我在postfixconfiguration文件中有这个smtp限制：
smtpd_sender_restrictions = permit_sasl_authenticated, check_policy_service inet:127.0.0.1:10031,permit_mynetworks, warn_if_reject reject_non_fqdn_sender, reject_unauth_pipelining, reject_authenticated_sender_login_mismatch, reject_unknown_sender_domain 据我所知，如果permit_sasl_authenticated说特定的用户被authentication，那么其余的限制不会被检查。
如果我想要确保“permit_sasl_authenticated”和“check_policy_service inet：127.0.0.1：10031”，如果他们都说是的，那么只有这样才能通过邮件否则不会？ 实际上我试图设置cluebringer，但得到的问题是说“发件人地址被拒绝”，即使发件人从SASL正确authentication后。
这是我的postconf -n输出：
append_dot_mydomain = no biff = no broken_sasl_auth_clients = yes config_directory = /etc/postfix disable_vrfy_command = yes inet_interfaces = 91.91.98.67, localhost mailbox_command = procmail -a "$EXTENSION" mailbox_size_limit = 0 mydestination = mauth.fdomain.co.uk, localhost myhostname = mauth.fdomain.co.uk mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 myorigin = /etc/mailname readme_directory = no recipient_delimiter = + relay_domains = mysql:/etc/postfix/relaydomains.cf relayhost = smtp_bind_address = 91.91.9.7 smtp_sasl_auth_enable = yes smtp_sasl_password_maps = mysql:/etc/postfix/authsmtp.conf smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtpd_banner = $myhostname Freezone Internet ESMTP smtpd_client_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_rbl_client sbl.spamhaus.org, reject_rbl_client blackholes.easynet.nl, reject_rbl_client bl.spamcop.net smtpd_data_restrictions = permit_sasl_authenticated, reject_unauth_pipelining smtpd_delay_reject = yes smtpd_end_of_data_restrictions = check_policy_service inet:127.0.0.1:10031 smtpd_helo_required = yes smtpd_helo_restrictions = permit_sasl_authenticated, permit_mynetworks, warn_if_reject reject_non_fqdn_hostname, reject_invalid_hostname, permit smtpd_recipient_restrictions = permit_sasl_authenticated, check_policy_service inet:127.0.0.1:10031, permit_mynetworks, reject_unauth_destination smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = smtpd_sasl_security_options = noanonymous smtpd_sender_restrictions = permit_sasl_authenticated, check_policy_service inet:127.0.0.1:10031,permit_mynetworks, warn_if_reject reject_non_fqdn_sender, reject_unauth_pipelining, reject_authenticated_sender_login_mismatch, reject_unknown_sender_domain smtpd_tls_CAfile = /etc/postfix/ssl/freezonewc.ca smtpd_tls_auth_only = no smtpd_tls_cert_file = /etc/postfix/ssl/freezonewc.crt smtpd_tls_key_file = /etc/postfix/ssl/freezonewc.key smtpd_tls_loglevel = 2 smtpd_tls_received_header = yes smtpd_tls_security_level = may smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtpd_tls_session_cache_timeout = 3600s smtpd_use_tls = yes transport_maps = mysql:/etc/postfix/transport.cf unknown_local_recipient_reject_code = 450
说实话，你的限制现在有点乱。 postfix-users邮件列表通常build议收集smtpd_recipient_restrictions或smtpd_relay_restrictions （仅适用于Postfix 2.10）下的所有限制。 这样做的原因是它提高了可读性，并且与smtpd_delay_reject=yes没有多大区别。
此外，一个政策服务应该很less回答一个accept / ok语句，而是用DUNNO。 所以在你的情况下，首先要求政策服务，给它一个机会说拒绝，然后检查SASL似乎是一个更好的方法，除非你的政策服务在某些情况下确实返回OK。
不知道你的政策服务的确切性质和你的要求，我会从这样的事情开始：
smtpd_relay_restrictions = # subject even authenticated users and trusted networks # to the policy check check_policy_service inet:127.0.0.1:10031 permit_mynetworks reject_unknown_sender_domain permit_sasl_authenticated defer_unauth_destination smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated # we exclude our networks and SASL authenticated users # from all further checks. # since I don't know if the policy service is relevant # for unauthenticated mail, I commented it out here # check_policy_service inet:127.0.0.1:10031 warn_if_reject reject_non_fqdn_hostname warn_if_reject reject_non_fqdn_sender reject_invalid_hostname reject_unknown_sender_domain smtpd_data_restrictions = reject_unauth_pipelining
请参阅我的configuration代码段中的注释，了解一些注意事项。
据我所知，如果permit_sasl_authenticated说特定的用户被authentication，那么其余的限制不会被检查。
你是对的，但只在当前smtpd_xxx_restrictions
只需从smtpd_sender_restrictions中删除permit_sasl_authenticated并将所有validation移至策略服务
smtpd_sender_restrictions = check_policy_service inet:127.0.0.1:10031, ...
将有可用的下列选项
sasl_method sasl_username sasl_sender
在没有SASLauthentication的情况下，这些属性将是空的。 在逻辑层面上，它可能类似于以下内容
if [ policy_service_return_code == OK && sasl_username not empty ] return OK else return REJECT