1<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 "http://www.w3.org/TR/html4/loose.dtd"> 3 4<html> 5 6<head> 7 8<title>Rejecting Unknown Local Recipients with Postfix</title> 9 10<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 11<link rel='stylesheet' type='text/css' href='postfix-doc.css'> 12 13</head> 14 15<body> 16 17<h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Rejecting Unknown Local Recipients with Postfix</h1> 18 19<hr> 20 21<h2>Introduction</h2> 22 23<p> As of Postfix version 2.0, the Postfix SMTP server rejects mail 24for unknown recipients in <a href="ADDRESS_CLASS_README.html#local_domain_class">local domains</a> (domains that match 25$<a href="postconf.5.html#mydestination">mydestination</a> or the IP addresses in $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or 26$<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>) with "User unknown in local recipient table". 27This feature was optional with earlier Postfix versions. </p> 28 29<p> The good news is that this keeps undeliverable mail out of your 30queue, so that your mail queue is not clogged up with undeliverable 31MAILER-DAEMON messages. </p> 32 33<p> The bad news is that it may cause mail to be rejected when you 34upgrade from a Postfix system that was not configured to reject 35mail for unknown local recipients. </p> 36 37<p> This document describes what steps are needed in order to reject 38unknown local recipients correctly. </p> 39 40<ul> 41 42<li><a href="#main_config">Configuring local_recipient_maps 43in main.cf</a> 44 45<li><a href="#change">When you need to change the local_recipient_maps 46setting in main.cf</a> 47 48<li><a href="#format">Local recipient table format </a> 49 50</ul> 51 52<h2><a name="main_config">Configuring local_recipient_maps 53in main.cf</a></h2> 54 55<p> The <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> parameter specifies lookup tables with 56all names or addresses of local recipients. A recipient address is 57local when its domain matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or 58$<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>. If a local username or address is not listed in 59$<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, then the Postfix SMTP server will reject 60the address with "User unknown in local recipient table". </p> 61 62<p> The default setting, shown below, assumes that you use the 63default Postfix <a href="local.8.html">local(8)</a> delivery agent for local delivery, where 64recipients are either UNIX accounts or local aliases: </p> 65 66<blockquote> 67<pre> 68/etc/postfix/<a href="postconf.5.html">main.cf</a>: 69 <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> = <a href="proxymap.8.html">proxy</a>:unix:passwd.byname $<a href="postconf.5.html#alias_maps">alias_maps</a> 70</pre> 71</blockquote> 72 73<p> To turn off unknown local recipient rejects by the SMTP server, 74specify: </p> 75 76<blockquote> 77<pre> 78/etc/postfix/<a href="postconf.5.html">main.cf</a>: 79 <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> = 80</pre> 81</blockquote> 82 83<p> That is, an empty value. With this setting, the Postfix SMTP 84server will not reject mail with "User unknown in local recipient 85table". <b> Don't do this on systems that receive mail directly 86from the Internet. With today's worms and viruses, Postfix will 87become a backscatter source: it accepts mail for non-existent 88recipients and then tries to return that mail as "undeliverable" 89to the often forged sender address</b>. </p> 90 91<h2><a name="change">When you need to change the local_recipient_maps 92setting in main.cf</a></h2> 93 94<ul> 95 96 <li> <p> Problem: you don't use the default Postfix <a href="local.8.html">local(8)</a> 97 delivery agent for domains matching $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>, 98 or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>. For example, you redefined the 99 "<a href="postconf.5.html#local_transport">local_transport</a>" setting in <a href="postconf.5.html">main.cf</a>. </p> 100 101 <p> Solution: your <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> setting needs to specify 102 a database that lists all the known user names or addresses 103 for that delivery agent. For example, if you deliver users in 104 $<a href="postconf.5.html#mydestination">mydestination</a> etc. domains via the <a href="virtual.8.html">virtual(8)</a> delivery agent, 105 specify: </p> 106 107<pre> 108/etc/postfix/<a href="postconf.5.html">main.cf</a> 109 <a href="postconf.5.html#mydestination">mydestination</a> = $<a href="postconf.5.html#myhostname">myhostname</a> localhost.$<a href="postconf.5.html#mydomain">mydomain</a> localhost ... 110 <a href="postconf.5.html#local_transport">local_transport</a> = virtual 111 <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> = $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> 112</pre> 113 114 <p> If you use a different delivery agent for $<a href="postconf.5.html#mydestination">mydestination</a> 115 etc. domains, see the section "<a href="#format">Local recipient 116 table format</a>" below for a description of how the table 117 should be populated. </p> 118 119 <li> <p> Problem: you use the <a href="postconf.5.html#mailbox_transport">mailbox_transport</a> or <a href="postconf.5.html#fallback_transport">fallback_transport</a> 120 feature of the Postfix <a href="local.8.html">local(8)</a> delivery agent in order to 121 deliver mail to non-UNIX accounts. </p> 122 123 <p> Solution: you need to add the database that lists the 124 non-UNIX users: </p> 125 126<pre> 127/etc/postfix/<a href="postconf.5.html">main.cf</a> 128 <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> = <a href="proxymap.8.html">proxy</a>:unix:passwd.byname, $<a href="postconf.5.html#alias_maps">alias_maps</a>, 129 <the database with non-UNIX accounts> 130</pre> 131 132 <p> See the section "<a href="#format">Local recipient table 133 format</a>" below for a description of how the table should be 134 populated. </p> 135 136 <li> <p> Problem: you use the <a href="postconf.5.html#luser_relay">luser_relay</a> feature of the Postfix 137 local delivery agent. </p> 138 139 <p> Solution: you must disable the <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> feature 140 completely, so that Postfix accepts mail for all local addresses: 141 </p> 142 143<pre> 144/etc/postfix/<a href="postconf.5.html">main.cf</a> 145 <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> = 146</pre> 147 148</ul> 149 150<h2><a name="format">Local recipient table format</a> </h2> 151 152<p> If you use local files in <a href="postmap.1.html">postmap(1)</a> format, then 153<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> expects the following table format: </p> 154 155<ul> 156 157<li> <p> In the left-hand side, specify a bare username, an 158"@domain.tld" wild-card, or specify a complete "user@domain.tld" 159address. </p> 160 161<li> <p> You have to specify something on the right-hand side of 162the table, but the value is ignored by <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>. 163 164</ul> 165 166<p> If you use lookup tables based on NIS, LDAP, MYSQL, or PGSQL, 167then <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> does the same queries as for local files 168in <a href="postmap.1.html">postmap(1)</a> format, and expects the same results. </p> 169 170<p> With regular expression tables, Postfix only queries with the 171full recipient address, and not with the bare username or the 172"@domain.tld" wild-card. </p> 173 174<p> NOTE: a lookup table should always return a result when the address 175exists, and should always return "not found" when the address does 176not exist. In particular, a zero-length result does not count as 177a "not found" result. </p> 178 179</body> 180 181</html> 182
