message_size_limit = 4896000000
anvil_rate_time_unit = 60s
smtpd_client_message_rate_limit = 100
smtpd_client_recipient_rate_limit = 30
smtpd_client_connection_rate_limit = 20
queue_run_delay = 5m
minimal_backoff_time = 5m
maximal_backoff_time = 15m
maximal_queue_lifetime = 1d
soft_bounce = no
bounce_template_file = /etc/postfix/bounce.cf
queue_directory = /var/spool/postfix
mail_owner = postfix
#default_privs = nobody
myorigin = $mydomain
#inet_interfaces = all
#inet_interfaces = $myhostname
#inet_interfaces = $myhostname, localhost
inet_interfaces = all
# Enable IPv4, and IPv6 if supported
inet_protocols = ipv4
unknown_local_recipient_reject_code = 550
mynetworks = 127.0.0.0/8

alias_maps = hash:/etc/aliases
#alias_maps = hash:/etc/aliases, nis:mail.aliases
#alias_maps = netinfo:/aliases

alias_database = hash:/etc/aliases
debug_peer_level = 2

virtual_mailbox_base = /home/mail
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql_virtual_alias_maps.cf
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
virtual_minimum_uid = 1024
virtual_uid_maps = static:1024
virtual_gid_maps = static:1024
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1

smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = /var/spool/postfix/private/auth

smtpd_tls_cert_file = /etc/ssl/mail/public.crt
smtpd_tls_key_file = /etc/ssl/mail/private.key
smtpd_use_tls = yes
#smtpd_tls_auth_only = no
smtpd_helo_required = no
smtp_destination_recipient_limit = 1024


smtpd_sasl_authenticated_header = yes

#настройки против спама
white_client_ip         = check_client_access hash:/etc/postfix/lists/white_client_ip
black_client_ip         = check_client_access hash:/etc/postfix/lists/black_client_ip
white_client            = check_sender_access hash:/etc/postfix/lists/white_client
black_client            = check_sender_access hash:/etc/postfix/lists/black_client
white_helo              = check_sender_access hash:/etc/postfix/lists/white_helo
block_dsl               = check_client_access regexp:/etc/postfix/lists/block_dsl
mx_access               = check_sender_mx_access cidr:/etc/postfix/lists/mx_access

#Описание списков исключений
smtpd_restriction_classes = white_client_ip
 black_client_ip
 block_dsl
 white_client
 white_helo
 black_client
 mx_access

smtpd_client_restrictions =
        permit_mynetworks
        white_client
        white_client_ip
        black_client
        black_client_ip
        permit_sasl_authenticated
        reject_unauth_pipelining
        permit

smtpd_helo_restrictions =
        permit_mynetworks
        white_client_ip
        white_helo
        black_client_ip
        block_dsl

smtpd_sender_restrictions =
        permit_mynetworks
        white_client
        black_client
        white_client_ip
        black_client_ip
        permit_sasl_authenticated
        reject_non_fqdn_sender
        reject_unknown_sender_domain
        mx_access
        reject_authenticated_sender_login_mismatch
        reject_unlisted_sender
        reject_unauth_destination
        #reject_unverified_sender
        check_sender_access hash:/etc/postfix/sender_access

smtpd_relay_restrictions =
        permit_mynetworks
        #white_client
        #white_client_ip
        black_client
        black_client_ip

smtpd_recipient_restrictions =
        permit_mynetworks
        white_client
        white_client_ip
        black_client
        black_client_ip
        permit_sasl_authenticated
        reject_non_fqdn_recipient
        reject_unauth_destination
        reject_unknown_recipient_domain
        reject_unverified_recipient
        reject_unknown_reverse_client_hostname
        reject_unlisted_recipient
    #
        reject_unknown_client_hostname
        #reject_invalid_helo_hostname
        #reject_non_fqdn_helo_hostname
        #reject_unknown_helo_hostname
        reject_rbl_client bl.spamcop.net
        reject_rbl_client cbl.abuseat.org
        reject_rbl_client dul.ru
        reject_rbl_client dnsbl.abuse.ch
        #reject_rbl_client ips.backscatterer.org

        #
        permit

smtpd_data_restrictions =
        permit

smtpd_end_of_data_restrictions =
        permit

#Настройка для dkim
smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = $smtpd_milters
receive_override_options = no_address_mappings
milter_default_action = accept
milter_protocol = 2
content_filter = scan:[127.0.0.1]:10025
mime_header_checks = pcre:/etc/postfix/pcre_mime_header_checks

bounce_queue_lifetime = 1d
mailbox_size_limit = 0
delay_warning_time = 1h

smtp      inet  n       -       n       -       -       smtpd
    -o content_filter=spamassassin
pickup    unix  n       -       n       60      1       pickup
cleanup   unix  n       -       n       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
#qmgr     unix  n       -       n       300     1       oqmgr
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
rewrite   unix  -       -       n       -       -       trivial-rewrite
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce
verify    unix  -       -       n       -       1       verify
flush     unix  n       -       n       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       n       -       -       smtp
relay     unix  -       -       n       -       -       smtp
showq     unix  n       -       n       -       -       showq
error     unix  -       -       n       -       -       error
retry     unix  -       -       n       -       -       error
discard   unix  -       -       n       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
scache    unix  -       -       n       -       1       scache

submission     inet  n       -       n       -       -       smtpd
    -o smtpd_tls_security_level=may
    -o smtpd_sasl_auth_enable=yes
    -o smtpd_sasl_type=dovecot
    -o smtpd_sasl_path=/var/spool/postfix/private/auth
    -o smtpd_sasl_security_options=noanonymous
    -o smtpd_sasl_local_domain=$myhostname
smtps      inet n - n - - smtpd
    -o syslog_name=postfix/smtps
    -o smtpd_tls_wrappermode=yes
    -o smtpd_sasl_auth_enable=yes
    -o smtpd_client_restrictions=permit_sasl_authenticated,reject

dovecot    unix  -       n       n       -        -       pipe
    flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -d ${recipient}

scan unix - - n - 16 smtp
     -o smtp_send_xforward_command=yes
     -o smtp_enforce_tls=no

127.0.0.1:10026 inet n - n - 16 smtpd
    -o content_filter=
    -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
    -o smtpd_helo_restrictions=
    -o smtpd_client_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o mynetworks_style=host
    -o smtpd_authorized_xforward_hosts=127.0.0.0/8



spamassassin      unix  -       n       n       -       -       pipe
            flags=R user=spamd argv=/usr/bin/spamc -u spamd -e /usr/sbin/sendmail -f $sender $recipient



smtp-amavis     unix    -       -       -       -       2       smtp
        -o smtp_data_done_timeout=1200
        -o smtp_send_xforward_command=yes
        -o disable_dns_lookups=yes
        -o max_use=20

## Dovecot configuration file

# If you're in a hurry, see http://wiki2.dovecot.org/QuickConfiguration

# "doveconf -n" command gives a clean output of the changed settings. Use it
# instead of copy&pasting files when posting to the Dovecot mailing list.

# '#' character and everything after it is treated as comments. Extra spaces
# and tabs are ignored. If you want to use either of these explicitly, put the
# value inside quotes, eg.: key = "# char and trailing whitespace  "

# Most (but not all) settings can be overridden by different protocols and/or
# source/destination IPs by placing the settings inside sections, for example:
# protocol imap { }, local 127.0.0.1 { }, remote 10.0.0.0/8 { }

# Default values are shown for each setting, it's not required to uncomment
# those. These are exceptions to this though: No sections (e.g. namespace {})
# or plugin settings are added by default, they're listed only as examples.
# Paths are also just examples with the real defaults being based on configure
# options. The paths listed here are for configure --prefix=/usr
# --sysconfdir=/etc --localstatedir=/var

# Protocols we want to be serving.
#protocols = imap pop3 lmtp

protocols = imap pop3 imaps pop3s
listen = *

mail_plugins = mailbox_alias #acl

# A comma separated list of IPs or hosts where to listen in for connections.
# "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces.
# If you want to specify non-default ports or anything more complex,
# edit conf.d/master.conf.
#listen = *, ::

# Base directory where to store runtime data.
#base_dir = /var/run/dovecot/

# Name of this instance. In multi-instance setup doveadm and other commands
# can use -i <instance_name> to select which instance is used (an alternative
# to -c <config_path>). The instance name is also added to Dovecot processes
# in ps output.
#instance_name = dovecot

# Greeting message for clients.
#login_greeting = Dovecot ready.

# Space separated list of trusted network ranges. Connections from these
# IPs are allowed to override their IP addresses and ports (for logging and
# for authentication checks). disable_plaintext_auth is also ignored for
# these networks. Typically you'd specify your IMAP proxy servers here.
#login_trusted_networks =

# Space separated list of login access check sockets (e.g. tcpwrap)
#login_access_sockets =

# With proxy_maybe=yes if proxy destination matches any of these IPs, don't do
# proxying. This isn't necessary normally, but may be useful if the destination
# IP is e.g. a load balancer's IP.
#auth_proxy_self =

# Show more verbose process titles (in ps). Currently shows user name and
# IP address. Useful for seeing who are actually using the IMAP processes
# (eg. shared mailboxes or if same uid is used for multiple accounts).
#verbose_proctitle = no

# Should all processes be killed when Dovecot master process shuts down.
# Setting this to "no" means that Dovecot can be upgraded without
# forcing existing client connections to close (although that could also be
# a problem if the upgrade is e.g. because of a security fix).
#shutdown_clients = yes

# If non-zero, run mail commands via this many connections to doveadm server,
# instead of running them directly in the same process.
#doveadm_worker_count = 0
# UNIX socket or host:port used for connecting to doveadm server
#doveadm_socket_path = doveadm-server

# Space separated list of environment variables that are preserved on Dovecot
# startup and passed down to all of its child processes. You can also give
# key=value pairs to always set specific settings.
#import_environment = TZ

##
## Dictionary server settings
##

# Dictionary can be used to store key=value lists. This is used by several
# plugins. The dictionary can be accessed either directly or though a
# dictionary server. The following dict block maps dictionary names to URIs
# when the server is used. These can then be referenced using URIs in format
# "proxy::<name>".

dict {
  #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext
  #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext
}

# Most of the actual configuration gets included below. The filenames are
# first sorted by their ASCII value and parsed in that order. The 00-prefixes
# in filenames are intended to make it easier to understand the ordering.
!include conf.d/*.conf

# A config file can also tried to be included without giving an error if
# it's not found:
!include_try local.conf

mail_debug = yes
auth_verbose = yes
auth_debug = yes

# Default VSZ (virtual memory size) limit for service processes. This is mainly
# intended to catch and kill processes that leak memory before they eat up
# everything.
#default_vsz_limit = 256M

mime_header_checks = pcre:/etc/postfix/pcre_mime_header_checks

# Files blocked by their suffix
/^\s*Content-(Disposition|Type).*name=\"(.*)\.(386|bat|bin|chm|cmd|com|do|exe|hta|jse|lnk|msi|ole|rar)\"$/
 REJECT Unwanted type of attachment $1: $2.$3
/^\s*Content-(Disposition|Type).*name=\"(.*)\.(pif|reg|rm|scr|shb|shm|shs|sys|vbe|vbs|vxd|xl)\"$/
 REJECT Unwanted type of attachment $1: $2.$3 

#Настройка для dkim
smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = $smtpd_milters
receive_override_options = no_address_mappings
milter_default_action = accept
milter_protocol = 2
content_filter = scan:[127.0.0.1]:10025
mime_header_checks = pcre:/etc/postfix/pcre_mime_header_checks
#