# /etc/postfix/main.cf - ::network.hostname::.::network.domain::
#
# ::do_not_edit::
# ::maintainer::
#
# These are only the parameters changed from a default install
# see /etc/postfix/main.cf.dist for a commented, full version of this file.


# protocols (ipv4, ipv6, all)
#
inet_protocols = ::postfix.protocols::

# features
#
biff = no
append_dot_mydomain = no
delay_warning_time = 4h

# See http://www.postfix.org/COMPATIBILITY_README.html for details
#
compatibility_level = ::postfix.compatibility_level::

# DEBUG / TEST
# you can set this to "yes" to check config changes (all REJECT 5xx codes
# will be changed in DEFER 4xx codes) (see \::postfix.soft_bounce\::)
#
# you can also give a list of client ip/names to debug
#
soft_bounce = ::postfix.soft_bounce::
debug_peer_list = ::postfix.debug_peer_list::


# users & map files
#
recipient_delimiter = +
virtual_alias_maps = hash:/etc/postfix/virtual
alias_maps = hash:/etc/postfix/aliases
# used by 'newaliases' command
alias_database = hash:/etc/postfix/aliases


# daemon params
#
unknown_local_recipient_reject_code = 450
default_destination_concurrency_limit = 3
message_size_limit = ::postfix.message_size_limit::
# will not be used, since we use the 'maildir' format, but
# must be still defined or postfix will complain
mailbox_size_limit = 1024000000


# networks
#
myorigin = /etc/mailname
myhostname = ::postfix.myhostname::
mynetworks = ::postfix.loopback:: ::postfix.mynetworks::
inet_interfaces = all
relayhost = ::postfix.relayhost::
transport_maps = hash:/etc/postfix/transport

# strip system and version infos from header, and WANT the sender
# to be polite, requiring at least the helo intro
#
smtpd_banner = ::postfix.myhostname:: ESMTP server ready
smtpd_helo_required = yes

# relay & destinations
#
mynetworks_style = host
mydestination = $myhostname,
		localhost, localhost.localdomain, localhost.$mydomain,
		::postfix.add_destinations::
relay_domains = $mydestination

# 2010.06.24 lc01
# limits to avoid blacklist or graylist protections
#
smtp_destination_concurrency_limit = 3
smtp_destination_rate_delay = 15s


# relay, regular expressions checks
header_checks = pcre:/etc/postfix/header_checks
body_checks = pcre:/etc/postfix/body_checks


# ----------------------------------------------------------------
# below are the 5 smtpd check stages for accepting / rejecting
# connections
# ----------------------------------------------------------------
#
smtpd_delay_reject = yes

# looking helo is a really basic check, but can throw away
# at least some simple spammers, like those that pretends to
# be ourself, or connecting from our own ip
# rejection must be explicit, other connections are ACCEPTED
# (and checked later, on 'recipient')
#
smtpd_helo_restrictions = 
	permit_mynetworks,
	check_helo_access hash:/etc/postfix/access_helo

# most checks are grouped on 'recipient', but some are
# phase specific
#
smtpd_client_restrictions = 
	check_client_access hash:/etc/postfix/access_client

smtpd_sender_restrictions = 
	check_sender_access hash:/etc/postfix/access_sender

# 2020.06.11 lc
# - this postfix version have smtpd_relay_restricion, so we
#   must do client relay checks in the properly stage;
#
#   note: this stage is a stop/go intermediate, early, stage
#
#   that means that check_client_access still needs to be listed
#   in smtpd_recipient_restrictions to work (aka 'permit' result
#   from this stage WILL NOT have effect smtp_recipient_...
#   stage, only 'reject' does, causing an early reject)
#
smtpd_relay_restrictions =
	permit_mynetworks, permit_sasl_authenticated,
	check_client_access hash:/etc/postfix/access_relay,
	defer_unauth_destination

# recipient manage post RELAY phase, working on both relay
# and local delivery, we grouped here most of checks (mostly
# for SPAM detection) -- see part2 template file
#
# note that include a copy of relay_restrictions above, the
# permit onces
#
smtpd_recipient_restrictions = 
	check_recipient_access hash:/etc/postfix/access_recipient,
	permit_mynetworks, permit_sasl_authenticated,
	check_client_access hash:/etc/postfix/access_relay,
