What does "setup email restrict <add|del|list> <send|receive> [<EMAIL ADDRESS>]" do?

[Waldorf3]

Can I block or "whitelist" an email address with this command? The help isn't very ... helpful ;)

# docker exec -ti mailserver setup email restrict help
[   INF   ]  Usage: /usr/local/bin/restrict-access <add|del|list> <send|receive> [<email@domain.com>]
[  ERROR  ]  Unknown or missing second parameter '' - specify 'send' or 'receive'
[  ERROR  ]  Aborting
# docker exec -ti mailserver setup email restrict add receive help
[  ERROR  ]  User 'help' already denied to receive mails
[  ERROR  ]  Aborting

[polarathene]

If you're comfortable reading the related script, this is the interesting part:

docker-mailserver/target/bin/restrict-access

Lines 34 to 45 in f674232

	if [[ ${DIRECTION} == 'send' ]]; then
	CHECK='check_sender_access'
	POSTFIX_OPTION='smtpd_sender_restrictions'
	else
	CHECK='check_recipient_access'
	POSTFIX_OPTION='smtpd_recipient_restrictions'
	fi
	# only adjust Postfix's `main.cf` if we haven't adjusted it before
	STRING_TO_BE_ADDED="${CHECK} texthash:/tmp/docker-mailserver/postfix-${DIRECTION}-access.cf"
	if ! grep -q "${STRING_TO_BE_ADDED}" /etc/postfix/main.cf; then
	sed -i -E "s|^(${POSTFIX_OPTION} =)(.*)|\1 ${STRING_TO_BE_ADDED},\2|" /etc/postfix/main.cf

You can look up the two postfix options on the Postfix config docs:

• https://www.postfix.org/postconf.5.html#smtpd_sender_restrictions
• https://www.postfix.org/postconf.5.html#smtpd_recipient_restrictions

Both appear to configure a recipient or sender access lookup table. I don't have much input beyond that unfortunately.

---

The help isn't very ... helpful ;)

To be fair, it does say "most" commands support help 😅

docker-mailserver/target/bin/setup

Lines 24 to 25 in f674232

	Most subcommands can provide additional information and examples by appending 'help'.
	For example: 'setup email add help'

It is an old feature contributed from community a while back I think, so it's not in as good shape as other parts of DMS. I don't think we have any official documentation tied to it either :(

[Waldorf3]

To be fair, it does say "most" commands support help 😅

Don't get me wrong, this is an awesome mailserver-inna-box solution. Amazing I run it in a 1 GB VM where most others would require 4 or even 8 GB to run reliable.

I was just looking for a way to block/reject specific mail addresses and domains and it seemed this might be it. I had a look at the linked docs, but it's unfortubately a bit too technical for my paygrade.

[polarathene]

From the access table docs:

This document describes access control on remote SMTP client information: host names, network addresses, and envelope sender or recipient addresses

The last part notes that you can use it for sender and recipient addresses which the related setup command was handling with those Postfix settings I linked earlier.

Further down in that access table docs is some example patterns supported, showing that it can match on a full email address (user@example.com, just the domain (example.com), all subdomains (.example.com) or user for any domain (user@).

When you add an address into this config file, it will append it like this with the REJECT result:

docker-mailserver/target/bin/restrict-access

Line 32 in f674232

echo -e "${USER} \t\t REJECT" >>"${DATABASE}"

Further down the access table docs is the actions, and for REJECT we have:

REJECT optional text...
Reject the address etc. that matches the pattern. Reply with "$access_map_reject_code optional text..." when the optional text is specified, otherwise reply with a generic error response message.

---

The current help message is what you already shared in your log output:

docker-mailserver/target/bin/restrict-access

Line 11 in f674232

function __usage { _log 'info' "Usage: ${0} <add|del|list> <send|receive> [<email@domain.com>]" ; }

We just need that extra clarity of what send and receive map to:

docker-mailserver/target/bin/restrict-access

Lines 34 to 40 in f674232

	if [[ ${DIRECTION} == 'send' ]]; then
	CHECK='check_sender_access'
	POSTFIX_OPTION='smtpd_sender_restrictions'
	else
	CHECK='check_recipient_access'
	POSTFIX_OPTION='smtpd_recipient_restrictions'
	fi

• send => sender address access config, configured for smtpd_sender_restrictions (matching mail that arrives on MAIL FROM).
• receive => recipient address access config, configured for smtpd_recipient_restrictions (matching mail that arrives on RCPT TO)

Great so if you want to block mail:

• Arriving from a specific user or domain (sender) => Use that with setup email restrict add send user@somewhere.com.
• Arriving to a specific user or domain (recipient) => Use that with setup email restrict add receive user@example.com.

You can use the setup email restrict list ... command with send or receive to then see what has already been added to either config file. Or likewise using setup email restrict del ... to remove one you've added (or just directly edit the file created).

---

I was just looking for a way to block/reject specific mail addresses and domains and it seemed this might be it.

Hope the above helps clarify the feature better.

Looks like it'll reject any mail address that matches a sender or recipient config described above with a generic message. You should be able to test it yourself with some other email address?

Since the command reloads Postfix after making the config change, it should apply immediately without needing to restart DMS. If you manually edit the config files instead you'd probably have to restart for it to notice the change.

[Waldorf3]

Indeed,
docker exec -it mailserver setup email restrict del send mail@example.com does indeed cause the mailserver to reject mail from mail@example.com with the message:

The response from the remote server was:
554 5.7.1 mail@example.com: Sender address rejected: Access denied

[polarathene]

I think you meant ... restrict add send ... (add instead of del)? But that is great to know! 😁

I suppose we should make a task get this better documented! (EDIT: Done!)

[Waldorf3]

Yes of course, sorry. Was playing around with the different options to understand what was what, and ended up copy/pasting a wrong line.

docker exec -it mailserver setup email restrict add send mail@example.com

Btw, it appears it is also possible to block a whole domain in the same way by using

docker exec -it mailserver setup email restrict add send @example.com

[polarathene]

Btw, it appears it is also possible to block a whole domain in the same way by using

I did mention this actually in my breakdown above for you 😉

I wasn't aware of it being valid with the @ prefix, as that wasn't mentioned in the docs. They suggested:

• user@ to target a user (local-part of address) for any domain.
• example.com for the domain-part regardless of local-part.
• Additionally .example.com (. prefix) to block any subdomain (Supposedly: marketing.example.com ✔️ , promotions.sales.example.com ❌ /❓ ).

[Waldorf3]

... 1.5 year later ...

So it's essentially a blacklist functionality, right?

How about a whitelist functionality, i.e. a way to disable all spam checking on mail from certain email addresses? Does this exist too somehow?

[polarathene]

There is no official convenience for whitelist support AFAIK.

However, I did provide this answer with detailed insights and advice for getting whitelist support per mail address in Amavis.

I do have a WIP (90% complete I think) follow-up response for rspamd equivalent there but I never got around to completing it due to a power outage event. If I find that and complete it at some point I'd update our docs to include guidance for these 😅 Presently I'm very busy elsewhere so I'm unable to provide much assistance.

These are rspamd/amavis specific solutions though. You can possibly do something on the Postfix side that skips mail being scanned when it's for specific recipients.

[Waldorf3]

Thanks, this is very helpful!! I just have so many questions about rspamd in DMS, and I can't seem to find answers anywhere. Like, changes made under config/rspamd/local.d and config/rspamd/override.d seem to be accepted and ignored somewhat randomly by DMS. I guess perhaps it has something to do with config being mounted to /tmp/... and the container doing something with that data on update, but what is not really clear to me.

If you'er 90% there, perhaps you could post it as a WIP and perhaps others (even me, perhaps?) could help fill in the blanks?

It's like with so many other things in life, the first 80% of the result are 20% of the work, the last 20% is 80% ;)

[polarathene]

TL;DR: I will share what I have when I can, but due to lack of RAM it will take a while as I prioritize finishing existing tasks.

The WIP document(s) are potentially noisy, all information needed is there but the final response might not be composed with the information you'd need (despite this attempting to access it right now is too risky for me to do).

Regardless I'll post an update once I return to my backlog item for it (feel free to ping me each month, many people are waiting on me to assist unfortunately so it may be a while).

If you're 90% there, perhaps you could post it as a WIP and perhaps others (even me, perhaps?) could help fill in the blanks?

I would if I could spare the time to look for it, but I have limited hardware for my system it is often always flirting with 95%+ RAM usage due to software like browser being open and using excessive memory. I have too much open that is unsaved that I'm juggling to resolve before another potential OOM/crash (had a few in the past few months where some of my work was lost).

I have a rough idea of where that WIP guide should be, it was being typed up into a discussions page in a browser tab at the time and I believe I made a backup copy to my notes program or an unsaved tab in VSCode (of which I have over 20 windows spanning projects in), so while there is some organization/structure I simply have too much incomplete tasks that I'm juggling between as time permits.

If I were to find it, I believe most of the WIP part was proper verification of commands and config to share. Some of that I would have lost when my system crashed (my terminal tabs and containers used to trial and error solve how to do it), but I believe the useful bits that you'd want were likely spread out across multiple unsaved tabs in VScode as I collected information from those terminal sessions to later comb through and tidy up. If I'm right then it'd be quite a bit of noise to sift through to get the information you actually want 😅

I have added this request to my TODO backlog, and if I can find time to locate any related documents for this task I'll update you with that information, but presently I cannot risk opening VSCode due to the memory usage concern. I must wrap up existing tasks I'm tackling at the moment and that can take a while until I can spare time for an improved workflow (like leveraging VM guests to suspend/snapshot my work safely).

[Waldorf3]

I'm not sure if I read this right but it seems like you have a lot of unsaved work in open browsers and other apps. Perhaps a quaint question, but maybe you could save to disk (or cloud, whatever) from time to time? No judgement, just curious?

Anyway I will dig into your Amavis link and see if I can understand what it does and make it do what I need. :)

[Waldorf3]

I don't think Amavis is used in DMS. Anyway I think I am able to both blacklist and whitelist email addresses and domains in postfix-send-access.cf.

I don't remember if I added this myself or it was already there, but it seems to work.

somspammer@somedomain.com REJECT
someknowngooddomain.com OK
someknown@goodemailaddress.com OK

[polarathene]

Perhaps a quaint question, but maybe you could save to disk (or cloud, whatever) from time to time? No judgement, just curious?

There is no such thing when I'm typing responses ad-hoc such as in this current discussion.

• If I encounter a power outage / system panic event, that data is gone.
• Sometimes I have OOM events that randomly kill software I have open, I may not be at my desk at the time this occurs, it is not always obvious when this type of data loss occurs.
• When I am delegating to external servers due to hardware constraints locally, I have an SSH session that gets terminated when internet connectivity is lost.
  • This occurs for me when the router (which I have no control/ownership of as a tenant) bugs out (or power loss event)
  • Lately this has also been causing difficult to troubleshoot network issues when the internet is restored (possibly driver related) as some websites are accessible while others are not, DNS queries for UDP are successful but TCP not, ping doesn't work for sites I cannot access. A couple weeks ago I was unable to interact with Github for 2 days until it resolved itself somehow, my phone was fine at reaching Github, and in this state my dev system could not get internet connectivity via my phone as a hotspot, so definitely an unfortunate issue to encounter.

For the latter point, I could probably resolve that with something like screen/tmux to not lose the session, or I could more actively guard against it by not running containers directly as I do (docker run --rm -it) and instead use -d to run it in the background and shell into it.

Most of the issues are resolvable, they just require me to divert time and energy from what I'm trying to accomplish to figure out how to resolve each different problem I run into.

For responses like these, I do try to actively maintain a backup copy that autosaves in another app like VSCode or Obsidian. The only issue there is keeping things in sync or keeping it tidy/organized as I juggle, but due to the amount of extra precaution there it can also add friction slowing me down further 😅

For context I currently have 5 browser windows I'm actively working with on a single virtual desktop over the past month, and possibly several hundred tabs across those as context on related topics as I troubleshoot and go through historical information on projects or their dependencies to get the information I need. Which I then will try to accumulate any noteworthy information and archive that into notes or raise issues / PRs with that info distilled.

Ideally I wouldn't be spreading myself thin like that and could be more focused with less open at any given time. I try to work towards that but it's often a losing battle due to the sheer size of content and tasks I'm juggling and struggle to reduce, best I can do is adopt better workflows/processes in future that work for me.

[polarathene]

I don't think Amavis is used in DMS.

It is, it is enabled by default:

docker-mailserver/target/scripts/startup/variables-stack.sh

Line 96 in 6bc4d24

VARS[ENABLE_AMAVIS]="${ENABLE_AMAVIS:=1}"

However it also delegates to SpamAssassin and ClamAV for anti-spam + anti-virus functionality, both require opt-in via ENV. Rspamd can manage spam by itself however.

The linked discussion I provided shows a detailed example for that users request of having Amavis/SA conditionally whitelist specific email addresses, while every other sender address would be subject to spam checks IIRC.

---

I don't remember if I added this myself or it was already there, but it seems to work.

somspammer@somedomain.com REJECT
someknowngooddomain.com OK
someknown@goodemailaddress.com OK

This is to 👍 / 👎 trust I think? So when a new mail is being delivered to Postfix, part of it's checks can involve this and decide to reject or allow that mail to go through.

I'd have to read up again, as I'm not sure if that would skip scanning for spam/viruses on the OK address matches when mail is arriving on port 25. Rejection works fine if you know the address is bad and don't need to filter.

If this approach is working well for you that's fantastic 😁 I wish I had more time to spare to be helpful, I am just swamped at present.

[Waldorf3]

I think I understand what you mean, it's hard to take time off for practical issues such as saving when you are deep into something else, but I just think you risk losing a lot more time that way than the time it would take to save from time to time. Anyway, no judgement, I was just wondering. I would get a nervous breakdown if it was me :)

The postfix .. fix, works fine, the whitelisted email addresses are my own, and the mail I get are like notification/warnings and such stuff that I don't want blocked. Obviously it is always possible someone could spoof them, but that is bridge I'll cross if and when it happens.

Thanks for your suggestions, they are very appreciated, not least knowing how busy you are working on the software for everybody's benefit!

[MichalisDBA]

Hello. Am i doing something wrong?

We have created an email account via:

setup email add info@mydomain.com Password1234

and then we want to disable the sending functonality from this account:

setup email restrict add send info@mydomain.com

The problem is that we still can send emails from info@mydomain.com

[polarathene]

Did you try restarting the container afterwards, docker compose up --force-recreate? It is sometimes required to apply settings updates.

UPDATE: As per my next comment, this seems to be the correct advice for you. In future please see our troubleshooting docs page, it's the first thing we ask our users to try (same with when they make a bug report).

[polarathene]

I have briefly touched on this feature in earlier comments on this discussion, for reference:

• https://github.com/orgs/docker-mailserver/discussions/3624#discussioncomment-7507323
• https://github.com/orgs/docker-mailserver/discussions/3624#discussioncomment-7514981

Which for your case the relevance is restricting incoming mail to Postfix via smtpd_sender_restrictions -> check_sender_access:

docker-mailserver/target/bin/restrict-access

Lines 32 to 37 in fcd9909

	echo -e "${USER} \t\t REJECT" >>"${DATABASE}"
	if [[ ${DIRECTION} == 'send' ]]; then
	CHECK='check_sender_access'
	POSTFIX_OPTION='smtpd_sender_restrictions'
	else

Now something I did not appear to mention in prior commentary was the rules change when that mail is submitted from a mail client (to port 587/465 instead of port 25), we defer to our custom restriction settings:

docker-mailserver/target/postfix/master.cf

Line 26 in fcd9909

-o smtpd_sender_restrictions=$mua_sender_restrictions

docker-mailserver/target/postfix/master.cf

Line 40 in fcd9909

-o smtpd_sender_restrictions=$mua_sender_restrictions

These are defined here, which effectively allows you to skip such restrictions applying to submitted mail:

docker-mailserver/target/postfix/main.cf

Lines 70 to 75 in fcd9909

	# Custom defined parameters for DMS:
	# Custom sender restrictions overview: https://github.com/docker-mailserver/docker-mailserver/pull/4379#issuecomment-2670365917
	# `reject_unknown_sender_domain`: https://github.com/docker-mailserver/docker-mailserver/issues/3716#issuecomment-1868033234
	dms_smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unknown_sender_domain
	# `SPOOF_PROTECTION=1` support requires prepending `reject_authenticated_sender_login_mismatch`
	mua_sender_restrictions = reject_authenticated_sender_login_mismatch, $dms_smtpd_sender_restrictions

It is a bit similar for port 25 (which just skips the custom mua settings):

docker-mailserver/target/postfix/main.cf

Line 59 in fcd9909

smtpd_sender_restrictions = $dms_smtpd_sender_restrictions

Except permit_sasl_authenticated, permit_mynetworks in either case means if the mail is sent from a trusted network or authenticated user (port 587/465), then security checks will be skipped.

And here is where we apply the actual setting during container startup (so restarting the container as I advised appears required in this case), and you can see that we are prepending this restriction so that it is run before the permit rules, thus it should also restrict the sender address with mail submission too 👍

docker-mailserver/target/scripts/startup/setup.d/postfix.sh

Lines 96 to 109 in fcd9909

	# These two config files are `access` database tables managed via `setup email restrict`:
	# NOTE: Prepends to existing restrictions, thus has priority over other permit/reject policies that follow.
	# https://www.postfix.org/postconf.5.html#smtpd_sender_restrictions
	# https://www.postfix.org/access.5.html
	__postfix__log 'trace' 'Configuring user access'
	if [[ -f /tmp/docker-mailserver/postfix-send-access.cf ]]; then
	# Prefer to prepend to our specialized variant instead:
	# https://github.com/docker-mailserver/docker-mailserver/pull/4379
	sed -i -E 's|^(dms_smtpd_sender_restrictions =)|\1 check_sender_access texthash:/tmp/docker-mailserver/postfix-send-access.cf,|' /etc/postfix/main.cf
	fi
	if [[ -f /tmp/docker-mailserver/postfix-receive-access.cf ]]; then
	sed -i -E 's|^(smtpd_recipient_restrictions =)|\1 check_recipient_access texthash:/tmp/docker-mailserver/postfix-receive-access.cf,|' /etc/postfix/main.cf
	fi

[MichalisDBA]

Thank you. docker compose up --force-recreate worked.