Preventing Open Relay
Validate relay restrictions and trusted networks.
Production note: Back up configuration, run
postfix check, and stage changes before reloading.Safe relay restriction
smtpd_relay_restrictions = permit_mynetworks,permit_sasl_authenticated,defer_unauth_destinationmynetworks discipline
Keep mynetworks explicit and narrow. Do not trust entire hosting-provider or public ranges.
Relay tests
Test from an external host using unrelated sender and recipient domains. The server must reject relay without authentication.
Audit
Review submission overrides in master.cf because service-level -o settings can change global behavior.