Imagine you want to host a mail relay in between your cloud servers and your real backend servers. You want it to accept all mail from the cloud servers because they already did all the filtering and rejecting. You also want it to not send NDRs (Non Delivery Reports) to the original senders if your backend servers rejects mail for whatever reason. This is the case I had to deal with recently and here I will explain how I did it.
Setup
There are several cloud servers accepting mail for several domains. They do live scanning of mail and mapping against recipient lists so spam, malformed mails and unknown recipients get directly rejected on stream. All this cloud servers send the mail to an internal relay which is connected over a non public network i.e. a tunnel, dark fibre or VPN. The relay server was a debian 12 with a postfix 3.7. And this relay server is connected to the backend servers over a LAN.
Premise
The backend servers can sometimes reject or delay mail. If that happens you don't want the relay server to send a NDR, because that would use an IP possibly not allowed to send mail, the relay server even hasn't a public internet connection, you don't want to reveal internal info or you even want to ghost people rejected by the backend servers. So you have to deactivate NDRs of that postfix. Also you don't want it to send delayed mail notifications if the relay server temporarily cannot send mail to the backend servers. Probably for the same reasons.
Prerequisites
You will need a fully configured postfix which already works. How to configure a postfix as mail relay is out of scope here. You need to install postfix-pcre on debian via apt. That is probabbly also true for devuan, ubuntu and other debian derivates.
The main.conf
This options you will have to add or change on the main.conf:
#Don't send delayed mail notifications at all.
delay_warning_time = 0
#If your backend servers are down, full or for whatever reason not accepting mail.
maximal_queue_lifetime = 10d
bounce_queue_lifetime = 10d
#NDRs are internally generated and normally don't pass header_checks
internal_mail_filter_classes = bounce
#The file doing the magic
header_checks = pcre:/etc/postfix/header_checks
nested_header_checks =
The header_checks
This file named header_checks is a PCRE (Perl-compatible regular expressions) containing file. It doesn't need to be postmap'd as it is not hashed but remains plain text.
/^From: Mail Delivery System <MAILER-DAEMON>/ DISCARD local generated NDR discarded
Note that this will only match local generated MAILER-DAEMON mails as bounce produces them w/o a domain and the domain is attached at a later step. So you will not match any mails from inbound.
Committing
And that's it. Just reload the postfix and NDRs are gone. Now you will find rejected mail in the log like this:
2026-08-02T13:32:05.780116+00:00 relay.example.com postfix/cleanup[2125955]: BE56A416DC: discard: header From: Mail Delivery System <MAILER-DAEMON> from local; from=<> to=<user@example.org>: local generated NDR discarded
This will be the only evidence of it. It is worth to make a monitoring for it or integrate notifications in your log parsing system.
There is also to take in consideration that there are other ways to handle NDRs, like sending them all to postmaster or writing them on the file system. You should be aware that silently discarded mail also can have legal considerations if you are a company or public institution.