Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

When sending mail, Postfix inserts the authenticated user’s IP and username into the Received header on the email. While this is useful for tracking down who sent a particular email that was sent from your mail server, it also has privacy implications. In a small-scale situation where I can trust all the users not to get their accounts compromised and turned into spam zombies, I’d rather not broadcast IP addresses and account names for all to read. In short, how do I set up Postfix to not send this:

Received: from [x.x.x.x] (pc1.example.com [x.x.x.x]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: user) by mail.example.com (Postfix) with ESMTPSA id CC77010C148 for ; Fri, 11 Nov 2011 04:55:18 +0000 (UTC)

share|improve this question

2 Answers 2

up vote 7 down vote accepted

The standard solution is to use the header_checks option. This will work, however, if we filter received lines on all mail both incoming and outgoing (as this will do), we could potentially lose Received headers on mail sent to us, which can be important for troubleshooting. To get around this problem, we will apply the header_checks only to the mail that could not possibly have been sent to us—mail that was sent to the submission port (you are using the submission port, aren’t you?).

This post explains how to apply header_checks exclusively to the submission port. What we need to do is pass the cleanup_service_name option to the submission service so that we can set up a new cleanup service, “subcleanup.” The relevant section of /etc/postfix/master.cf might look like this:

submission inet n       -       -       -       -       smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
  -o cleanup_service_name=subcleanup

Now we can pass the header_checks option to the new cleanup service. That part of /etc/postfix/master.cf might look like this:

cleanup   unix  n       -       -       -       0       cleanup
subcleanup unix n       -       -       -       0       cleanup
  -o header_checks=regexp:/etc/postfix/submission_header_checks

Finally, we need to create the file /etc/postfix/submission_header_checks, which will contain the regex that filters offending Received header lines:

/^Received:.*\(Authenticated sender:/ IGNORE
share|improve this answer
Do you have to call postmap submission_header_checks? –  Mitar Mar 24 '14 at 23:29
@Mitar no clue, but if you find out that you do, feel free to edit the answer. These are old instructions for 10.04, but I'll probably be updating them when 14.04 comes out. –  Michael Kropat Mar 25 '14 at 0:53
It seems it worked without. :-) –  Mitar Mar 25 '14 at 4:16
+1, thanks for the very helpful answer. It's a few years later, and I had to make a minor tweak. I'm running Postfix 2.9.6. I changed the regex to: /^Received:.*\(Postfix/ IGNORE because I wasn't getting the "Authenticated sender" portion in my headers. Do you see any risks associated with my new regex? –  Dominic P Apr 23 '14 at 21:07

You can use

smtpd_sasl_authenticated_header = no

in postfix/main.cf to eliminate the header information in your outgoing mails.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.