Postfix // Maquerading internal hosts

Here we need it to be able to talk on the public network to other MXes. Make sure you’ve got a public A and PTR for this host

cp -i /etc/postfix/ /etc/postfix/
vi /etc/postfix/

smtp      inet  n       -       n       -       -       smtpd 

cp -i /etc/postfix/ /etc/postfix/
vi /etc/postfix/


It is here listening in plain-text on the internal network – this is not CIDR but rather binding to an interface.

inet_interfaces =, x.x.x.x
mynetworks_style = subnet

That one needs to resolve on the public network

smtpd_banner = relay for internal hosts
myhostname =
mydomain =
myorigin =

Do something like NAT for Sender addresses (Return-path)

masquerade_domains =
sender_canonical_classes = envelope_sender, header_sender
sender_canonical_maps = regexp:/etc/postfix/sender_canonical

Dymanical for any internal host and domain (Received headers and data fields will still let you know which server originally sent the message)

vi /etc/postfix/sender_canonical


Note this has a mild security implication - any internal host, be it mallory, may use that relay and the return path will be yours.

Enforce outbound starttls


we eventually need an origin and destination to make possible bounces end-up somewhere while avoiding loops

local user, get rid of the root alias

vi /etc/mail/aliases

change those

inet_interfaces = all
mynetworks =,

mydestination =

get a self-signed certificate ready and enforce inbound starttls


postfix check
service postfix restart

Check you are listening on the internal interface only

netstat -an -f inet
netstat -lntup


check the logs on all the hosts on the way - source, relay, and eventually destination

tail -F /var/log/maillog
#tail -F /var/log/mail.log
date | mail -s `hostname` root


Bind Postfix Mail Server To Localhost or Specific IP Address Only

Postfix Address Rewriting –> Address masquerading

Postfix masquerading or changing outgoing SMTP email or mail address

canonical - format of Postfix canonical table

Rewriting Addresses

How to masquerade domains in Postfix

Forcing the from address when postfix relays over smtp

Blog: How to rewrite outgoing address in Postfix

Address rewriting when mail is received

How To Install and Configure Postfix as a Send-Only SMTP Server on Debian 9


regexp_table - format of Postfix regular expression tables

postfix smtp_generic_maps with regular expression

postfix sender address rewriting


w/ generic maps –or–

vi /etc/postfix/

smtp_generic_maps = hash:/etc/postfix/generic

vi /etc/postfix/generic


postmap /etc/postfix/generic
ls -lF /etc/postfix/generic.db

w/ canonical maps –or–

vi /etc/postfix/

canonical_maps = hash:/etc/postfix/canonical

vi /etc/postfix/canonical


postmap /etc/postfix/canonical
ls -lF /etc/postfix/canonical.db

Nethence | Pub | Lab | Pbraun | SNE Russia | xhtml