main.cf

inet_interfaces = all

inet_protocols = ipv4

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)

myhostname = mail.example.com

append_dot_mydomain = no

mynetworks =
    # Local
    127.0.0.0/8
    # External
    ip/32

local_transport = error:Local Transport Disabled

alias_maps =

mydomain = example.com

mydestination =
    $myhostname
    localhost.$mydomain
    localhost

virtual_transport = dovecot

dovecot_destination_recipient_limit = 1

virtual_mailbox_domains = hash:/etc/postfix/virtual_domains

virtual_mailbox_maps = proxy:ldap:/etc/postfix/ldap_virtual_recipients.cf

virtual_alias_maps = proxy:ldap:/etc/postfix/ldap_virtual_aliases.cf

smtpd_sasl_auth_enable = yes

broken_sasl_auth_clients = yes

smtpd_tls_security_level = may

smtpd_tls_auth_only = yes

smtpd_tls_cert_file = /etc/postfix/certs/mail_public_cert.pem

smtpd_tls_key_file = /etc/postfix/certs/mail_private_key.pem

tls_random_source = dev:/dev/urandom

smtpd_tls_loglevel = 0

smtpd_client_new_tls_session_rate_limit = 10

smtpd_tls_session_cache_database = btree:/etc/postfix/smtpd_session_cache

smtpd_tls_exclude_ciphers =
        EXP
        EDH-RSA-DES-CBC-SHA
        ADH-DES-CBC-SHA
        DES-CBC-SHA
        SEED-SHA

smtpd_tls_dh512_param_file = ${config_directory}/certs/dh_512.pem
smtpd_tls_dh1024_param_file = ${config_directory}/certs/dh_1024.pem

postscreen_greet_action = enforce

smtpd_recipient_restrictions =
        reject_non_fqdn_recipient
        reject_unknown_recipient_domain
        permit_sasl_authenticated
        permit_mynetworks
        reject_unauth_destination
        check_sender_ns_access cidr:/etc/postfix/drop.cidr
        check_sender_mx_access cidr:/etc/postfix/drop.cidr
        reject_rbl_client ix.dnsbl.manitu.net
        permit

smtpd_data_restrictions = reject_multi_recipient_bounce

smtpd_sender_restrictions =
        reject_non_fqdn_sender
        reject_unknown_sender_domain

smtpd_helo_restrictions =
		permit_mynetworks
        check_helo_access pcre:/etc/postfix/identitycheck.pcre
        reject_invalid_hostname
disable_vrfy_command = yes
smtpd_helo_required = yes
smtpd_delay_reject = no
smtpd_client_restrictions = check_client_access cidr:/etc/postfix/drop.cidr