# man > access(5)

---
type: CommandReference
command: access
mode: man
section: 5
source: man-pages
---

## Quick Reference
- `1.2.3.4 OK` — Allow specific IPv4 address
- `1.2.3 REJECT` — Reject entire IPv4 subnet
- `example.com REJECT` — Reject domain and optionally subdomains
- `user@example.com OK` — Permit specific email address
- `DISCARD` — Silently discard message
- `HOLD` — Place message on hold queue
- `REDIRECT user@example.com` — Redirect to another address
- `FILTER transport:destination` — Route through external content filter

## Name
access — Postfix SMTP server access table

## Synopsis
shell
postmap /etc/postfix/access
postmap -q "string" /etc/postfix/access
postmap -q - /etc/postfix/access <inputfile
## Options

### Email Address Patterns
- `user@domain` — Matches the exact mail address
- `domain.tld` — Matches the domain part (and subdomains if `parent_domain_matches_subdomains` is set)
- `.domain.tld` — Matches subdomains only when `parent_domain_matches_subdomains` is not set
- `user@` — Matches all addresses with the specified user part
- `user+foo@domain` — Extension delimiter causes fallback to `user@domain`, `domain`, `user+foo@`, `user@`

### Host Name/Address Patterns
- `domain.tld` — Matches hostname; subdomains included if `parent_domain_matches_subdomains` is set
- `.domain.tld` — Subdomains if not listed
- `net.work.addr.ess` to `net` — IPv4 address or network (truncated octets)
- `net:work:addr:ess` to `net` — IPv6 address or network (truncated octet pairs, compressed form)
- Use `cidr` table type for netmask patterns; see [cidr_table(5)](man:cidr_table(5))

### Actions

#### Accept
- `OK` — Permit the match
- All‑numerical result — Treated as OK (pop‑before‑smtp)

#### Reject / Defer
- `4NN text` — Temporary rejection with custom code and text
- `5NN text` — Permanent rejection; `421` or `521` also disconnect immediately
- `REJECT optional text` — Reject with generic or custom message
- `DEFER optional text` — Temporary failure response
- `DEFER_IF_REJECT optional text` — Defer if later restriction would REJECT
- `DEFER_IF_PERMIT optional text` — Defer if later restriction would PERMIT

#### Other
- `DISCARD optional text` — Silently discard message
- `DUNNO` — Pretend lookup key not found; stops substring search
- `FILTER transport:destination` — Route through external content filter
- `HOLD optional text` — Place message on hold queue
- `REDIRECT user@domain` — Redirect all recipients to the given address
- `BCC user@domain` — Send one blind copy (Postfix ≥ 3.0)
- `PREPEND header: value` — Prepend a header to the message
- `INFO optional text` — Log informational record (Postfix ≥ 3.0)
- `WARN optional text` — Log warning (Postfix ≥ 2.1)
- `restriction...` — Apply named UCE restriction (e.g., `permit`, `reject_unauth_destination`)

## Examples
shell
# /etc/postfix/main.cf
smtpd_client_restrictions =
    check_client_access hash:/etc/postfix/access

# /etc/postfix/access
1.2.3   REJECT
1.2.3.4 OK
Execute `postmap /etc/postfix/access` after editing.

## See Also
- [postmap(1)](man:postmap(1)) — Postfix lookup table manager
- [smtpd(8)](man:smtpd(8)) — SMTP server
- [postconf(5)](man:postconf(5)) — configuration parameters
- [transport(5)](man:transport(5)) — transport:nexthop syntax
- [cidr_table(5)](man:cidr_table(5)) — CIDR lookup table type
- [regexp_table(5)](man:regexp_table(5)) — regular expression table
- [pcre_table(5)](man:pcre_table(5)) — PCRE table
- [tcp_table(5)](man:tcp_table(5)) — TCP‑based lookup table