POSTALLOW(1)

NAME
postallow - generate a Postscreen allowlist (and optionally blocklist) from SPF records

SYNOPSIS
postallow [config-file]

postallow -q|--quick-add domain [config-file]

DESCRIPTION
postallow is a POSIX shell script that generates an allowlist (and optionally a blocklist) for Postfix's postscreen(8), based on large senders' published SPF records.

It recursively queries the SPF records of the domains listed in the allowlist_hosts file, collects the resulting IP addresses and CIDR ranges, summarises them with aggregateCIDR.pl(1) from the route-summarization package, and writes a flat CIDR file that Postfix reads directly via postscreen_access_list.

postallow is designed to run as a dedicated unprivileged system user (postallow). It writes its output to a directory owned by that user; Postfix reads the files from there directly. Reloading Postfix after a run is left to the init system — see the service units in contrib/systemd/ (Linux/systemd) or contrib/freebsd/ (FreeBSD rc.d).

OPTIONS

config-file
    Path to an alternative configuration file. Overrides the default search path (see FILES below).

-q, --quick-add domain
    Resolve the SPF record for domain and append the resulting permit rules to the existing allowlist file, then reload Postfix. This is intended as a quick, one-off unblock while waiting for a time-sensitive e-mail (such as an OTP or account-confirmation message).

    WARNING: --quick-add triggers a postfix reload so that the new rules take effect immediately. While reload(8) is non-disruptive (it does not drop established connections), it does apply configuration changes mid-flight. The command must be run as root (or via sudo) for the reload to succeed; if it cannot reload Postfix it prints the manual command and exits cleanly.

    The appended entries are temporary. The next time postallow performs a full run it regenerates the allowlist from scratch, removing the quick-added rules. postallow prints a ready-to-run echo command to add the domain permanently to your custom hosts file.

FILES
postallow searches for its configuration file in the following locations, in order. A path supplied on the command line takes precedence over all of them.

/etc/postallow.conf
/etc/postallow/postallow.conf
/usr/local/etc/postallow.conf
/usr/local/etc/postallow/postallow.conf

See postallow.conf(5) for a description of all configuration options.

DEPENDENCIES

spf-tools
    Provides despf.sh(1), used to recursively expand SPF “include:” chains. Available at https://github.com/spf-tools/spf-tools.

route-summarization
    Provides aggregateCIDR.pl(1), used to aggregate and summarise the resulting CIDR ranges. Available at https://github.com/edmundlod/route-summarization.

EXIT STATUS

0   Success.

1   The configuration file or the allowlist_hosts file could not be found, or temporary files could not be created.

EXAMPLES
Run with the default configuration file search path:

    postallow

Run with an explicit configuration file:

    postallow /etc/postallow/postallow.conf

Temporarily allow mail from example.com while waiting for an OTP e-mail:

    postallow --quick-add example.com

Same, using the short form:

    postallow -q example.com

SEE ALSO
postallow.conf(5), postscreen(8), postfix(1)

BUGS
Please report bugs at https://github.com/edmundlod/postallow/issues.

AUTHORS
Originally written by Steve Jenkins as Postwhite. Renamed and maintained as Postallow from 2025 by Edmund Lodewijks.