SnapOverflow

SnapOverflow Logo SnapOverflow Logo

SnapOverflow Navigation

  • Home
  • Server
  • Ubuntu

Mobile menu

Close
  • Home
  • System Administrators
    • Hot Questions
    • New Questions
    • Tags
  • Ubuntu
    • Hot Questions
    • New Questions
    • Tags
  • Help
Home / server / Questions / 42519
In Process
Noah Goodrich
Noah Goodrich
Asked: 2009-07-19 06:59:12 +0800 CST2009-07-19 06:59:12 +0800 CST 2009-07-19 06:59:12 +0800 CST

How to correct Postfix' 'Relay Access Denied'?

  • 772

This morning, in order to correct a problem with a name mismatch in the security certificate, I followed the recommended steps from How to fix mail server SSL?, but now, when attempting to send an email from a client (in this case the client is Windows Mail), I receive the following error.

The rejected e-mail address was '[email protected]'. Subject 'This is a test. ', Account: 'mail.domain.com', Server: 'mail.domain.com', Protocol: SMTP, Server Response: '554 5.7.1 : Relay access denied', Port: 25, Secure(SSL): No, Server Error: 554, Error Number: 0x800CCC79

Edit: I can still retrieve emails from this account, and I send emails to other accounts at the same domain. I just can't send emails to recipients outside of our domain.

I tried disabling TLS altogether but no dice, I still get the same error.

When I check file mail.log, I see the following.

Jul 18 08:24:41 company imapd: LOGIN, [email protected], ip=[::ffff:111.111.11.11], protocol=IMAP
Jul 18 08:24:42 company imapd: DISCONNECTED, [email protected], ip=[::ffff:111.111.11.11], headers=0, body=0, rcvd=83, sent=409, time=1
Jul 18 08:25:19 company postfix/smtpd[29282]: connect from company.university.edu[111.111.11.11]
Jul 18 08:25:19 company postfix/smtpd[29282]: NOQUEUE: reject: RCPT from company.university.edu[111.111.11.11]: 554 5.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<UserPC>
Jul 18 08:25:19 company postfix/smtpd[29282]: disconnect from company.university.edu[111.111.11.11]
Jul 18 08:25:22 company imapd: DISCONNECTED, [email protected], ip=[::ffff:111.111.11.11], headers=13, body=142579, rcvd=3289, sent=215892, time=79

File main.cf looks like this:

#
# Postfix MTA Manager Main Configuration File;
#
# Please do NOT edit this file manually;
#

#
# Postfix directory settings; These are critical for normal Postfix MTA functionallity;
#

command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
program_directory = /usr/lib/postfix

#
# Some common configuration parameters;
#

inet_interfaces = all
mynetworks = 127.0.0.0/8
mynetworks_style = host

myhostname = mail.domain.com
mydomain = domain.com
myorigin = $mydomain

smtpd_banner = $myhostname ESMTP 2.4.7.1 (Debian/GNU)
setgid_group = postdrop

#
# Receiving messages parameters;
#

mydestination = localhost, company 
append_dot_mydomain = no
append_at_myorigin = yes
transport_maps = mysql:/etc/postfix/transport.cf

#
# Delivering local messages parameters;
#

mail_spool_directory = /var/spool/mail
mailbox_size_limit = 0
mailbox_command = procmail -a "$EXTENSION"

biff = no

alias_database = hash:/etc/aliases

local_recipient_maps =

#
# Delivering virtual messages parameters;
#
virtual_mailbox_maps=mysql:/etc/postfix/mysql_virt.cf
virtual_uid_maps=mysql:/etc/postfix/uids.cf
virtual_gid_maps=mysql:/etc/postfix/gids.cf
virtual_mailbox_base=/usr/local/virtual
virtual_maps=mysql:/etc/postfix/virtual.cf
virtual_mailbox_domains=mysql:/etc/postfix/virtual_domains.cf


#
# SASL paramters;
#
smtp_use_tls = yes
smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s

smtp_tls_CAfile = /etc/postfix/ssl/smptd.pem
smtp_tls_cert_file = /etc/postfix/ssl/smptd.crt
smtp_tls_key_file = /etc/postfix/ssl/smptd.key

smtpd_tls_CAfile = /etc/postfix/ssl/smptd.pem
smtpd_tls_cert_file = /etc/postfix/ssl/smptd.crt
smtpd_tls_key_file = /etc/postfix/ssl/smptd.key

smtpd_sasl_auth_enable = yes

smtpd_sasl_security_options = noanonymous

smtpd_sasl_local_domain =

broken_sasl_auth_clients = yes

smtpd_sender_restrictions =
        permit_sasl_authenticated
        permit_mynetworks

smtpd_recipient_restrictions =
        permit_sasl_authenticated
        check_recipient_access hash:/etc/postfix/filtered_domains
        permit_mynetworks
        reject_unauth_destination

As a side note, my employer wants to be able to send emails from clients (Thunderbird and Outlook) both from within our local network and outside it.

linux smtp postfix
  • 7 7 Answers
  • 458340 Views

7 Answers

  • Voted
  1. Brandon
    2009-07-23T12:59:39+08:002009-07-23T12:59:39+08:00

    TLS just enables encryption on the smtp session and doesn't directly affect whether or not Postfix will be allowed to relay a message.

    The relaying denied message occurs because the smtpd_recipient_restrictions rules was not matched. One of those conditions must be fulfilled to allow the message to go through:

    smtpd_recipient_restrictions =
        permit_sasl_authenticated
        check_recipient_access hash:/etc/postfix/filtered_domains
        permit_mynetworks
        reject_unauth_destination
    

    To explain those rules:

    permit_sasl_authenticated
    

    permits authenticated senders through SASL. This will be necessary to authenticate users outside of your network which are normally blocked.

    check_recipient_access
    

    This will cause postfix to look in /etc/postfix/filtered_domains for rules based on the recipient address. (Judging by the file name on the file name, it is probably just blocking specific domains... Check to see if gmail.com is listed in there?)

    permit_mynetworks
    

    This will permit hosts by IP address that match IP ranges specified in $mynetworks. In the main.cf you posted, $mynetworks was set to 127.0.0.1, so it will only relay emails generated by the server itself.

    Based on that configuration, your mail client will need to use SMTP Authentication before being allowed to relay messages. I'm not sure what database SASL is using. That is specified in /usr/lib/sasl2/smtpd.conf Presumably it also uses the same database as your virtual mailboxes, so you should be able enable SMTP authentication in your mail client and be all set.

    • 74
  2. pgs
    2009-07-19T07:47:57+08:002009-07-19T07:47:57+08:00
    smtpd_use_tls = no
    

    You've disabled TLS, so you now need to authorise your local network by adding it to mynetworks. For example,

    mynetworks = 192.168.1.0/24 127.0.0.0/8
    

    This will fix sending from your local network only. For sending email from outside your local network, you'll need to get TLS authentication working.

    • 18
  3. Dzung Nguyen
    2009-11-21T08:54:33+08:002009-11-21T08:54:33+08:00

    I think you miss you domain.com in mydestination, because the default relay_domains=$mydestination, so you you can append you configuration the line:

    mydestinations = $mydomain, $myhostname, localhost, localhost.localdomain
    

    or:

    relay_domains = $mydomain
    

    Dont forget to restart the postfix server (service postfix restart) every time you edit postfix conf file.

    • 9
  4. Dee
    2013-05-11T14:29:30+08:002013-05-11T14:29:30+08:00

    I had the same issue in Outlook (with dovecote and postfix backend) and I spent two days looking for solution and tweaking my config files. All I needed to do was check "Server requires authentication" in the Outgoing tab in mail settings in outlook and my messages are now sent to gmail. See detailed instruction on how to find the setting here http://support.bluetie.com/node/440.

    • 2
  5. A23
    2014-04-16T17:40:06+08:002014-04-16T17:40:06+08:00

    This problem was bugging me for a while. I was trying to connect from server1.domain.com to server2.domain.com.

    Here's how I fixed this -

    #/etc/postfix/main.cf
    mydomain = server1.domain.com
    myhostname = $mydomain
    virtual_alias_maps = hash:/etc/postfix/virtual
    alias_database = hash:/etc/postfix/virtual
    myorigin = /etc/mailname
    mydestination = localhost.localdomain localhost $mydomain
    relayhost =
    mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
    mailbox_size_limit = 0
    recipient_delimiter = +
    inet_interfaces = all
    

    You also need to make sure that you have set /etc/hosts and /etc/hostname properly and make sure that you run the following after networking changes -

    sudo service networking restart
    

    and the following after postfix configuration changes

    sudo service postfix reload
    
    • 2
  6. Greendrake
    2022-06-17T06:13:48+08:002022-06-17T06:13:48+08:00

    Many answers to this problem on the Internet mention adding permit_mynetworks to smtpd_recipient_restrictions. But it does not seem to be enough these days.

    To get it work, I had to add permit_mynetworks to smtpd_relay_restrictions as well (Postfix 3.4.14).

    • 1
  7. Putnik
    2017-04-19T07:51:52+08:002017-04-19T07:51:52+08:00

    For me: I had to add localhost to mynetworks regardless of the fact 127.0.0.0/8 already was there. So, now it looks:

    mynetworks = 1.1.1.1/32, 127.0.0.0/8, localhost

    • 0

Sidebar

Stats

  • Questions 681965
  • Answers 980273
  • Best Answers 280204
  • Users 287326
  • Popular
  • Answers
  • Marko Smith

    Ping a Specific Port

    • 18 Answers
  • Marko Smith

    What port does SFTP use?

    • 6 Answers
  • Marko Smith

    Resolve host name from IP address

    • 8 Answers
  • Marko Smith

    How can I sort du -h output by size

    • 30 Answers
  • Marko Smith

    Command line to list users in a Windows Active Directory group?

    • 9 Answers
  • Marko Smith

    What's the command-line utility in Windows to do a reverse DNS look-up?

    • 14 Answers
  • Marko Smith

    How to check if a port is blocked on a Windows machine?

    • 4 Answers
  • Marko Smith

    What port should I open to allow remote desktop?

    • 9 Answers
  • Marko Smith

    What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

    • 3 Answers
  • Marko Smith

    How to determine if a bash variable is empty?

    • 15 Answers
  • Martin Hope
    Davie Ping a Specific Port 2009-10-09 01:57:50 +0800 CST
  • Martin Hope
    Deepak Mittal How to run a server on port 80 as a normal user on Linux? 2008-11-11 06:31:11 +0800 CST
  • Martin Hope
    MikeN In Nginx, how can I rewrite all http requests to https while maintaining sub-domain? 2009-09-22 06:04:43 +0800 CST
  • Martin Hope
    Tom Feiner How can I sort du -h output by size 2009-02-26 05:42:42 +0800 CST
  • Martin Hope
    0x89 What is the difference between double and single square brackets in bash? 2009-08-10 13:11:51 +0800 CST
  • Martin Hope
    kch How do I change my private key passphrase? 2009-08-06 21:37:57 +0800 CST
  • Martin Hope
    Kyle Brandt How does IPv4 Subnetting Work? 2009-08-05 06:05:31 +0800 CST
  • Martin Hope
    Noah Goodrich What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats? 2009-05-19 18:24:42 +0800 CST
  • Martin Hope
    Brent How to determine if a bash variable is empty? 2009-05-13 09:54:48 +0800 CST
  • Martin Hope
    cletus How do you find what process is holding a file open in Windows? 2009-05-01 16:47:16 +0800 CST

Related Questions

Trending Tags

linux nginx windows networking ubuntu domain-name-system amazon-web-services active-directory apache-2.4 ssh

Explore

  • Home
  • Questions
    • Hot Questions
    • New Questions
  • Tags
  • Help

Footer

SnapOverflow

About Us

  • About Us
  • Contact Us

Legal Stuff

  • Privacy Policy

Help

© 2022 SOF-TR. All Rights Reserve