# See /usr/share/postfix/main.cf.dist for a commented, more complete version

#################################################
# Main domain & conf
#
myhostname = _MAIL_SERVER_FQDN_
mydomain = _DEFAULT_MAIL_DOMAIN_
myorigin = /etc/mailname
mydestination = _MAIL_SERVER_FQDN_, localhost._DEFAULT_MAIL_DOMAIN_, localhost
relayhost =
inet_interfaces = all
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases

# Recipient delimiter : + is often refused, _ is more accepted
recipient_delimiter = _

# Strict address format in addresses
strict_rfc821_envelopes = yes

# Maximum postmaster notifications
notify_classes = bounce, 2bounce, delay, policy, protocol, resource, software

# Mail maximum size in Bytes
message_size_limit = 67108864
mailbox_size_limit = 0


################################################################################
# SSL/TLS

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/<changeme>
smtpd_tls_key_file=/etc/ssl/private/<changeme>
smtpd_use_tls=yes
smtpd_tls_auth_only = yes


################################################################################
# Sender restrictions

# Only registered users can send emails
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_sasl-sender-check.cf
smtpd_reject_unlisted_sender = yes

# Have a look : http://www.postfix.org/SMTPD_ACCESS_README.html
smtpd_client_restrictions =
smtpd_sender_restrictions = permit_sasl_authenticated
smtpd_recipient_restrictions =  permit_mynetworks
                                permit_sasl_authenticated
                                reject_unverified_recipient
                                reject_non_fqdn_recipient
##                                reject_non_fqdn_sender
                                reject_non_fqdn_helo_hostname
                                reject_invalid_helo_hostname
##                                reject_unknown_sender_domain
                                reject_unknown_recipient_domain
                                reject_unlisted_recipient
                                reject_unlisted_sender
                                reject_unauth_destination
                                reject_unlisted_sender
                                reject_unauth_destination
                                reject_rbl_client bl.spamcop.net
                                reject_rbl_client zen.spamhaus.org
                                permit
smtpd_data_restrictions = reject_unauth_pipelining
                          reject_multi_recipient_bounce
                          permit

# hide the sender IP
header_checks = regexp:/etc/postfix/postfix_header-checks.cf

################################################################################
# SASL Auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain =
smtpd_sasl_authenticated_header = yes
broken_sasl_auth_clients = yes


################################################################################
# mail delivery
#mailbox_transport = dovecot
#mailbox_command = procmail -a "$EXTENSION"
#mailbox_command = /usr/lib/dovecot/deliver -n -m "$EXTENSION"
#mailbox_size_limit = 0
#dovecot_destination_recipient_limit = 1
virtual_transport = lmtp:unix:private/dovecot-lmtp

################################################
# Virtual mailboxes

virtual_mailbox_domains = proxy:mysql:/etc/postfix/sql/mysql_virtual_domains_maps.cf
virtual_alias_maps =
   proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf,
   proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_maps.cf,
   proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf
virtual_mailbox_maps =
   proxy:mysql:/etc/postfix/sql/mysql_virtual_mailbox_maps.cf,
   proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf


################################################################################
# misc config

# No local user, no need to notify them.
biff = no

# Appending .domain is the MUA's job.
append_dot_mydomain = no

# messages d'erreur (bounces) en français :
bounce_template_file = /etc/postfix/bounce.cf.fr

# warn the user of non distributed mail after 24h of tries (but keep trying during 5 days)
delay_warning_time = 24h

# No need for documentation
readme_directory = no

# HELO Stuff
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_helo_required = yes


################################################
# Proxy

# Proxy service feeding (important because of the chrooted environment in Debian)
proxy_read_maps = $local_recipient_maps
                  $mydestination
                  $mynetworks
                  $virtual_alias_maps
                  $virtual_alias_domains
                  $virtual_mailbox_maps
                  $virtual_mailbox_domains
                  $relay_recipient_maps
                  $relay_domains
                  $canonical_maps
                  $sender_canonical_maps
                  $recipient_canonical_maps
                  $relocated_maps
                  $transport_maps
                  $smtpd_sender_login_maps

proxy_write_maps = $smtp_sasl_auth_cache_name
                   $smtp_tls_session_cache_database
                   $smtpd_tls_session_cache_database
                   $lmtp_sasl_auth_cache_name
                   $address_verify_map
                   $postscreen_cache_map

smtp_sasl_auth_cache_name = proxy:btree:${data_directory}/smtp_sasl_auth_cache_name
smtp_tls_session_cache_database = proxy:btree:${data_directory}/smtp_tls_session_cache_database
smtpd_tls_session_cache_database = proxy:btree:${data_directory}/smtpd_tls_session_cache_database
lmtp_sasl_auth_cache_name = proxy:btree:${data_directory}/lmtp_sasl_auth_cache_name
address_verify_map = proxy:btree:${data_directory}/address_verify_map
postscreen_cache_map = proxy:btree:${data_directory}/postscreen_cache_map