Stop spam relaying by fixing authorization before adding spam filters. On Postfix 2.10 and newer, put trusted-network and SASL exceptions in smtpd_relay_restrictions, finish with defer_unauth_destination, and ensure an effective recipient policy also contains reject_unauth_destination. Then verify the live configuration, test an unauthenticated external recipient, and inspect logs and the queue.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
DNS blocklists, SPF policy services, greylisting, content filters, firewall rules, and rate limits reduce unwanted mail, but none replaces relay authorization. A server can still be an open relay when those layers are perfectly configured.
As an Amazon Associate I earn from qualifying purchases.
What “spam through Postfix” usually means
There are two different incidents that administrators often call Postfix spam:
- Unauthorized relaying: an outside client submits mail to a destination that is not hosted by your server. This is the open-relay problem and must be fixed first.
- Abuse by an allowed sender: a compromised mailbox, application, or host has valid credentials or is inside a trusted network and is sending large volumes. Relay restrictions will not identify that sender as unauthorized, so you also need authentication controls, queue monitoring, and host-level limits.
Postfix is intended to forward mail only from clients in trusted networks, from clients authenticated with SASL, or to domains configured as authorized relay destinations. The configuration must make those three cases explicit. Do not begin by stacking DNSBL or content-filter rules onto an unknown relay policy.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Build the relay-safe policy first
Postfix 2.10 and newer
Postfix 2.10 introduced smtpd_relay_restrictions as a safety mechanism against mistakes in smtpd_recipient_restrictions that could create an open relay. On a current CentOS-style installation, use it as the primary relay control:
# /etc/postfix/main.cf
smtpd_relay_restrictions = permit_mynetworks,
permit_sasl_authenticated,
defer_unauth_destination
# Keep anti-spam checks separate and deliberate.
smtpd_recipient_restrictions = permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destinationThis is a policy shape, not a universal copy-and-paste configuration. Adapt the trusted networks, local domains, authenticated submission service, and any later checks to your mail design.
Free tools Windows power users keep installed
One-click scans. No signup required.
What each rule does
permit_mynetworksallows clients in Postfix’smynetworkslist. Review that list carefully; an accidentally broad network can authorize an entire untrusted segment.permit_sasl_authenticatedallows a client that has successfully authenticated. It belongs before the unauthorized-destination rule so legitimate submission users can relay.defer_unauth_destinationprevents relaying to destinations that are not authorized for this server by deferring the request.reject_unauth_destinationis the explicit rejection check in the recipient policy. Postfix requires an effective relay or recipient restriction to enforce a reject policy for unauthorized destinations; leaving both lists without that protection is unsafe.
Restriction lists are evaluated from left to right. Evaluation stops when a rule returns a final PERMIT, REJECT, or DEFER. Consequently, a broad permit placed before relay protection can make every later rejection unreachable. Put only narrowly defined exceptions first, and never add an unrestricted permit merely to make a test succeed.
Older Postfix releases
Before 2.10, relay and anti-spam policy were commonly combined in smtpd_recipient_restrictions. A conservative structure for such a release is:
smtpd_recipient_restrictions = permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination
# Add other recipient checks after the relay rule.Check the installed version before using a modern parameter. The compatibility behavior and available defaults differ by release, so do not assume that a setting copied from a newer host exists on an older CentOS system.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Prepare and change a CentOS-style host safely
1. Confirm the version and active configuration
Run these commands as an administrator:
postconf mail_version
postconf -n
postconf mynetworks
postconf mydestination
postconf relay_domains
postconf smtpd_relay_restrictions
postconf smtpd_recipient_restrictionspostconf -n shows non-default settings, which is the most useful starting point for finding an accidental permit, an unexpected network, or a relay rule that was never loaded. If a parameter is absent because the release predates it, use the legacy policy instead of inserting an unknown setting.
2. Back up the files and edit the intended instance
Back up /etc/postfix/main.cf and, if you use lookup tables, the relevant master.cf and table files. Edit the configuration for the Postfix instance that actually serves mail; hosts with multiple instances or a control panel may have a different configuration directory. Keep relay authorization in main.cf, and use master.cf to define separate service behavior for port 25 and authenticated submission when required.
3. Validate before reloading
postfix check
postconf -npostfix check catches many syntax and permission problems. Read the resulting configuration again and confirm that the relay restrictions are present in the order you intended. A successful syntax check does not prove that the policy is secure; it only proves that Postfix can parse it.
4. Reload, do not restart unnecessarily
systemctl reload postfix
systemctl status postfix --no-pagerA reload applies configuration changes while allowing the service to continue handling existing work. Use the service name appropriate to your CentOS or RHEL release if it differs, and investigate any reload error before testing delivery.
Make the trusted and authenticated paths precise
Audit mynetworks
List every network in mynetworks and ask why it needs relay permission. Keep only infrastructure that you control, such as a local application host or a deliberately designated internal relay. Do not include a public address range, a guest network, or an entire cloud subnet when only one application needs to send mail. If a server’s address changes, update the list deliberately rather than widening it as a quick fix.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Separate inbound SMTP from authenticated submission
Port 25 is normally used for server-to-server delivery, while authenticated users and applications are commonly placed on a submission service. Your policy should make clear which service permits SASL authentication and which clients may use it. Requiring authentication on submission does not by itself make port 25 safe; the relay restrictions still have to reject unauthorized external destinations.
Protect credentials and applications
If the queue continues to grow after unauthorized relay is closed, suspect a stolen SASL password, a compromised local account, or an application inside mynetworks. Disable or rotate the affected credential, identify the originating client in the logs, and remove queued messages only after preserving evidence you need for incident response. Do not solve a compromised account by adding a new network to mynetworks.
Add anti-spam controls without weakening relay protection
Once authorization is correct, add policy layers in an order that preserves legitimate exceptions. Keep trusted-network and authenticated-user permits ahead of checks that should not apply to those clients.
DNS blocklists
Postfix supports DNSBL checks through directives such as reject_rbl_client. Apply a blocklist only after checking its operator terms, query limits, listing criteria, and removal process. A DNSBL is a reputation signal, not proof that a client is unauthorized to relay. It should never replace reject_unauth_destination, and it should not accidentally block your own trusted or authenticated senders.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
HELO and sender validation
HELO syntax checks, sender restrictions, access tables, and recipient access maps can reject malformed or known-bad traffic. Define the exception scope first: a rule intended for unauthenticated Internet clients may be inappropriate for an internal application that uses unusual envelope senders. Test each change against both an inbound message to a local domain and an authenticated submission.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
SPF policy services and greylisting
SPF evaluation and greylisting are commonly implemented through policy services or external integrations rather than as a single relay switch. Treat them as separate policy decisions. Greylisting can delay legitimate first deliveries, and SPF results describe sender-domain authorization rather than whether your server may relay a message. Document the service, its timeout behavior, and the clients that must bypass it.
Content filters
An after-queue content filter can inspect messages that Postfix has already accepted, while a before-queue policy service can reject during the SMTP transaction. Either placement has operational trade-offs: after-queue filtering can prevent a slow scanner from holding an SMTP connection, but accepted spam may already consume queue and disk resources; before-queue filtering can reject earlier, but a failing or slow service can affect delivery availability. Choose placement separately from relay authorization.
Reduce the host’s exposure
Check listening interfaces
Red Hat’s RHEL 9 security guidance notes that Postfix listens on the local loopback address by default. Inspect inet_interfaces and confirm that the daemon is bound only to addresses required by the mail role. A server that only sends through another relay may not need to accept Internet SMTP at all; a server receiving mail for its own domains generally needs an externally reachable port 25.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Use the firewall deliberately
Review firewall exposure alongside Postfix settings. Permit only the SMTP and submission services that your design requires, and restrict administrative access separately. Blocking port 25 on a host that must receive mail will break inbound delivery, so decide whether the machine is an Internet-facing MX, an internal relay, or an outbound submission host before changing firewall rules.
Apply rate and size limits
Host-level controls limit abuse that SMTP authorization alone cannot stop. Configure strict but workable connection-rate, message-rate, and message-size limits for the workload described by the RHEL security guidance. Set different limits or service policies for trusted infrastructure and public clients where necessary, and monitor rejections after tightening them. An arbitrary limit that blocks legitimate bulk notifications is not a successful hardening change.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Verify that the server is no longer an open relay
Inspect the effective policy
- Run
postconf -nand confirm that the loaded configuration containspermit_mynetworksandpermit_sasl_authenticatedbefore the unauthorized-destination rule. - Check that
mynetworkscontains only intended addresses and that local destinations are correctly represented bymydestinationor the appropriate relay-domain settings. - Look for an earlier broad
permitin any restriction list. That rule can terminate evaluation before the relay protection is reached.
Run a controlled unauthenticated test
From a host that is not in mynetworks and is not authenticated, connect to the server’s public SMTP service. A diagnostic client such as OpenSSL can provide an encrypted session where supported:
openssl s_client -connect mail.example.net:25 -crlfAfter the server banner, issue a basic SMTP conversation using an envelope sender and a recipient in a domain that the server does not host:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteEHLO test.example
MAIL FROM:<[email protected]>
RCPT TO:<[email protected]>The RCPT TO command should be rejected or deferred by the relay policy. Do not send a real message during this test. Use a destination outside your local domains, because a server is expected to accept recipients for domains it is configured to host.
Test the allowed paths separately
Repeat testing from an approved internal client and with a valid SASL account on the submission service. Confirm that each can deliver to its intended external destination, while an unauthenticated external client cannot. This separation catches the common mistake of fixing spam by disabling all outbound delivery.
Review logs and the queue
mailq
postqueue -p
journalctl -u postfix --since "1 hour ago"
Depending on the logging setup, CentOS systems may also write SMTP events to /var/log/maillog. Look for repeated unauthorized RCPT TO attempts, bursts from one address, authentication failures, unexpected authenticated usernames, deferred deliveries, and queue growth. Do not flush a large queue until you understand why it accumulated; forcing delivery can amplify an ongoing abuse incident.
Quick Recap
Troubleshoot common failures
| Symptom | Likely cause | Corrective action |
|---|---|---|
| An outside client can relay to an unrelated domain. | A broad permit, an oversized mynetworks, or relay restrictions that were not loaded. |
Inspect postconf -n, remove the broad exception, verify the network list, run postfix check, reload, and repeat the external test. |
| Authenticated users receive an unauthorized-destination error. | permit_sasl_authenticated is missing, appears after a rejecting rule, or authentication is occurring on a different service. |
Put the authenticated exception before the rejection and verify the submission service’s SASL settings and logs. |
| Legitimate inbound mail is rejected. | The recipient domain is not configured as local or authorized, or a sender/ DNSBL rule is too broad. | Correct domain configuration and test the inbound path separately; do not add a global permit. |
| The queue remains full after relay testing fails. | A valid credential, local application, or compromised host is sending through an allowed path. | Identify the authenticated user or source address in logs, rotate credentials or isolate the application, then review and clean the queue. |
| Reload fails after editing. | A syntax error, invalid parameter for the installed Postfix release, or a file permission problem. | Run postfix check, compare the parameter with postconf mail_version, correct the file, and reload only after validation succeeds. |
A maintenance checklist
- Record the Postfix version and the role of the host: MX, internal relay, or submission server.
- Keep
permit_mynetworksandpermit_sasl_authenticatednarrowly scoped and ahead of rejection rules. - Ensure the effective relay policy contains
defer_unauth_destinationor an equivalent unauthorized-destination control, withreject_unauth_destinationenforced in the effective recipient or relay restrictions. - Review
mynetworks, local destinations, relay domains, interfaces, and firewall exposure after network changes. - Treat DNSBL, SPF, greylisting, access tables, and content filters as additional layers, not substitutes for relay authorization.
- Monitor logs, authentication failures, queue size, deferred mail, and rate-limit events.
- Repeat a controlled unauthenticated external
RCPT TOtest after every major Postfix or network-policy change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
