smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mx_backup, permit_mynetworks, reject_unknown_recipient_domain, reject

transport_maps = hash:/usr/local/etc/postfix/transport
virtual_maps = hash:/usr/local/etc/postfix/virtusertable, regexp:/etc/postfix/virtusertable.regex
readme_directory = no
sample_directory = /usr/local/etc/postfix
sendmail_path = /usr/local/sbin/sendmail
setgid_group = maildrop
manpage_directory = /usr/local/man
newaliases_path = /usr/local/bin/newaliases
mailq_path = /usr/local/bin/mailq
unknown_local_recipient_reject_code = 450

#body_checks = regexp:/usr/local/etc/postfix/body_checks
header_checks = regexp:/usr/local/etc/postfix/header_checks

mynetworks = 127.0.0.0/8,\
        10.23.5.0/24,\
        66.246.132.0/23,\
        66.246.136.0/23,\
        66.246.150.0/23,\
        66.246.166.0/23,\
        209.213.224.0/19,\
        63.250.98.63/32,\
        65.48.19.244/32,\
        65.126.154.240/29,\
        209.135.75.0/24, \
        66.246.151.0/24, \
        216.6.201.72/29, \
        209.135.116.86/32, \
        209.135.116.0/24, \
        69.90.48.0/21, \
        64.228.96.0/19, \
        64.228.32.0/19, \
        216.208.192.0/19, \
        209.226.0.0/16, \
        206.172.0.0/16, \
        209.53.214.179/32, \
        66.96.16.0/20, \
        72.0.64.0/20, \
        24.42.120.192, \
        69.195.21.41, \
        65.39.195.237, \
        65.39.195.238


# Seems people can use an HHTP proxy to hit an SMTP server.  This
# should generate errors.  The default for this is 10.  I'm lowering
# it to 4 so tha the 5th error should terminate the connection.
# This should prevent this from happening in the future as there
# are normally more than 4 lines of headers.

smtpd_soft_error_limit=4
smtpd_hard_error_limit=8
smtpd_error_sleep_time=10

# other things that seem like a good idea.

queue_minfree = 209715200
message_size_limit = 20971520

# tls
smtpd_sasl_auth_enable = yes 
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes

smtpd_use_tls = yes
smtpd_tls_key_file = /var/imap/server.pem
smtpd_tls_cert_file = /var/imap/server.pem
smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

html_directory = no

# content_filter = scan:127.0.0.1:10025
receive_override_options = no_address_mappings

relay_domains = hash:/usr/local/etc/postfix/transport

smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks,
        reject_unknown_sender_domain
smtpd_helo_restrictions = permit_sasl_authenticated, permit_mynetworks,
        reject_unknown_helo_hostname
smtpd_client_restrictions = permit_sasl_authenticated, permit_mynetworks,
        reject_rbl_client dnsbl.sorbs.net, 
        check_client_access cidr:/usr/local/etc/postfix/filtertable