support is available in Postfix 2.2 and later. 171 # 172 # ACCEPT ACTIONS 173 # OK Accept the address etc. that matches the pattern. 174 # 175 # all-numerical 176 # An all-numerical result is treated as OK. This for- 177 # mat is generated by address-based relay authoriza- 178 # tion schemes such as pop-before-smtp. 179 # 180 # For other accept actions, see "OTHER ACTIONS" below. 181 # 182 # REJECT ACTIONS 183 # Postfix version 2.3 and later support enhanced status 184 # codes as defined in RFC 3463. When no code is specified 185 # at the beginning of the text below, Postfix inserts a 186 # default enhanced status code of "5.7.1" in the case of 187 # reject actions, and "4.7.1" in the case of defer actions. 188 # See "ENHANCED STATUS CODES" below. 189 # 190 # 4NN text 191 # 192 # 5NN text 193 # Reject the address etc. that matches the pattern, 194 # and respond with the numerical three-digit code and 195 # text. 4NN means "try again later", while 5NN means 196 # "do not try again". 197 # 198 # The following responses have special meaning for 199 # the Postfix SMTP server: 200 # 201 # 421 text (Postfix 2.3 and later) 202 # 203 # 521 text (Postfix 2.6 and later) 204 # After responding with the numerical 205 # three-digit code and text, disconnect imme- 206 # diately from the SMTP client. This frees up 207 # SMTP server resources so that they can be 208 # made available to another SMTP client. 209 # 210 # Note: The "521" response should be used only 211 # with botnets and other malware where inter- 212 # operability is of no concern. The "send 521 213 # and disconnect" behavior is NOT defined in 214 # the SMTP standard. 215 # 216 # REJECT optional text... 217 # Reject the address etc. that matches the pattern. 218 # Reply with "$access_map_reject_code optional 219 # text..." when the optional text is specified, oth- 220 # erwise reply with a generic error response message. 221 # 222 # DEFER optional text... 223 # Reject the address etc. that matches the pattern. 224 # Reply with "$access_map_defer_code optional 225 # text..." when the optional text is specified, oth- 226 # erwise reply with a generic error response message. 227 # 228 # This feature is available in Postfix 2.6 and later. 229 # 230 # DEFER_IF_REJECT optional text... 231 # Defer the request if some later restriction would 232 # result in a REJECT action. Reply with 233 # "$access_map_defer_code 4.7.1 optional text..." 234 # when the optional text is specified, otherwise 235 # reply with a generic error response message. 236 # 237 # Prior to Postfix 2.6, the SMTP reply code is 450. 238 # 239 # This feature is available in Postfix 2.1 and later. 240 # 241 # DEFER_IF_PERMIT optional text... 242 # Defer the request if some later restriction would 243 # result in an explicit or implicit PERMIT action. 244 # Reply with "$access_map_defer_code 4.7.1 optional 245 # text..." when the optional text is specified, oth- 246 # erwise reply with a generic error response message. 247 # 248 # Prior to Postfix 2.6, the SMTP reply code is 450. 249 # 250 # This feature is available in Postfix 2.1 and later. 251 # 252 # For other reject actions, see "OTHER ACTIONS" below. 253 # 254 # OTHER ACTIONS 255 # restriction... 256 # Apply the named UCE restriction(s) (permit, reject, 257 # reject_unauth_destination, and so on). 258 # 259 # BCC user@domain 260 # Send one copy of the message to the specified 261 # recipient. 262 # 263 # If multiple BCC actions are specified within the 264 # same SMTP MAIL transaction, with Postfix 3.0 only 265 # the last action will be used. 266 # 267 # This feature is available in Postfix 3.0 and later. 268 # 269 # DISCARD optional text... 270 # Claim successful delivery and silently discard the 271 # message. Log the optional text if specified, oth- 272 # erwise log a generic message. 273 # 274 # Note: this action currently affects all recipients 275 # of the message. To discard only one recipient 276 # without discarding the entire message, use the 277 # transport(5) table to direct mail to the discard(8) 278 # service. 279 # 280 # This feature is available in Postfix 2.0 and later. 281 # 282 # DUNNO Pretend that the lookup key was not found. This 283 # prevents Postfix from trying substrings of the 284 # lookup key (such as a subdomain name, or a network 285 # address subnetwork). 286 # 287 # This feature is available in Postfix 2.0 and later. 288 # 289 # FILTER transport:destination 290 # After the message is queued, send the entire mes- 291 # sage through the specified external content filter. 292 # The transport name specifies the first field of a 293 # mail delivery agent definition in master.cf; the 294 # syntax of the next-hop destination is described in 295 # the manual page of the corresponding delivery 296 # agent. More information about external content 297 # filters is in the Postfix FILTER_README file. 298 # 299 # Note 1: do not use $number regular expression sub- 300 # stitutions for transport or destination unless you 301 # know that the information has a trusted origin. 302 # 303 # Note 2: this action overrides the main.cf con- 304 # tent_filter setting, and affects all recipients of 305 # the message. In the case that multiple FILTER 306 # actions fire, only the last one is executed. 307 # 308 # Note 3: the purpose of the FILTER command is to 309 # override message routing. To override the recipi- 310 # ent's transport but not the next-hop destination, 311 # specify an empty filter destination (Postfix 2.7 312 # and later), or specify a transport:destination that 313 # delivers through a different Postfix instance 314 # (Postfix 2.6 and earlier). Other options are using 315 # the recipient-dependent transport_maps or the sen- 316 # der-dependent sender_dependent_default_transport- 317 # _maps features. 318 # 319 # This feature is available in Postfix 2.0 and later. 320 # 321 # HOLD optional text... 322 # Place the message on the hold queue, where it will 323 # sit until someone either deletes it or releases it 324 # for delivery. Log the optional text if specified, 325 # otherwise log a generic message. 326 # 327 # Mail that is placed on hold can be examined with 328 # the postcat(1) command, and can be destroyed or 329 # released with the postsuper(1) command. 330 # 331 # Note: use "postsuper -r" to release mail that was 332 # kept on hold for a significant fraction of $maxi- 333 # mal_queue_lifetime or $bounce_queue_lifetime, or 334 # longer. Use "postsuper -H" only for mail that will 335 # not expire within a few delivery attempts. 336 # 337 # Note: this action currently affects all recipients 338 # of the message. 339 # 340 # This feature is available in Postfix 2.0 and later. 341 # 342 # PREPEND headername: headervalue 343 # Prepend the specified message header to the mes- 344 # sage. When more than one PREPEND action executes, 345 # the first prepended header appears before the sec- 346 # ond etc. prepended header. 347 # 348 # Note: this action must execute before the message 349 # content is received; it cannot execute in the con- 350 # text of smtpd_end_of_data_restrictions. 351 # 352 # This feature is available in Postfix 2.1 and later. 353 # 354 # REDIRECT user@domain 355 # After the message is queued, send the message to 356 # the specified address instead of the intended 357 # recipient(s). When multiple REDIRECT actions fire, 358 # only the last one takes effect. 359 # 360 # Note 1: this action overrides the FILTER action, 361 # and currently overrides all recipients of the mes- 362 # sage. 363 # 364 # Note 2: a REDIRECT address is subject to canonical- 365 # ization (add missing domain) but NOT subject to 366 # canonical, masquerade, bcc, or virtual alias map- 367 # ping. 368 # 369 # This feature is available in Postfix 2.1 and later. 370 # 371 # INFO optional text... 372 # Log an informational record with the optional text, 373 # together with client information and if available, 374 # with helo, sender, recipient and protocol informa- 375 # tion. 376 # 377 # This feature is available in Postfix 3.0 and later. 378 # 379 # WARN optional text... 380 # Log a warning with the optional text, together with 381 # client information and if available, with helo, 382 # sender, recipient and protocol information. 383 # 384 # This feature is available in Postfix 2.1 and later. 385 # 386 # ENHANCED STATUS CODES 387 # Postfix version 2.3 and later support enhanced status 388 # codes as defined in RFC 3463. When an enhanced status 389 # code is specified in an access table, it is subject to 390 # modification. The following transformations are needed 391 # when the same access table is used for client, helo, 392 # sender, or recipient access restrictions; they happen 393 # regardless of whether Postfix replies to a MAIL FROM, RCPT 394 # TO or other SMTP command. 395 # 396 # o When a sender address matches a REJECT action, the 397 # Postfix SMTP server will transform a recipient DSN 398 # status (e.g., 4.1.1-4.1.6) into the corresponding 399 # sender DSN status, and vice versa. 400 # 401 # o When non-address information matches a REJECT 402 # action (such as the HELO command argument or the 403 # client hostname/address), the Postfix SMTP server 404 # will transform a sender or recipient DSN status 405 # into a generic non-address DSN status (e.g., 406 # 4.0.0). 407 # 408 # REGULAR EXPRESSION TABLES 409 # This section describes how the table lookups change when 410 # the table is given in the form of regular expressions. For 411 # a description of regular expression lookup table syntax, 412 # see regexp_table(5) or pcre_table(5). 413 # 414 # Each pattern is a regular expression that is applied to 415 # the entire string being looked up. Depending on the appli- 416 # cation, that string is an entire client hostname, an 417 # entire client IP address, or an entire mail address. Thus, 418 # no parent domain or parent network search is done, 419 # user@domain mail addresses are not broken up into their 420 # user@ and domain constituent parts, nor is user+foo broken 421 # up into user and foo. 422 # 423 # Patterns are applied in the order as specified in the ta- 424 # ble, until a pattern is found that matches the search 425 # string. 426 # 427 # Actions are the same as with indexed file lookups, with 428 # the additional feature that parenthesized substrings from 429 # the pattern can be interpolated as $1, $2 and so on. 430 # 431 # TCP-BASED TABLES 432 # This section describes how the table lookups change when 433 # lookups are directed to a TCP-based server. For a descrip- 434 # tion of the TCP client/server lookup protocol, see tcp_ta- 435 # ble(5). This feature is not available up to and including 436 # Postfix version 2.4. 437 # 438 # Each lookup operation uses the entire query string once. 439 # Depending on the application, that string is an entire 440 # client hostname, an entire client IP address, or an entire 441 # mail address. Thus, no parent domain or parent network 442 # search is done, user@domain mail addresses are not broken 443 # up into their user@ and domain constituent parts, nor is 444 # user+foo broken up into user and foo. 445 # 446 # Actions are the same as with indexed file lookups. 447 # 448 # EXAMPLE 449 # The following example uses an indexed file, so that the 450 # order of table entries does not matter. The example per- 451 # mits access by the client at address 1.2.3.4 but rejects 452 # all other clients in 1.2.3.0/24. Instead of hash lookup 453 # tables, some systems use dbm. Use the command "postconf 454 # -m" to find out what lookup tables Postfix supports on 455 # your system. 456 # 457 # /etc/postfix/main.cf: 458 # smtpd_client_restrictions = 459 # check_client_access hash:/etc/postfix/access 460 # 461 # /etc/postfix/access: 462 # 1.2.3 REJECT 463 # 1.2.3.4 OK 464 # 465 # Execute the command "postmap /etc/postfix/access" after 466 # editing the file. 467 # 468 # BUGS 469 # The table format does not understand quoting conventions. 470 # 471 # SEE ALSO 472 # postmap(1), Postfix lookup table manager 473 # smtpd(8), SMTP server 474 # postconf(5), configuration parameters 475 # transport(5), transport:nexthop syntax 476 # 477 # README FILES 478 # Use "postconf readme_directory" or "postconf html_direc- 479 # tory" to locate this information. 480 # SMTPD_ACCESS_README, built-in SMTP server access control 481 # DATABASE_README, Postfix lookup table overview 482 # 483 # LICENSE 484 # The Secure Mailer license must be distributed with this 485 # software. 486 # 487 # AUTHOR(S) 488 # Wietse Venema 489 # IBM T.J. Watson Research 490 # P.O. Box 704 491 # Yorktown Heights, NY 10598, USA 492 # 493 # Wietse Venema 494 # Google, Inc. 495 # 111 8th Avenue 496 # New York, NY 10011, USA 497 # 498 # ACCESS(5) 499
Indexes created Sun Sep 20 00:26:38 UTC 2026