---
title: "Howto Block Entire TLDs in Postfix"
description: "Block entire TLDs in Postfix mail server to reduce spam, phishing and, other unwanted emails."
url: "https://mailmum.io/posts/howto-block-entire-tlds-in-postfix/"
image: "https://mailmum.io/posts/howto-block-entire-tlds-in-postfix/block-entire-tlds-in-postfix.png"
---

# Howto Block Entire TLDs in Postfix

![Block entire TLDs in Postfix through config](https://mailmum.io/posts/howto-block-entire-tlds-in-postfix/block-entire-tlds-in-postfix.png)

Blocking or [blacklisting](https://mailmum.io/glossary/ip-blacklisting/) entire [Top Level Domains
(TLDs)](https://mailmum.io/glossary/tld/) in [Postfix mail server](https://www.postfix.org) may
have a big impact to reduce [spam](https://mailmum.io/glossary/spam/),
[phishing](https://mailmum.io/glossary/phishing/), and other unwanted emails. Dependent on the use case of your
systems it is a valid and effective solution. The only drawback is, to monitor
your email traffic and check, whether valid emails from blocked TLDs are sent to
your systems. Blocking a whole TLD is mostly a temporary thing, as the bad guys
move on if the domains on a specific TLD are not usable for their cases.

This tutorial is focuses on senders (users/clients) using this
[TLDs](https://mailmum.io/glossary/tld/). If you want to block mail servers using uncommon TLDs for
their hostname in setup, this is not the right solution. Check this tutorial:
[Howto block mailservers using uncommon TLDs in hostname through Postfix](https://mailmum.io/posts/howto-block-mailservers-using-uncommon-tlds-in-hostname-through-postfix/)

## Setup using PCRE and Regexp Table Format

The setup on a single Postfix mail server is pretty straightforward and can be
updated, extended, or removed at any time without big changes.

First of all, create a file called something like `/etc/postfix/reject_domains`
and add the relevant [Top Level Domain (TLD)](https://mailmum.io/glossary/tld/) like `.xyz`, the
word `REJECT`, and the message like "*We reject all mails from .xyz domains*".
Dependent on your preferences you can use [Perl Compatible Regular Expressions
(PCRE) Format](https://www.postfix.org/PCRE_README.html) or built-in
[Regexp](https://www.postfix.org/regexp_table.5.html). I'll explain you both.

### PCRE Table Format Setup

Dependent on your Linux distribution you may need to install an additional
package called something like **postfix-pcre** as [Perl Compatible Regular
Expressions (PCRE) support is optional in
Postfix](https://www.postfix.org/PCRE_README.html). As the regexp format is
pretty similar, you can skip this and use the second one.

You can use PCRE format to define regular expressions for [TLDs](https://mailmum.io/glossary/tld/).
Your `/etc/postfix/reject_domains` may look like this:

```config
/\.date$/ REJECT We reject all mails from .date domains
/\.pro$/  REJECT We reject all mails from .pro domains
/\.top$/  REJECT We reject all mails from .top domains
/\.wtf$/  REJECT We reject all mails from .wtf domains
/\.xyz$/  REJECT We reject all mails from .xyz domains
```

Now edit your Postfix main configuration `/etc/postfix/main.cf` and add a rule
to your `smtpd_sender_restrictions`:

```config
smtpd_sender_restrictions =
check_sender_access pcre:/etc/postfix/reject_domains
```

`pcre:` parameter tells Postfix, that the regular expression in the file is
in Perl [PCRE
Table](https://www.postfix.org/pcre_table.5.html).

As the last step you have to reload/restart Postfix to enable this setup:

```sh
# using systemd
service postfix reload
# or just postfix
postfix reload
```

### Regexp Table Format Setup

Compared to [PCRE](https://www.postfix.org/pcre_table.5.html), [Regexp
Tables](https://www.postfix.org/regexp_table.5.html) are built-in Postfix and
enabled by default. That's why I prefer using Regexp instead of PCRE and I'm
used to programming languages using this format for regular expressions.

You define one regular expression for every [TLD](https://mailmum.io/glossary/tld/) per line. Your
`/etc/postfix/reject_domains` may look like this:

```config
/.*\.date$/ REJECT We reject all mails from .date domains
/.*\.pro$/  REJECT We reject all mails from .pro domains
/.*\.top$/  REJECT We reject all mails from .top domains
/.*\.live$/ REJECT We reject all mails from .live domains
/.*\.wtf$/  REJECT We reject all mails from .wtf domains
/.*\.xyz$/  REJECT We reject all mails from .xyz domains
```

Now edit your Postfix main configuration `/etc/postfix/main.cf` and add a rule
to your `smtpd_sender_restrictions`:

```config
smtpd_sender_restrictions =
check_sender_access regexp:/etc/postfix/reject_domains
```

`regexp:` parameter tells Postfix, that the regular expression in the file is in
[Regexp Table](https://www.postfix.org/regexp_table.5.html) format.

As the last step you have to reload/restart Postfix to enable this setup:

```sh
# using systemd
service postfix reload
# or just postfix
postfix reload
```

## To block or not to block a whole TLD

Dependent on the use case of your server, it may be appropriate to block
[TLDs](https://mailmum.io/glossary/tlds/) for a short or even longer period. Take a look at your
logs, maybe a monitoring system, which can analyze and display such information.

By using [MailMum](https://mailmum.io/) and this way analyzing email traffic to the systems I'm
responsible for, I could get the same insights as [Brian
Krebs](https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/).
Also, you can check [Spamhaus World's Most Abused
TLDs](https://www.spamhaus.org/statistics/tlds/) to get a feeling, of what to
look for.

Providing separated (virtual) servers for single customers which a specific user
base, you can take advantage of this simple and pretty effective way to block
senders using this technique.

## Summary

Dependent on your mail systems setup, you can use [TLD](https://mailmum.io/glossary/tld/) blocking
by rejecting specific [TLDs](https://mailmum.io/glossary/tlds/) or Domains to reject the traffic.
It may be a valid solution for one use case and a wrong one for big providers
hosting thousands of different customers with their different use cases on a
system or even a cluster.