From 8bbd19dc0195b38365163de61db7fe9bd587230a Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Mon, 31 Aug 2026 18:50:05 +0200
Subject: [PATCH] add Postfix reverse hostname rejection toggle

---
 README.md                                   | 4 ++++
 rootfs/etc/cont-init.d/00-env               | 1 +
 rootfs/etc/cont-init.d/15-config-postfix.sh | 9 +++++++--
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index fbb24359..ba674c6e 100644
--- a/README.md
+++ b/README.md
@@ -158,6 +158,7 @@ linux/arm64
 * `POSTFIX_DEBUG`: Enable debug (default `false`)
 * `POSTFIX_MYNETWORKS`: Trusted SMTP clients that may relay outbound mail through Postfix (default `127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128`)
 * `POSTFIX_MESSAGE_SIZE_LIMIT`: The maximal size in bytes of a message, including envelope information (default `26214400`)
+* `POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME`: Reject clients when their IP address has no reverse DNS entry (default `true`)
 * `POSTFIX_STRIP_SENDER_HEADER`: Strip the Sender header from incoming emails to prevent SES rejection issues (default `false`)
 * `POSTFIX_SMTPD_TLS`: Enabling TLS in the Postfix SMTP server (default `false`, possible values: `true`|`may`|`encrypt`|`ask`|`require`, see [Postfix TLS README](https://www.postfix.org/TLS_README.html#client_tls_levels))
 * `POSTFIX_SMTPD_TLS_CERT_FILE`: File with the Postfix SMTP server RSA certificate in PEM format
@@ -182,6 +183,9 @@ linux/arm64
 > unless every client in those ranges is trusted to relay mail. Docker port
 > publishing and proxies can make external SMTP clients appear as private bridge
 > addresses.
+> If Docker or a proxy makes public SMTP clients appear as a local bridge address
+> without reverse DNS, set `POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME=false`
+> instead of trusting that bridge range.
 
 ### RSPAMD
 
diff --git a/rootfs/etc/cont-init.d/00-env b/rootfs/etc/cont-init.d/00-env
index d95ad4e2..d57fa323 100755
--- a/rootfs/etc/cont-init.d/00-env
+++ b/rootfs/etc/cont-init.d/00-env
@@ -86,6 +86,7 @@ POSTFIX_DEBUG=${POSTFIX_DEBUG:-false}
 POSTFIX_LOG_PATH=/data/postfix/mail.log
 POSTFIX_MYNETWORKS="${POSTFIX_MYNETWORKS:-127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128}"
 POSTFIX_MESSAGE_SIZE_LIMIT=${POSTFIX_MESSAGE_SIZE_LIMIT:-26214400}
+POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME=${POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME:-true}
 POSTFIX_STRIP_SENDER_HEADER=${POSTFIX_STRIP_SENDER_HEADER:-false}
 POSTFIX_SMTPD_TLS=${POSTFIX_SMTPD_TLS:-false}
 POSTFIX_SMTP_TLS=${POSTFIX_SMTP_TLS:-false}
diff --git a/rootfs/etc/cont-init.d/15-config-postfix.sh b/rootfs/etc/cont-init.d/15-config-postfix.sh
index 2b405fdd..1274acd5 100755
--- a/rootfs/etc/cont-init.d/15-config-postfix.sh
+++ b/rootfs/etc/cont-init.d/15-config-postfix.sh
@@ -48,6 +48,12 @@ else
   ZEN_DOMAIN="${POSTFIX_SPAMHAUS_DQS_KEY}.zen.dq.spamhaus.net"
 fi
 
+POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME_RESTRICTION=""
+if [ "$POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME" = "true" ]; then
+  POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME_RESTRICTION=$',
+    reject_unknown_reverse_client_hostname'
+fi
+
 cat >>/etc/postfix/main.cf <<EOL
 myhostname = ${ANONADDY_HOSTNAME}
 mydomain = ${ANONADDY_DOMAIN}
@@ -90,8 +96,7 @@ smtpd_sender_restrictions =
     permit_mynetworks,
     permit_sasl_authenticated,
     reject_non_fqdn_sender,
-    reject_unknown_sender_domain,
-    reject_unknown_reverse_client_hostname
+    reject_unknown_sender_domain${POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME_RESTRICTION}
 
 smtpd_recipient_restrictions =
     permit_mynetworks,