---
name: "smtp.access"
section: "5"
platform: "linux"
package: "sharc"
version: "2.1-1"
release: "Debian 2.2 (Potato)"
platforms: ["linux"]
url: "https://new.carta.tech/smtp.access"
---

# smtp.access(5)

sendmail access-control database

## NAME

smtp.access - sendmail access-control database

## SYNOPSIS

**/etc/mail/smtp.access**

## DESCRIPTION

This section describes the contents of the config file smtp.access (for SMTP access control).  It demonstrates all the features.

## SAMPLE CONFIG FILE

Here is an example of the config file **smtp.access**\
\
     deny    bozo@domain.com\
     deny    xyzzy@foo.net        "Get Lost!"\
     deny    @company.com\
     permit  friend@company.com\
     deny    166.28.8.222/31\
     deny    192.2\
     permit  192.2.49\
     deny    199.12.76.0  255.255.254.0

The first column can be either "permit" or "deny". This is followed by either a complete adress (like "bozo@domain.com"), or a "@" and a domain name (like "@cyberpromo.com") which matches all addresses ending in that domain, or 1-4 IP-address octets and an optional netmask which matches all IP adresses in that range.

In all cases a most-exact-match comparison is performed. If you want to deny access from all IP adresses beginning with 192.2 \_except\_ for adresses beginning with 192.2.49, you could put:

    deny    192.2\
     permit  192.2.49

Similarly, if you want to prevent everyone that supplies a return address ending in "company.com" except "friend@company.com" you could put:

    deny    @company.com\
     permit  friend@company.com

You can specify a netmask using either the modern slash (/) format or the traditional dotted quad format. If you leave out the netmask, it is implied by the number of octets you specify in the address. These are all equivalent:

    deny    50.12.76

    deny    50.12.76.0/24

    deny    50.12.76.0  255.255.255.0

So you could say something like this (whitespace before the mask is fine):

    deny    38.0.160.0  /20\
     permit  38.0.168.0  /22\
     deny    38.0.168.0  /24

adresses starting with 38.0.169 - 38.0.171 (Longest prefix matches first).

After email address deny-entries (\_NOT\_ after IP address entries) there can be an optional third column with an error message enclosed in quotes which will be sent to the client instead of the standard "Acces denied".  Example:

    deny    xyzzy@foo.net        "Get Lost!"

There is an implicit "permit all" if no match is found or if the file is empty or does not exist. I imagine that an empty **smtp.access** file would be the common case.

Be aware that the access control just described consists of two  completely different things - access control based on the client's IP address which normally can't be faked, and access control based on the senders envelope return address, which is trivial to bypass but still useful.

Everything following a  #  through the rest of the line is a comment.

## SEE ALSO

**[sharc-update(8)](/sharc-update/8.md),** **[mk-accessdb(8)](/mk-accessdb/8.md),** **[mk-relaydb(8)](/mk-relaydb/8.md)** and **[smtp.relay(5)](/smtp.relay/5.md)**

## AUTHOR

This manual page, based on the original README, was written by Stig Sandbeck Mathisen \<ssm@debian.org\>, for the Debian GNU/Linux system (but may be used by others).