{
    "mode": "man",
    "parameter": "cidr_table",
    "section": "5",
    "url": "https://www.chedong.com/phpMan.php/man/cidr_table/5/json",
    "generated": "2026-08-16T00:40:19Z",
    "synopsis": "postmap -q \"string\" cidr:/etc/postfix/filename\npostmap -q - cidr:/etc/postfix/filename <inputfile",
    "sections": {
        "NAME": {
            "content": "cidrtable - format of Postfix CIDR tables\n",
            "subsections": []
        },
        "SYNOPSIS": {
            "content": "postmap -q \"string\" cidr:/etc/postfix/filename\n\npostmap -q - cidr:/etc/postfix/filename <inputfile\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "The  Postfix  mail system uses optional lookup tables.  These tables are usually in dbm or db\nformat.  Alternatively, lookup tables can be specified in CIDR (Classless Inter-Domain  Rout‐\ning)  form.  In this case, each input is compared against a list of patterns. When a match is\nfound, the corresponding result is returned and the search is terminated.\n\nTo find out what types of lookup tables your Postfix system supports use  the  \"postconf  -m\"\ncommand.\n\nTo test lookup tables, use the \"postmap -q\" command as described in the SYNOPSIS above.\n",
            "subsections": []
        },
        "TABLE FORMAT": {
            "content": "The general form of a Postfix CIDR table is:\n\npattern     result\nWhen  a  search  string  matches  the  specified pattern, use the corresponding result\nvalue. The pattern must be in network/prefix or networkaddress form (see ADDRESS PAT‐\nTERN SYNTAX below).\n\n!pattern     result\nWhen a search string does not match the specified pattern, use  the  specified  result\nvalue. The pattern must be in network/prefix or networkaddress form (see ADDRESS PAT‐\nTERN SYNTAX below).\n\nThis feature is available in Postfix 3.2 and later.\n\nif pattern\n\nendif  When  a  search string matches the specified pattern, match that search string against\nthe patterns between if and endif.  The pattern must  be  in  network/prefix  or  net‐\nworkaddress form (see ADDRESS PATTERN SYNTAX below). The if..endif can nest.\n\nNote: do not prepend whitespace to text between if..endif.\n\nThis feature is available in Postfix 3.2 and later.\n\nif !pattern\n\nendif  When  a  search  string does not match the specified pattern, match that search string\nagainst the patterns between if and endif. The pattern must be  in  network/prefix  or\nnetworkaddress form (see ADDRESS PATTERN SYNTAX below). The if..endif can nest.\n\nNote: do not prepend whitespace to text between if..endif.\n\nThis feature is available in Postfix 3.2 and later.\n\nblank lines and comments\nEmpty lines and whitespace-only lines are ignored, as are lines whose first non-white‐\nspace character is a `#'.\n\nmulti-line text\nA  logical  line  starts  with non-whitespace text. A line that starts with whitespace\ncontinues a logical line.\n",
            "subsections": []
        },
        "TABLE SEARCH ORDER": {
            "content": "Patterns are applied in the order as specified in the table, until a pattern  is  found  that\nmatches the search string.\n",
            "subsections": []
        },
        "ADDRESS PATTERN SYNTAX": {
            "content": "Postfix  CIDR  tables are pattern-based. A pattern is either a networkaddress which requires\nan exact match, or a networkaddress/prefixlength where the prefixlength part specifies the\nlength of the networkaddress prefix that must be matched (the other bits in the  networkad‐\ndress part must be zero).\n\nAn  IPv4  network  address is a sequence of four decimal octets separated by \".\", and an IPv6\nnetwork address is a sequence of three to eight hexadecimal octet pairs separated by  \":\"  or\n\"::\",  where the latter is short-hand for a sequence of one or more all-zero octet pairs. The\npattern 0.0.0.0/0 matches every IPv4 address, and ::/0 matches every IPv6 address.  IPv6 sup‐\nport is available in Postfix 2.2 and later.\n\nBefore comparisons are made, lookup keys and table entries are converted from string  to  bi‐\nnary. Therefore, IPv6 patterns will be matched regardless of leading zeros (a leading zero in\nan IPv4 address octet indicates octal notation).\n\nNote: address information may be enclosed inside \"[]\" but this form is not required.\n",
            "subsections": []
        },
        "INLINE SPECIFICATION": {
            "content": "The  contents of a table may be specified in the table name (Postfix 3.7 and later).  The ba‐\nsic syntax is:\n\nmain.cf:\nparameter = .. cidr:{ { rule-1 }, { rule-2 } .. } ..\n\nmaster.cf:\n.. -o { parameter = .. cidr:{ { rule-1 }, { rule-2 } .. } .. } ..\n\nPostfix ignores whitespace after '{' and before '}', and writes each rule as one text line to\nan in-memory file:\n\nin-memory file:\nrule-1\nrule-2\n..\n\nPostfix parses the result as if it is a file in /etc/postfix.\n\nNote: if a rule contains $, specify $$ to keep Postfix from trying to do $name  expansion  as\nit evaluates a parameter value.\n",
            "subsections": []
        },
        "EXAMPLE SMTPD ACCESS MAP": {
            "content": "/etc/postfix/main.cf:\nsmtpdclientrestrictions = ... cidr:/etc/postfix/client.cidr ...\n\n/etc/postfix/client.cidr:\n# Rule order matters. Put more specific allowlist entries\n# before more general denylist entries.\n192.168.1.1             OK\n192.168.0.0/16          REJECT\n2001:db8::1             OK\n2001:db8::/32           REJECT\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "postmap(1), Postfix lookup table manager\nregexptable(5), format of regular expression tables\npcretable(5), format of PCRE tables\n",
            "subsections": []
        },
        "README FILES": {
            "content": "Use \"postconf readmedirectory\" or \"postconf htmldirectory\" to locate this information.\nDATABASEREADME, Postfix lookup table overview\n",
            "subsections": []
        },
        "HISTORY": {
            "content": "CIDR table support was introduced with Postfix version 2.1.\n\nAUTHOR(S)\nThe CIDR table lookup code was originally written by:\nJozsef Kadlecsik\nKFKI Research Institute for Particle and Nuclear Physics\nPOB. 49\n1525 Budapest, Hungary\n\nAdopted and adapted by:\nWietse Venema\nIBM T.J. Watson Research\nP.O. Box 704\nYorktown Heights, NY 10598, USA\n\nWietse Venema\nGoogle, Inc.\n111 8th Avenue\nNew York, NY 10011, USA\n\nCIDRTABLE(5)",
            "subsections": []
        }
    },
    "summary": "cidrtable - format of Postfix CIDR tables",
    "flags": [],
    "examples": [],
    "see_also": [
        {
            "name": "postmap",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/postmap/1/json"
        },
        {
            "name": "regexptable",
            "section": "5",
            "url": "https://www.chedong.com/phpMan.php/man/regexptable/5/json"
        },
        {
            "name": "pcretable",
            "section": "5",
            "url": "https://www.chedong.com/phpMan.php/man/pcretable/5/json"
        }
    ]
}