How to create a greylist domain exclusion on 10.7 Lion Mail server? Having a Mail server running on Mac OS X 10.7.5 (Lion) and having "Junk Mail Filtering" enabled, causes greylisting to kick in on every received message. An example:

Dec 23 22:05:45 servername /usr/libexec/postfix/greylist.pl[89032]: Temporary message rejection to: &lt;user@host.tld&gt; from: &lt;nobody@linux3.s12.com.br&gt; sent from: [50.23.172.250] for: 60 seconds due to greylisting


That is nice for spam prevention, but not so nice for customers submitting orders through a PHP formmail at our web site. This causes a delay before order messages are being delivered to our mailbox. Our web site is being hosted by a third party web hosting firm.

How to exclude the messages sent via our web hosting firm from greylisting?
As this is 10.7 Server, the 10.8 command:

$ sudo serveradmin settings mail:postfix:add_whitelist_domain = "yahoo.com"


can't be used in this case.



1. Create an exception file

$ sudo touch /etc/postfix/sender_access


2. Fill this file with domains that are OK to be excluded from the (greylist) policy

$ echo 'mail-out.ovh.net OK' | sudo tee -a /etc/postfix/sender_access


3. Create database from text file

$ sudo postmap hash:/etc/postfix/sender_access


4. Modify the Mac OS Lion SMTP server configuration

This configuration change allows the domains configured in the exception file to bypass running the greylist check. Therefore open up the main.cf, for example using the nano editor:

$ sudo nano /etc/postfix/main.cf


Search for the line that starts with smtpd_recipient_restrictions =, for example using the key combination Ctrl + W

The line might look like:

smtpd_recipient_restrictions = permit_sasl_authenticated permit_mynetworks reject_unauth_destination check_policy_service unix:private/policy permit


For readability I am writing this one line now as multiple lines:

smtpd_recipient_restrictions = 
    permit_sasl_authenticated 
    permit_mynetworks 
    reject_unauth_destination 
    check_policy_service unix:private/policy 
    permit


After reject_unauth_destination and before check_policy_service unix:private/policy some new text has to be inserted. The new text tells the mail server to look in the newly created file. The magic words to insert are: check_sender_access hash:/etc/postfix/sender_access.

Now the smtpd_recipient_restrictions looks like:

smtpd_recipient_restrictions = 
    permit_sasl_authenticated 
    permit_mynetworks 
    reject_unauth_destination 
    check_sender_access hash:/etc/postfix/sender_access 
    check_policy_service unix:private/policy 
    permit


Or written as a single line, it looks like:

smtpd_recipient_restrictions = permit_sasl_authenticated permit_mynetworks reject_unauth_destination check_sender_access hash:/etc/postfix/sender_access check_policy_service unix:private/policy permit


To save the change press Ctrl + O, and to exit the nano editor press Ctrl + X.

5. Make the configuration changed become effective

$  sudo postfix reload


And presto, now the web form mail messages arrive without greylisting delay.



PS You can also use the sender_access file to reject users, by adding lines like: user@abadboy.com REJECT