address_verify_map = btree:/var/spool/postfix/saved/verify disable_vrfy_command = yes smtpd_helo_required = yes smtpd_etrn_restrictions = permit_mynetworks, reject smtpd_client_restrictions = permit_sasl_authenticated, permit_mynetworks smtpd_recipient_restrictions = reject_unknown_recipient_domain, reject_non_fqdn_recipient, reject_non_fqdn_sender, reject_unknown_sender_domain, check_recipient_access pcre:/etc/postfix/recipient_checks.pcre, check_sender_mx_access cidr:/etc/postfix/bogus_mx, check_recipient_mx_access cidr:/etc/postfix/bogus_mx, permit_sasl_authenticated, check_recipient_access hash:/etc/postfix/blocked_recipients, permit_mynetworks, reject_unauth_destination, check_client_access hash:/etc/postfix/access_permit, check_client_access hash:/etc/postfix/access_deny, check_client_access hash:/etc/spam_check/blocklist/block_list.txt, check_sender_access hash:/etc/postfix/access_senders, check_helo_access hash:/etc/postfix/helo_checks, check_helo_access pcre:/etc/postfix/helo_checks.pcre, check_helo_access hash:/etc/postfix/helo_exceptions reject_invalid_hostname reject_non_fqdn_hostname, check_policy_service unix:private/policy, check_policy_service inet:127.0.0.1:60000, check_sender_access hash:/etc/postfix/no_verify_sender, reject_unverified_sender smtpd_data_restrictions = reject_unauth_pipelining, permit

recipient_checks.pcre – зпрещающие pcre-паттерны
/^\@/ 550 Invalid address format. /[!%\@].*\@/ 550 This server disallows weird address syntax.

access_deny – сюда прописываем плохие, негодные хосты, с которых не надо принимать мыло
swip.net REJECT swipnet.se REJECT tele2.se REJECT

access_permit – файл с хостами-исключениями, с которых надо всегда принмать мыло, trusted-хосты
mail.ru OK tyumen.ru OK vsluh.ru OK tura.ru OK yandex.ru OK gmail.com OK spamcop.net OK rambler.ru OK egroups.com OK scd.yahoo.com OK dcn.yahoo.com OK sc5.yahoo.com OK net.rol.ru OK subscribe.ru OK googlegroups.com OK server.dns-redirect.com OK e-mail.ru OK pochta.ru OK 195.161.118.50 OK wall.epn.ru OK t-x.dignus.nl OK sbtx.tmn.ru OK ns.usro.askar.ru OK optivera.convex.ru OK optivera.ur.r OK relay1.mplik.ru OK 82.147.80.50 OK 80.91.16.138 OK 195.133.70.146 OK astral.intramail.ru OK ds124.masterhost.ru OK 217.115.148.91 OK 85.15.146.2 OK

helo_checks – проверки helo
my.ip.add.ress REJECT Don't use my own IP address in brackets localhost REJECT Localhost is not a valid helo response mydomain REJECT You are not mydomain

helo_checks.pcre – проверки helo (pcre)
/^[0-9.]+$/ REJECT Your software is not RFC 2821 compliant: EHLO/HELO must be a domain or an address-literal (IP enclosed in []) - not a naked IP.

bogus_mx – проверка кошерности IP-адреса MX-хостов для домена в MAIL FROM / RCPT TO
255.255.255.255 550 Domain MX in world broadcast address 0.0.0.0/8 550 Domain MX in block that refer to source hosts on "this" network (RFC 1700) 10.0.0.0/8 550 Domain MX in RFC 1918 private network 127.0.0.0/8 550 Domain MX in loopback network 169.254.0.0/16 550 Domain MX in link local network 172.16.0.0/12 550 Domain MX in RFC 1918 private network 192.0.2.0/24 550 Domain MX in TEST-NET network 192.168.0/16 550 Domain MX in RFC 1918 private network 224.0.0.0/4 550 Domain MX in class D multicast network 240.0.0.0/5 550 Domain MX in class E reserved network 248.0.0.0/5 550 Domain MX in reserved network
См. также RFC-3330

no_verify_sender – см раздел про sender verification