POSTALLOW.CONF(5)

NAME
postallow.conf - configuration file for postallow(1)

DESCRIPTION
postallow.conf is a POSIX shell snippet that is .-sourced by postallow(1). Lines beginning with # are comments; all settings are plain shell variable assignments.

postallow searches for its configuration file in the following locations, in order. A path supplied on the command line takes precedence over all of them.

/etc/postallow.conf
/etc/postallow/postallow.conf
/usr/local/etc/postallow.conf
/usr/local/etc/postallow/postallow.conf

FILE PATH OPTIONS

allowlist_hosts=path
    Path to the package-managed file containing the default sender domain lists. Updated on package upgrade; do not edit. Default: /usr/share/postallow/allowlist_hosts.

custom_hosts_file=path
    Path to the user-managed file for local additions. Preserved across upgrades. Default: /etc/postallow/custom_hosts. This file may define custom_hosts and blocklist_hosts (see HOST LIST FILE below).

spftoolspath=path
    Directory containing despf.sh(1) from the spf-tools package.

output_dir=path
    Directory to which postallow writes the generated CIDR files. This directory must be writable by the postallow system user. Point Postfix's postscreen_access_list directly at the files in this directory; they do not need to reside under /etc/postfix. The generated files are world-readable (mode 644). Set automatically by the installer for the current platform (/var/lib/postallow on Linux, /var/db/postallow on FreeBSD/NetBSD, /var/postallow on OpenBSD).

OTHER OPTIONS

include_yahoo=yes|no
    Whether to append additional Yahoo!/Verizon/AOL outbound IPs scraped from senders.yahooinc.com to the allowlist. Yahoo IPs are already obtained from their SPF records; this adds any extras not covered there. The static list can be refreshed with the scrape_yahoo script. Default: no.

enable_blocklist=yes|no
    Whether to generate a blocklist in addition to the allowlist. Blocklist source domains are defined in the blocklist_hosts variable in the allowlist_hosts file. Default: no.

invalid_cidr=fix|remove
    How to handle invalid IPv4 CIDR ranges (non-null host bits) found in SPF records. fix corrects the network address to the proper network prefix — the same result Postfix would derive internally from the invalid range. remove drops the range entirely; this was the original Postwhite and early Postallow behaviour. Default: fix.

HOST LIST FILE
The file pointed to by allowlist_hosts is a POSIX shell snippet that defines space-separated lists of sender domains. postallow supports the following variables:

email_hosts
    Webmail and personal e-mail providers.

social_hosts
    Social-network notification senders.

commerce_hosts
    E-commerce and payment providers.

bulk_hosts
    Bulk and transactional mail providers.

misc_hosts
    Miscellaneous senders.

custom_hosts
    User-supplied additions. Add your own domains here.

blocklist_hosts
    Domains whose SPF-resolved IPs are written to the blocklist. Only consulted when enable_blocklist is yes.

Example:

    custom_hosts="example.com mycompany.org"

EXAMPLE
# /etc/postallow/postallow.conf
allowlist_hosts=/usr/share/postallow/allowlist_hosts
custom_hosts_file=/etc/postallow/custom_hosts
spftoolspath=/usr/bin/spf-tools
output_dir=/var/lib/postallow
include_yahoo="no"
enable_blocklist=no

SEE ALSO
postallow(1), postscreen(8), postfix(1)

AUTHORS
Originally written by Steve Jenkins as Postwhite. Renamed and maintained as Postallow from 2025 by Edmund Lodewijks.