smtpd_delay_reject = yes
#strict_rfc821_envelopes = yes
#not strictly necessary, can reject legit mail from misconfigured hosts
smtpd_helo_required = yes
smtpd_helo_restrictions =
        permit_mynetworks,
        check_helo_access
                hash:/etc/postfix/helo_access,
        reject_non_fqdn_hostname,
        reject_invalid_hostname,
#       reject_unknown_hostname,
#can cause high rejection of valid mail from misconfigured hosts
        permit
disable_vrfy_command = yes
smtpd_sender_restrictions =
        permit_sasl_authenticated,
        permit_mynetworks,
        reject_non_fqdn_sender,
        reject_unknown_sender_domain,

#       rDNS Check
#       check_policy_service unix:private/rdns-policy

        permit
smtpd_recipient_restrictions =
        reject_non_fqdn_recipient,
        reject_unknown_recipient_domain,
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_unauth_destination,
# ABOVE ENTRY REQUIRED to prevent open relay!
#        check_recipient_access
#                hash:/usr/local/etc/postfix/recipient_access,

#        RBLs
        reject_rbl_client list.dsbl.org,
        reject_rbl_client zen.spamhaus.org,

#        SPF check (not installed)
#        check_policy_service unix:private/spfpolicy

#        Postgrey (not installed)
#        check_policy_service inet:127.0.0.1:10023

        permit
smtpd_data_restrictions =
        reject_unauth_pipelining
        permit