SMTP AUTH Submission with SASL
Create a secure authenticated submission service.
Production note: Back up configuration, run
postfix check, and stage changes before reloading.Enable submission
submission inet n - n - - smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_recipient_restrictions=permit_sasl_authenticated,rejectmain.cf controls
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_tls_auth_only = yesRelay restrictions
smtpd_relay_restrictions = permit_mynetworks,permit_sasl_authenticated,defer_unauth_destinationTest authentication
Use a dedicated test account and swaks --auth. Confirm unauthenticated relay attempts are denied.