Send a Postfix domain catch-all to one mailbox

Use virtual_alias_maps to route unmatched recipients in a specific domain to one mailbox. This is a domain catch-all, not a guarantee that every message handled by Postfix will be captured. It also does not prevent a test system from sending mail to other domains.

For an isolated test environment, use a mail-capture service or an independently enforced outbound restriction when preventing real delivery is the requirement.

Define the domain and destination

This example assumes a dedicated alias domain, example.com, and an existing local user named catchall on mail.internal.example.net. The destination host must be a local delivery domain, and it must not be included in the catch-all alias scope.

Merge these settings with the current configuration rather than replacing unrelated maps or hosted domains:

virtual_alias_domains = example.com
virtual_alias_maps = hash:/etc/postfix/virtual

Do not also put example.com in mydestination or virtual_mailbox_domains for this dedicated virtual-alias design. Ensure mail.internal.example.net belongs to the appropriate local destination configuration and the catchall account exists.

In /etc/postfix/virtual:

@example.com    catchall@mail.internal.example.net

An explicit full destination avoids an unqualified catchall being expanded with $myorigin back into the domain being caught. Virtual alias lookups are recursive; a destination that matches the same catch-all again can loop.

Understand lookup precedence

For an indexed map, a specific address entry takes precedence over the @domain fallback. Audit existing entries if the requirement really is to redirect every address in that domain. A local account's existence does not by itself exempt its matching address from virtual alias rewriting.

Add a separate catch-all entry for each intended domain. Avoid an unrestricted regular expression matching every possible recipient unless the complete routing and recursion behavior is intentionally designed for that purpose.

Build the map and reload

Check the available map types first:

postconf -m
sudo postmap hash:/etc/postfix/virtual
postmap -q '@example.com' hash:/etc/postfix/virtual
sudo postfix check
sudo postfix reload

Use hash: only if the installation supports it; some builds use lmdb: instead. Rebuild an indexed map after editing its text source. The backing filename is backend-dependent, so not every installation produces a .db file.

The direct postmap -q query checks the literal catch-all key. It does not reproduce all of Postfix's address-lookup fallback rules when given an arbitrary full address.

Verify actual delivery

Send a controlled test to an otherwise unmapped address in the catch-all domain. Follow the queue ID through recipient rewriting and local delivery. Then test an explicit-address entry and a different domain to confirm the boundaries. Check postconf virtual_alias_maps virtual_alias_domains and the active logs if behavior differs.

An external destination on the right-hand side forwards mail externally. It requires a working outbound route and acceptance by the next hop; forwarding can also affect SPF and DMARC outcomes. Do not confuse outbound connectivity with permission to accept arbitrary inbound relay traffic.

A catch-all accepts typos and unwanted addresses as well as intended mail. Confirm capacity, retention, and who can read the shared mailbox before using one in production.

Regular-expression maps

regexp: maps are read as patterns rather than built as hash databases. They operate on the full address and have different lookup behavior from indexed maps. Check the installed map support and test representative addresses, including the final destination, before replacing a working domain-scoped map.

References

• Postfix virtual alias lookup rules
• Postfix virtual domain hosting