If I run it /usr/sbin/postgrey with parameteres it works as usual. If i use /etc/init.d/postgrey restart or systemctl restart postgrey - it doesn't.
It looks like it doesn't read /etc/default/postgrey at all, but how to debug this?
And if so, how to force it?
/etc/default/postgrey:
POSTGREY_OPTS="--unix /var/spool/postfix/postgrey/socket"
I'm docker-mailserver to manage my incoming and outgoing emails. One annoying thing is that some of the emails are greylisted (e.g. from amazon or digitalocean). I've already whitelisted these domains, but was thinking if there is an option to put incoming, greylisted emails into a dedicated directory on my inbox.
So instead of rejecting some emails completely it would put them into "postgrey" directory (and responding the sender that the message was rejected, as usually).
I've looked into the documentation but was unable to find such an option.
I'm getting this error in my mail log:
Feb 29 21:06:14 mail postfix/smtpd[29464]: NOQUEUE: reject: RCPT from mail-vi1eur05olkn2106.outbound.protection.outlook.com[40.92.90.106]: 451 4.3.5 [email protected]: Recipient address rejected: Server configuration error; from=nicolo.****@hotmail.it [email protected] proto=ESMTP helo=<EUR05-VI1-obe.outbound.protection.outlook.com>
I recently installed rspamd and postgrey, but if I disable postgrey I get the same error.
This is my postfix config:
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
smtpd_error_sleep_time = 1s
smtpd_soft_error_limit = 10
smtpd_hard_error_limit = 20
transport_maps = hash:/etc/postfix/transport
# Throttle limit policy mail (global)
smtp_destination_concurrency_limit = 4
polite_destination_rate_delay = 1s
smtp_extra_recipient_limit = 10
# Polite policy
polite_destination_concurrency_limit = 3
polite_destination_rate_delay = 1s
polite_destination_recipient_limit = 10
# Turtle policy
turtle_destination_concurrency_limit = 2
turtle_destination_rate_delay = 1s
turtle_destination_recipient_limit = 10
smtpd_sender_restrictions =
reject_unknown_sender_domain
permit_mynetworks
permit_sasl_authenticated
reject_unknown_reverse_client_hostname
smtpd_helo_required = yes
smtpd_helo_restrictions =
permit_mynetworks
permit_sasl_authenticated
check_helo_access hash:/etc/postfix/helo_access
reject_invalid_helo_hostname
reject_non_fqdn_helo_hostname
reject_unknown_helo_hostname
# Debian specific: Specifying a file name will cause the first
# line of that file to be used as the name. The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
readme_directory = no
# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on
# fresh installs.
compatibility_level = 2
# TLS parameters
smtpd_tls_cert_file = /etc/letsencrypt/live/indst.eu/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/indst.eu/privkey.pem
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.
# Handing off local delivery to Dovecot's LMTP, and telling it where to store mail
virtual_transport = lmtp:unix:private/dovecot-lmtp
# Virtual domains, users, and aliases
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated check_relay_domains
myhostname = mail.indst.eu
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = indst.eu
mydestination = $myhostname, localhost.indst.eu, localhost
relayhost =
mynetworks = 164.68.123.81 192.168.1.0/24 127.0.0.0/8
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4
relay_domains = indst.eu
#home_mailbox = Maildir/
mailbox_command =
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_local_domain =
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_mynetworks, reject_sender_login_mismatch, permit_sasl_authenticated, reject_unauth_destination, reject_non_fqdn_recipient, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unknown_recipient_domain, check_recipient_access hash:/etc/postfix/roleaccount_exceptions, check_sender_access hash:/etc/postfix/sender_access, reject_non_fqdn_hostname, reject_invalid_hostname, reject_unknown_reverse_client_hostname, reject_rbl_client zen.spamhaus.org, check_policy_service inet:127.0.0.1:10023, permit
smtp_tls_security_level = may
smtpd_tls_security_level = may
smtp_tls_note_starttls_offer = yes
smtp_use_tls=yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
mail.indst.eu = mail.indst.eu
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
maximal_queue_lifetime = 1d
delay_warning_time = 0h
bounce_template_file = /etc/postfix/bounce.cf
milter_protocol = 6
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
milter_default_action = accept
smtpd_milters = inet:127.0.0.1:11332
non_smtpd_milters = inet:127.0.0.1:11332
Thank you for your help.
The postgrey manual sais:
--auto-whitelist-clients=N whitelist host after first successful delivery N is the minimal count of mails before a client is whitelisted (turned on by default with value 5) specify N=0 to disable.
As I understand, this would for example automatically whitelist gmail.com completely, whenever I get 5 emails from different gmail users. Isn't that dangerous?, because there are a lot of spammers sending from that host.
Centos 6.8 Postfix 2.6.6
I still am having problems with Postgrey greylisting. I forgot my Dropbox password so I followed the know procedure. Dropbox sent me a mail to change it. Postgrey is continuously rejecting dropbox retries.
In my maillog each 5/6 minutes I see dropbox rejections, "reason=new"
I guess this is because sender's IP changes. After 4/5 tries dropbox server stops retries.
How can this be fixed apart of manually add sender in whitelist?
Edit 1: I added "dropbox.com" to /etc/postfix/postgrey_whitelist_clients.local, restarted Postfix but sender=01000157d7ee0e57-3626bd2e-5464-4efc-b36b-a61d9df644d2-000000@email.dropbox.com is rejected (sender's "name" changes every try)
Edit 2:
Oct 18 11:30:36 host postgrey[1813]: action=greylist, reason=new, client_name=a10-6.smtp-out.amazonses.com, client_address=54.240.10.6, sender=01000157d7ee0e57-3626bd2e-5464-4efc-b36b-a61d9df644d2-000000@email.dropbox.com, recipient=d@s
Oct 18 11:30:36 host postfix/smtpd[4306]: NOQUEUE: reject: RCPT from a10-6.smtp-out.amazonses.com[54.240.10.6]: 450 4.2.0 : Recipient address rejected: Greylisted, see http://postgrey.schweikert.ch/help/s.html; from=<01000157d7ee0e57-3626bd2e-5464-4efc-b36b-a61d9df644d2-000000@email.dropbox.com> to= proto=ESMTP helo=
Edit 3: After hours one of rejected IPs was used again so mail was delivered
Oct 18 14:03:39 host postgrey[1813]: action=pass, reason=triplet found, delay=10532, client_name=a27-148.smtp-out.us-west-2.amazonses.com, client_address=54.240.27.148, sender=01010157d8133997-c0c68e0b-a976-4319-9e67-0f18785a6bbe-000000@email.dropbox.com, recipient=d@s
Oct 18 14:03:39 host opendkim[1496]: 004561CA0888: message has signatures from dropbox.com, amazonses.com
Oct 18 14:03:40 host postfix/qmgr[12510]: 004561CA0888: from=<01010157d8133997-c0c68e0b-a976-4319-9e67-0f18785a6bbe-000000@email.dropbox.com>, size=6972, nrcpt=1 (queue active)