[Newby Question] Restrict outgoing mail to specific domain

[jdtron]

This might possibly be an easy task, but as the title already says, this is my first time ever hosting an email server.

I have a local mail server setup with the docker-mailserver container, that only serves the purpose of sending and accepting mail for my home lab. Everything works like a charm.

It's not exposed to the internet and it's meant to just work with my internal domain, so I wanted to block outgoing mails to other than my internal domain, to avoid bouncing mails to public servers, that reject them anyways.

I already searched for a solution and stumbled upon possibilities using transport maps and the smtp_recipient_restrictions setting.
But none of them worked.

Is there a (possibly simple) solution, so that my server rejects mail to other domains than my internal one?
Thanks in advance!

[polarathene]

Solution

transport maps

This seems like the way to go, although there is no official DMS support for making that easier, it's not too difficult for you to configure with us 😎

Custom config files (without runtime scripts)

Use our postfix-main.cf override to enable transport_maps:

# text is used instead of hash, this should work and not require the postmap + reload step:
transport_maps = text:/etc/postfix/transport

Then volume mount the config to /etc/postfix/transport, or alternatively, update that path above to point to your config volume (/tmp/docker-mailserver/path/to/transport):

.example.com   :
example.com    :
*              discard:

Postfix docs for transport table explain most of it.

• The * is ok (see "Table Search Order")
• The : for the first two lines is detailed in "Result Format" (5th paragraph, null transport + null nexthop == "do not change")
• The above snippet is very similar to the first "Example" snippet.
• discard is a different transport to direct all other mail to (configured in /etc/postfix/master.cf). It will do as it implies and discard the mail instead of delivering it.

Via user-patches.sh (all in one file)

If the above doesn't work, and you need to do the hash: table type with the postmap command, you can handle this with our user-patches.sh, that'll run after startup of DMS is finished, but just before we start Postfix (so no reload necessary).

user-patches.sh:

#! /bin/bash

# Update `main.cf` directly instead of `postfix-main.cf` override:
postconf 'transport_maps = hash:/etc/postfix/transport'

# NOTE: If you prefer to copy separate file instead of using below heredoc, use:
# cp /tmp/docker-mailserver/transport /etc/postfix/transport

# HereDoc to create the file inline:
cat > /etc/postfix/transport << EOF
.example.com   :
example.com    :
*              discard:
EOF

# hash table type requires running `postmap` command to update:
postmap /etc/postfix/transport

---

Alternatives

smtp_recipient_restrictions

That is not a valid setting, there's only smtpd_recipient_restrictions, but that will only limit inbound mail (port 25, or submission(s) ports 587 and 465), not mail Postfix could send out itself or permit through other means (local mail submission such as sendmail command I think goes straight to the mail queue bypassing any restriction?).

The order of the restrictions is also important, and probably a bit annoying to tamper with when DMS modifies it in a few places during startup.

This answer also notes that it doesn't seem like smtpd_recipient_restrictions would be as viable as transport_maps.

Is there a (possibly simple) solution, so that my server rejects mail to other domains than my internal one?

You could use your own local DNS, such as with a CoreDNS container and really limit it for internal use, but that's probably not as easy 😅

[jdtron]

Hi @polarathene and thanks vor the very detailed explaination!

I tried your suggested solutions in order you wrote them down.

Config files
For some reason Postfix doesn't seem to like the text map type. I got an error in my log, saying that it's not supported.

user-patches.sh
This one worked immediately. I chose to have the transport config in a separate file and let the script copy it over, as you suggested. It works like a charm.

Thank you very much for helping me understand better how stuff works and making me able to get things to work! 🥳

[polarathene]

I got an error in my log, saying that it's not supported.

Yeah I figured it didn't support that for this setting based on the Postfix docs and linked ServerFault answer. Sometimes it is which is a little convenient. Thanks for letting me know 👍

---

This one worked immediately.
I chose to have the transport config in a separate file and let the script copy it over, as you suggested. It works like a charm.

Fantastic! 🥳

There have been similar discussions in the past for using transport_maps for a noreply@example.com which points to a discard (although the transport docs examples show a potentially better way with error to send a bounce message back to anyone who does try). Maybe DMS will get some integration some day :)

---

Thank you very much

No problem! Enjoy DMS 😁

[jdtron]

the transport docs examples show a potentially better way with error

This might be a even better approach.
I updated my transport map to use error instead of discard, so the user is informed, that the mail was not delivered.

No problem! Enjoy DMS 😁

I do, thanks to people like you and the nice community that built such a greate project!
It's a nice way for people like me, who were never in touch with a mail server, to easily get a running system and dive into the details in a much more enjoyable way.

Thanks to everyone involved for making this project possible and being so friendly and helpful 🙂