---
title: "Howto block mailservers using uncommon TLDs in hostname through Postfix"
description: "Block mail servers using uncommon TLDs in their hostname to stop spam/junk, phishing and other unwanted emails."
url: "https://mailmum.io/posts/howto-block-mailservers-using-uncommon-tlds-in-hostname-through-postfix/"
image: "https://mailmum.io/posts/howto-block-mailservers-using-uncommon-tlds-in-hostname-through-postfix/block-mail-servers-on-helo-ehlo.png"
---

# Howto block mailservers using uncommon TLDs in hostname through Postfix

![Block mail servers on HELO/EHLO hostname using TLD](https://mailmum.io/posts/howto-block-mailservers-using-uncommon-tlds-in-hostname-through-postfix/block-mail-servers-on-helo-ehlo.png)

Blocking or [blacklisting](https://mailmum.io/glossary/ip-blacklisting/) entire [Top Level Domains
(TLDs)](https://mailmum.io/glossary/tlds) used for [hostname](https://mailmum.io/glossary/hostname/) in email server
setup can be a very effective solution to stop low reputation mail servers
delivering mails to your email system(s).

As most email providers use common [TLDs](https://mailmum.io/glossary/tld) like `.net`, `.com`
or `.de` in their email setup, you can selectively block new or low reputation
TLDs and this way reducing a lot of unwanted emails.

If you are looking for a tutorial to blocking/blacklisting sender
(users/clients) using specific TLD, this tutorial is the right one for you:
[Howto Block Entire TLDs in
Postfix for Senders](https://mailmum.io/posts/howto-block-entire-tlds-in-postfix/).

## Setup

The setup on a single Postfix mail server is pretty straightforward and can be
updated, extended, or removed at any time without big changes. As the hostname
of a connecting email server is provided in the
[HELO/EHLO](https://mailmum.io/glossary/simple-mail-transfer-protocol-smtp/) message, you have to
target it on this step.

### Create a File with Regexp Table Format

[Regexp Tables](https://www.postfix.org/regexp_table.5.html) are built-in
Postfix and enabled by default. That’s why I prefer using Regexp instead of
[PCRE Table](https://www.postfix.org/pcre_table.5.html).

First of all, create a file called something like
`/etc/postfix/helo_reject_domains` and add the relevant [Top Level Domain
(TLD)](https://mailmum.io/glossary/tld) like `.xyz`, the word `REJECT`, and the message like `We
reject all email servers using .xyz domains`.

You define one regular expression for every TLD per line. Your
`/etc/postfix/helo_reject_domains` may look like this:

```text
/.*\.date$/ REJECT We reject all email servers using .date domains
/.*\.pro$/  REJECT We reject all email servers using .pro domains
/.*\.top$/  REJECT We reject all email servers using .top domains
/.*\.live$/ REJECT We reject all email servers using .live domains
/.*\.wtf$/  REJECT We reject all email servers using .wtf domains
/.*\.xyz$/  REJECT We reject all email servers using .xyz domains
```

Now edit your Postfix main configuration `/etc/postfix/main.cf` and add a rule
to your `smtpd_helo_restrictions` at the relevant place:

```txt
smtpd_helo_restrictions = regexp:/etc/postfix/helo_reject_domains
```

**WARNING:** Some network providers use uncommon TLDs for the reverse DNS records
of client IPs. It is good practice to add this check after
`permit_sasl_authenticated` rule.

Your setup may look something like:

```txt
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated,
  regexp:/etc/postfix/helo_reject_domains, reject_invalid_helo_hostname,
  reject_unknown_helo_hostname, permit
```

As the last step you have to reload/restart Postfix to enable this setup:

```sh
# using systemd
service postfix reload
# or just postfix
postfix reload
```


## To block or not to block a whole TLD by mailserver hostname

Dependent on the use case of your server, it may be appropriate to block
[TLDs](https://mailmum.io/glossary/tld) for a short or even longer period. Take a look at your
logs, maybe a monitoring system, which can analyze and display such information.

By using [MailMum](https://mailmum.io/) and this way analyzing email traffic to the systems I'm
responsible for, I could get the same insights as [Brian
Krebs](https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/).
You can check [Spamhaus World's Most Abused
TLDs](https://www.spamhaus.org/statistics/tlds/) to get a feeling, of what to
look for.

Providing separated (virtual) servers for single customers which a specific user
base, you can take advantage of this simple and pretty effective way to block
senders using this technique.

## Summary

Dependent on your mail systems setup, you can use [TLD](https://mailmum.io/glossary/tld/) blocking
by rejecting specific [TLDs](https://mailmum.io/glossary/tlds/) or even domains on HELO/EHLO
to your servers using their hostname.
It may be a valid solution for one use case and a wrong one for big providers
hosting thousands of different customers with their different use cases on a
system or even a cluster.

Using this technique, we could also identify a lot of invalid senders using
different networks all over the world for the same purpose. The only drawback
is, you have to monitor your systems for valid email providers and maybe remove
the block listing on some time.

Based on our experience using our own [MailMum Service](https://mailmum.io), we
could find a lot of abusive email servers using low reputation domain names as
hostname from selected [TLDs](https://mailmum.io/glossary/tlds). For such domains you can see a
lot of changes on [reverse DNS records (rDNS)](https://mailmum.io/glossary/rdns) for the same IP.