tls_advertise_hosts = *

acl_smtp_auth = check_auth

begin acl
check_relay:
  # locally generated smtp (not via tcp/ip) accepted
  accept hosts = :

  # accept anything from host we relay for
  accept  hosts = +relay_hosts

  # accept anything from authenticated clients
  accept authenticated = *

  # otherwise deny
  deny

check_auth:
  # extra paranoia
  accept encrypted = *
  deny message = TLS encryption required

check_rcpt:
  # accept anything from host we relay for
  accept acl = check_relay
    endpass

check_data:
  # do not scan messages submitted from our own hosts
  accept acl = check_relay