==== Required information ====
- iRedMail version (check /etc/iredmail-release):
- Linux/BSD distribution name and version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Web server (Apache or Nginx):
- Manage mail accounts with iRedAdmin-Pro?
- Related log if you're reporting an issue:
======== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.2
- Linux/BSD distribution name and version: Centos 7 x64 (3.10.0-229.14.1.el7.x86_64)
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx):  Apache
- Manage mail accounts with iRedAdmin-Pro?: No
- Related log if you're reporting an issue:
====

Hi All

We have several subnet local servers that I want to use iRedMail as a relay for.  The mail server needs to accept and forward messages bound to both itself and world wide destinations.  I've been able to do this by making the following changes based on my admittedly less than expert understanding of postfix but I'd like to know if this is the best way or if there's a better/recommended way to provide this service.  And most importantly if these changes will damage any critical functionality of iRedMail (or expose the server to unintended relaying).

Here's what I had to change to get relaying to work for my local network and my reasoning for each change.

1)  Add 10.232.1.0/24 (my local subnet) to mynetworks.  This is obvious; just adding my local subnet to the list.

2) Move permit_mynetworks to the beginning of the smtpd_sender_restrictions, smtpd_helo_restrictions, and smtpd_recipient_restrictions lists.
My understanding is that the various SMTPD restrictions check each entry in order until they hit an accept or deny.  If  permit_mynetworks comes after reject_unlisted_recipient or recipient_domain then the server won't relay email bound for other destinations.

3) Set the standalone smtpd_reject_unlisted_recipient and smtpd_reject_unlisted_sender entries to "no".
My understanding is that these standalone settings force the recipient and sender checks to happen after postfix is finished with the restriction lists above.  I had to set both to "no" so that the messages bound for other domains weren't rejected at this stage.

I've tested the above combination and it does work for my local subnet while still denying relay access to any systems not on the local subnet, but I'm not fully sure of the additional impact of these changes.  In particular, this may disable the iRedAPD service from checking messages from subnet hosts because the check_policy_service listing is now after permit_mynetworks.  Would moving those entries before permit_mynetworks and just leaving the reject_unknown_recipient and recipient_domain be a better way to arrange this?

Any advice is appreciated.