Rejecting Unknown Local Recipients with Postfix


Introduction

As of Postfix version 2.0, the Postfix SMTP server rejects mail for unknown recipients in local domains (domains that match $mydestination or the IP addresses in $inet_interfaces or $proxy_interfaces) with "User unknown in local recipient table". This feature was optional with earlier Postfix versions.

The good news is that this keeps undeliverable mail out of your queue, so that your mail queue is not clogged up with undeliverable MAILER-DAEMON messages.

The bad news is that it may cause mail to be rejected when you upgrade from a Postfix system that was not configured to reject mail for unknown local recipients.

This document describes what steps are needed in order to reject unknown local recipients correctly.

Configuring local_recipient_maps in main.cf

The local_recipient_maps parameter specifies lookup tables with all names or addresses of local recipients. A recipient address is local when its domain matches $mydestination, $inet_interfaces or $proxy_interfaces. If a local username or address is not listed in $local_recipient_maps, then the Postfix SMTP server will reject the address with "User unknown in local recipient table". Other Postfix interfaces may still accept an "unknown" recipient.

The default setting, shown below, assumes that you use the default Postfix local(8) delivery agent for local delivery, where recipients are either UNIX accounts or local aliases:

/etc/postfix/main.cf:
    local_recipient_maps = proxy:unix:passwd.byname $alias_maps

To turn off unknown local recipient rejects by the SMTP server, specify:

/etc/postfix/main.cf:
    local_recipient_maps =

That is, an empty value. With this setting, the Postfix SMTP server will not reject mail with "User unknown in local recipient table". Don't do this on systems that receive mail directly from the Internet. With today's worms and viruses, Postfix will become a backscatter source: it accepts mail for non-existent recipients and then tries to return that mail as "undeliverable" to the often forged sender address.

When you need to change the local_recipient_maps setting in main.cf

Local recipient table format

If you use local files in postmap(1) format, then local_recipient_maps expects the following table format:

If you use lookup tables based on NIS, LDAP, MYSQL, or PGSQL, then local_recipient_maps does the same queries as for local files in postmap(1) format, and expects the same results.

With regular expression tables, Postfix only queries with the full recipient address, and not with the bare username or the "@domain.tld" wild-card.

NOTE: a lookup table should always return a result when the address exists, and should always return "not found" when the address does not exist. In particular, a zero-length result does not count as a "not found" result.