Postfix：作为智能主机，如何限制传入邮件到发件人域和发件人IP？

我在Centos 7上运行一个Postfix + Dovecot服务，并且有一些不相关的虚拟域。 同样的Postfix服务器也被设置为IP 192.0.2.2和203.0.113.2的智能主机（中继）。 现在，无论邮件IP 192.0.2.2发送什么邮件，我的Postfix都会转发到Internet上。 来自192.0.2.2的所有发件人地址来自@ example.com域。 但是，有时候IP 192.0.2.2会发送来自随机发送者域的垃圾邮件，我的Postfix会将这些邮件转发到Internet上，将我的IP列入黑名单。

我想为我的Postfixconfiguration一个限制，所以当IP 192.0.2.2尝试中继邮件时，发件人域必须是example.com，否则我的Postfix必须拒绝邮件。

我有从@ example.net域发送的IP 203.0.113.2相同的问题。

我无法控制192.0.2.2或203.0.113.2，所以只能使用我的Postfix来解决问题。

• spflogging转发邮件失败
• Postfix / OpenDKIM不签署PHP发送的电子邮件
• 如何过滤基于收件人地址的catchall电子邮件帐户
• 从Postfix迁移问题
• Postfix转发所有电子邮件，无论限制

这是在我的main.cf文件现在启用智能主机function：

mynetworks = 127.0.0.0/8, 192.0.2.2/32, 203.0.113.2/32 

编辑：

下面是匿名postconf -n输出：“inet：127.0.0.1：8891”是OpenDKIM，我用来从example.org签署外发电子邮件

 alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases broken_sasl_auth_clients = yes command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix debug_peer_level = 2 debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5 dovecot_destination_recipient_limit = 1 html_directory = no inet_interfaces = all inet_protocols = all mail_owner = postfix mailbox_size_limit = 51200000 mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man message_size_limit = 51200000 milter_default_action = accept milter_protocol = 6 mydestination = $myhostname, localhost.$mydomain, localhost mydomain = example.org myhostname = mail.example.org mynetworks = 127.0.0.0/8, 192.0.2.2/32, 203.0.113.2/32 myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix non_smtpd_milters = inet:127.0.0.1:8891 queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES relay_domains = $mydestination, example.com sample_directory = /usr/share/doc/postfix-2.10.1/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop smtpd_milters = inet:127.0.0.1:8891, unix:/run/spamass-milter/postfix/sock smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_tls_auth_only = yes smtpd_tls_cert_file = /etc/pki/tls/mail.example.org.public.pem smtpd_tls_key_file = /etc/pki/tls/mail.example.org.private.pem smtpd_tls_loglevel = 1 smtpd_tls_mandatory_protocols = $smtpd_tls_protocols smtpd_tls_protocols = !SSLv2, !SSLv3 smtpd_tls_received_header = yes smtpd_tls_security_level = may smtpd_tls_session_cache_timeout = 3600s smtpd_use_tls = yes tls_random_source = dev:/dev/urandom transport_maps = hash:/etc/postfix/transport unknown_local_recipient_reject_code = 550 virtual_alias_maps = hash:/etc/postfix/vmail_aliases virtual_gid_maps = static:800 virtual_mailbox_base = /var/mail/vhosts virtual_mailbox_domains = hash:/etc/postfix/vmail_domains virtual_mailbox_maps = hash:/etc/postfix/vmail_mailboxes virtual_minimum_uid = 800 virtual_transport = dovecot virtual_uid_maps = static:800 

 smtpd_restriction_classes = firstclient firstclient = check_sender_access hash:/etc/postfix/firstsender reject smtpd_recipient_restrictions = permit_sasl_authenticated permit_mynetworks check_client_access hash:/etc/postfix/myclient reject_unauth_destination 

 192.0.2.2 firstclient 

 example.com OK 

 smtpd_restriction_classes = firstclient, secondclient firstclient = check_sender_access hash:/etc/postfix/firstsender reject secondclient = check_sender_access hash:/etc/postfix/secondsender reject smtpd_recipient_restrictions = permit_sasl_authenticated permit_mynetworks check_client_access hash:/etc/postfix/myclient reject_unauth_destination 

 192.0.2.2 firstclient 203.0.113.2 secondclient 

 example.com OK 

 example.net OK