mydomain = domen
myhostname = domen

#mydestination = localhost, localhost.localdomain
mydestination = $myhostname localhost.$mydomain localhost
mynetworks = 127.0.0.0/8 192.168.1.0/24
message_size_limit = 41943040
append_dot_mydomain = yes

virtual_alias_domains =
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql_virtual_alias_maps.cf
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
virtual_mailbox_base = /home/vmail
virtual_uid_maps = static:107
virtual_gid_maps = static:110
#home_mailbox = Maildir/

smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
broken_sasl_auth_clients = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = private/auth
#smtpd_sasl_application_name = smtpd
#smtpd_sasl_path = /var/lib/dovecot
smtpd_sasl_security_options = noanonymous

smtpd_recipient_restrictions =
        permit_mynetworks,
#        check_recipient_access hash:/etc/postfix/rec_access,
        permit_sasl_authenticated,
        permit_tls_clientcerts,
        reject_unauth_destination,
        check_client_access hash:/etc/postfix/rbl_override,
        check_helo_access hash:/etc/postfix/corrupted_mailers,
        #check_recipient_access  pcre:$config_directory/recipient_global.allow,
        reject_invalid_helo_hostname,
        reject_non_fqdn_helo_hostname,
        reject_unknown_helo_hostname,
        warn_if_reject reject_unknown_client,
        reject_non_fqdn_sender,
        reject_non_fqdn_recipient,
        reject_unknown_sender_domain,
        reject_unknown_recipient_domain,
#        reject_unverified_sender,
        reject_unverified_recipient,
        #check_helo_access       hash:$config_directory/mydomain.deny,
        #check_helo_access       cidr:$config_directory/mynetworks.deny,
        #check_helo_access       cidr:$config_directory/reserved_ip.deny,
        #check_sender_mx_access  cidr:$config_directory/reserved_ip.deny,
        #check_sender_access     pcre:$config_directory/sender.deny,
#!!        check_sender_access     mysql:$config_directory/sql/access.cf,
        #check_recipient_access  pcre:$config_directory/recipient.deny,
        #check_sender_access     pcre:$config_directory/sender_email.allow,
        #check_recipient_access  pcre:$config_directory/recipient_email_fast.allow,
        #check_recipient_access  pcre:$config_directory/recipient_domain.allow,
        reject_rbl_client cbl.abuseat.org
        reject_rbl_client list.dsbl.org
        reject_rbl_client opm.blitzed.org
        reject_rbl_client sbl.spamhaus.org
        reject_rbl_client bl.spamcop.net

#        reject_rbl_client dnsbl.sorbs.net=127.0.0.2
#        reject_rbl_client dnsbl.sorbs.net=127.0.0.3
#        reject_rbl_client dnsbl.sorbs.net=127.0.0.4
#        reject_rbl_client dnsbl.sorbs.net=127.0.0.5
#        reject_rbl_client dnsbl.sorbs.net=127.0.0.7
#        reject_rbl_client dnsbl.sorbs.net=127.0.0.9
#        reject_rbl_client dnsbl.sorbs.net=127.0.0.11
#        reject_rbl_client dnsbl.sorbs.net=127.0.0.12
        warn_if_reject reject_rhsbl_sender dsn.rfc-ignorant.org
        warn_if_reject reject_rhsbl_sender abuse.rfc-ignorant.org
        warn_if_reject reject_rhsbl_sender whois.rfc-ignorant.org
        warn_if_reject reject_rhsbl_sender bogusmx.rfc-ignorant.org
        warn_if_reject reject_rhsbl_sender postmaster.rfc-ignorant.org
        permit
smtpd_data_restrictions =
        reject_unauth_pipelining,
        reject_multi_recipient_bounce,
        permit
smtpd_helo_required = yes
#address_verify_map = btree:/var/spool/postfix/verify
address_verify_map = btree:/var/lib/postfix/verify
smtpd_etrn_restrictions = reject
smtpd_reject_unlisted_sender = yes
disable_vrfy_command = yes
strict_rfc821_envelopes = yes
show_user_unknown_table_name = no
unverified_sender_reject_code = 550
unknown_local_recipient_reject_code = 550
smtpd_hard_error_limit = 8


non_fqdn_reject_code            = 450
invalid_hostname_reject_code    = 450
maps_rbl_reject_code            = 450

smtpd_use_tls = yes
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
#virtual_create_maildirsize = yes
#virtual_maildir_extended = yes
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $virtual_mailbox_limit_maps
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
#relayhost = 192.168.2.1
queue_run_delay = 240s
minimal_backoff_time = 240s

content_filter = scan:127.0.0.1:10025
receive_override_options = no_address_mappings

milter_default_action = accept
milter_protocol = 2
smtpd_milters = unix:/var/run/opendkim/opendkim.sock
non_smtpd_milters = unix:/var/run/opendkim/opendkim.sock