biff = no
append_dot_mydomain = no
readme_directory = no
myhostname = mail.mymailserver.com
mydomain = mymailserver.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination =
relayhost =
mynetworks =
mailbox_size_limit = 0
message_size_limit = 200000000
recipient_delimiter = +
inet_interfaces = all
myorigin = $mydomain
soft_bounce = no
in_flow_delay = 3s

# Virtual mailbox settings
virtual_mailbox_domains = proxy:mysql:$config_directory/mysql_virtual_domains_maps.cf
virtual_mailbox_base = /home/vmail
virtual_mailbox_maps =
    proxy:mysql:$config_directory/mysql_virtual_mailbox_maps.cf,
    proxy:mysql:$config_directory/mysql_virtual_alias_domain_mailbox_maps.cf,
    proxy:mysql:$config_directory/mysql_virtual_alias_domain_catchall_maps.cf
virtual_alias_maps =
    proxy:mysql:$config_directory/mysql_virtual_alias_maps.cf,
    proxy:mysql:$config_directory/mysql_virtual_alias_domain_maps.cf
virtual_mailbox_limit = proxy:mysql:$config_directory/mysql_virtual_mailbox_limit_maps.cf
virtual_mailbox_limit_override = yes
virtual_maildir_limit_message = Sorry, the user's maildir has overdrawn his diskspace quota, please try again later.
virtual_overquota_bounce = yes
virtual_minimum_uid = 5000
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1

smtpd_helo_required = yes

# SASL Authentication
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_exceptions_networks = $mynetworks
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes

# No open relay!
smtpd_relay_restrictions =
    reject_non_fqdn_recipient,
    reject_unknown_recipient_domain,
    permit_sasl_authenticated,
    reject_unauth_destination

smtpd_sender_restrictions =
    reject_authenticated_sender_login_mismatch,
    permit_sasl_authenticated

smtpd_client_restrictions =
     permit_sasl_authenticated

smtpd_recipient_restrictions =
    permit_sasl_authenticated,
    reject_unauth_destination,
    reject_unauth_pipelining,
    reject_unknown_sender_domain,
    reject_non_fqdn_recipient,
    reject_unknown_recipient_domain

smtpd_data_restrictions =
    reject_unauth_pipelining

# TLS parameters
smtp_use_tls = yes
smtp_tls_cert_file = /etc/ssl/mailserver/mail.crt
smtp_tls_key_file = /etc/ssl/mailserver/mail.key
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_tls_note_starttls_offer = yes
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s

transport_maps = hash:/etc/postfix/transport

smtp_destination_concurrency_limit = 2
smtp_destination_rate_delay = 3s
smtp_extra_recipient_limit = 10
smtp_error_sleep_time = 1s
smtp_soft_error_limit = 10
smtp_hard_error_limit = 20

anvil_rate_time_unit = 60s

milter_protocol = 2
milter_default_action = accept
smtpd_milters = inet:localhost:12301
non_smtpd_milters = inet:localhost:12301

header_checks = regexp:/etc/postfix/header_checks