Skip to content

Recipient Domain Restrictions for users

This guide demonstrates how to limit user's outbound email destinations to specific domains using LDAP

How It Works

  • When a sender attempts to send an email, Postfix queries the rcpt_restriction.cf map
  • The map checks if the sender is a member of the recipient_restriction policy group
  • If the sender is in the group, the recipient_restriction class is triggered
  • The restriction class checks the recipient domain against the user's allowDomain list in LDAP
  • If the domain is allowed, Postfix returns OK; otherwise, the mail is rejected with a custom message

Configuring Recipient Domain Restrictions

LDAP

Create a policy group and add restricted senders. Add domains to allowDomain attribute for user

dn: uid=xdeeproot,ou=people,dc=deeproot,dc=in 
objectClass: top
...
allowDomain: deeproot.in

dn: cn=recipient_restriction,ou=policy,dc=deeproot,dc=in 
objectClass: top
objectClass: deepofixUser
cn: recipient_restriction
restrictedSender: xdeeproot@deeproot.in

Postfix configuration

Lookup tables

Create an LDAP table that queries allowed domains. If the domain is permitted, return 'OK'; otherwise, reject the mail

server_host = 127.0.0.1:389
bind = yes
bind_dn = uid=deepofix,ou=admin,dc=deeproot,dc=in
bind_pw = bind_pass
search_base = dc=deeproot,dc=in
query_filter = (&(objectClass=qmailUser)(allowedDomains=%d))
result_attribute = mail
result_format = OK

/*/ REJECT You are not allowed to send to this domain

Restriction class

Create a restriction class using the lookup tables and enable restriction. The smtpd_restriction_classes evaluates FROM address against the recipient_restriction class.

# restriction classes
recipient_restriction = check_recipient_access ldap:/etc/postfix/restrictions/allowed_rcpts.cf, check_recipient_access pcre:/etc/postfix/restriction/reject_rcpts.cf, reject

smtpd_restriction_classes = recipient_restriction

# Smtpd restrictions
smtpd_sender_restrictions =  check_sender_access ldap:/etc/postfix/restrictions/rcpt_restriction.cf,
  ...  # other restrictions

Restriction map

The allowed domains in LDAP do not automatically enforce restrictions. A policy group is used to determine which users should be restricted. This map checks if a sender belongs to the restriction policy group and applies the restriction class accordingly.

server_host = 127.0.0.1:389
bind = yes
bind_dn = uid=deepofix,ou=admin,dc=deeproot,dc=in
bind_pw = bind_pass
search_base = ou=policy,dc=deeproot,dc=in
query_filter = (&(objectClass=deepofixUser)(cn=recipient_restriction)(restrictedSender=%s))
result_attribute = cn

This setup ensures that only users in the recipient_restriction policy group with explicitly defined allowed domains can send to those domains. All other recipient domains will be rejected.