Allow external emails to send

postfix/main.cf.template

@@ -3,6 +3,9 @@ myhostname = lists.sasalliance.org
 myorigin = sasalliance.org
 mydestination = $myhostname, localhost.$mydomain, localhost
 
+# Virtual alias domains - domains we handle via virtual_alias_maps
+virtual_alias_domains = lists.sasalliance.org
+
 # Relay through SES
 relayhost = [${SMTP_HOST}]:${SMTP_PORT}
 smtp_tls_security_level = encrypt
@@ -16,6 +19,17 @@ smtp_sasl_security_options = noanonymous
 # Virtual aliases (static for now)
 virtual_alias_maps = hash:/etc/postfix/virtual_aliases.cf
 
+# Sender restrictions - enforce whitelist
+smtpd_sender_restrictions = 
+    permit_mynetworks,
+    check_sender_access hash:/etc/postfix/sender_access,
+    reject
+
+# Recipient restrictions - accept mail for our domains
+smtpd_recipient_restrictions = 
+    permit_mynetworks,
+    reject_unauth_destination
+
 # Other recommended settings
 alias_maps = hash:/etc/aliases
 alias_database = hash:/etc/aliases