Postfix - limiting destination domains by sending user

gistfile1.txt

The various runes for limiting senders to specific domains in Postfix. This was done to prevent accidental information disclosure from an MTA shared between monitoring (send to Internet) and application (send to internal addresses only).

The result of the config is that users in the pingu_domains class can only send mail to penguinanddaemon.com, and users in the internet class can send mail everywhere apart from penguinanddaemon.com. Don't forget about running postmap on the mapping files

main.cf

smtpd_recipient_restrictions =
    check_sender_access hash:/etc/postfix/restricted_senders
    permit_mynetworks,
    permit_inet_interfaces,
    check_relay_domains
    permit_sasl_authenticated,

smtpd_restriction_classes = pingu_mail,internet
pingu_mail =
    check_recipient_access hash:/etc/postfix/pingu_domains, reject
internet =
    check_recipient_access hash:/etc/postfix/pingu_domains_invert

pingu_domains

penguinanddaemon.com OK

pingu_domains_invert

penguinanddaemon.com Reject

restricted_senders

standard_user internet
internal_user pingu_mail
standard_user@cromarty.racksofwin.net internet
internal_user@cromarty.racksofwin.net	pingu_mail