Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Im trying to setup a mail server to receive email and I am working with Postfix on an Ubuntu EC2 instance with an Elastic IP and the reverse DNS Lookup points to my domain.

I am able to send and receive email between local accounts but unable to receive external email.

I have setup my MX records and am able to telnet to port 25 without problems, though I still have doubts if my MX records are correct

A (delete)       300         2010-10-12 03:37:24
A (delete)       300         2010-10-11 04:34:53
MX (delete)    300     10  2010-10-12 02:03:03
A (delete)       300         2010-10-11 04:34:15
MX (delete)    300     10  2010-10-12 02:12:51

netstat -nl gives me

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0   *               LISTEN     
tcp        0      0      *               LISTEN     
tcp        0      0      *               LISTEN     
tcp        0      0     *               LISTEN     
tcp        0      0       *               LISTEN     
tcp        0      0       *               LISTEN     
tcp        0      0       *               LISTEN     
tcp        0      0      *               LISTEN     
tcp        0      0      *               LISTEN     
tcp6       0      0 :::22                            :::*                          LISTEN     
tcp6       0      0 :::25                            :::*                          LISTEN     
udp        0         *

My /etc/postfix/ looks as follows

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file = /etc/ssl/certs/ssl-mail.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-mail.key
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname =
mydomain =
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = $mydomain
mydestination = $myhostname,localhost.$mydomain, localhost, $mydomain
relayhost =
#mynetworks = [::ffff:]/104 [::1]/128
mynetworks_style = host
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

local_recipient_maps =
virtual_alias_domains =

virtual_alias_maps = hash:/etc/postfix/virtual
inet_protocols = all
home_mailbox = Maildir/
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_authenticated_header = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sender_restrictions = reject_unknown_sender_domain
mailbox_command = /usr/lib/dovecot/deliver -c /etc/dovecot/conf.d/01-dovecot-postfix.conf -n -m "${EXTENSION}"
smtp_use_tls = yes
smtpd_tls_received_header = yes
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_auth_only = yes
tls_random_source = dev:/dev/urandom

The see no log of the mail actually reaching my server and there is no detail in /var/log/syslog

Im sure i am missing something basic and would like some help on how to go about setting this up.

I have setup a catch all id in /etc/postfix/virtual which works for local emails. I intend to process incoming mails using a ruby but I've been having trouble getting this up and running.

My mails keep getting the following message

This is an automatically generated Delivery Status Notification



Delivery to the following recipient has been delayed:

Message will be retried for 2 more day(s)

Technical details of temporary failure:
The recipient server did not accept our requests to connect. Learn more at
[ (10): Connection timed out]

Thanks in advance

share|improve this question
It would be much easier if you share the real domain name. Without that there is not much we can do besides of guessing. –  cstamas Oct 12 '10 at 18:39

2 Answers 2

up vote 5 down vote accepted

If you can access the server from outside your network by IP then there must be something wrong with your MX record. Google for an open relay tester and put your IP in there and see if it is able to connect to the server.

Connection timed out is usually caused by one of two things: a firewall eating the connection (could be on the server itself or the network firewall) or the IP address being wrong and pointing to an unused address where nothing can reject the connection. Note that if you just changed the DNS configuration, depending on how long your DNS records tell everyone to cache the lookup results, they may still be using the old information for a while.

If the IP works from outside of your network and it's been long enough since you set it up that the DNS caches have updated, then figuring out whats wrong with your MX record isn't going to be easy without real information. The only rules for an MX record is that
1) The MX record must contain a hostname (not an IP) and
2) The hostname must have an A record containing its IP (not a CNAME)
Most mailservers identify a completely invalid MX record and bounce with a message saying so.

Your best bet is to use dig MX which should produce something like

;; ANSWER SECTION:      6400    IN    MX

Then, dig A should say something like

;; ANSWER SECTION:   6400  IN    A

The only other thing I can think of is that in the anonymized sample DNS configuration you pasted, the terminating "." is missing from the hostnames, but I don't know if that was because of your search-and-replace or because that paste came from some kind of web-editor which may be hiding those terminating "."s from you. The bounce message you pasted used "" so I suspect it's just hidden.

If the IP doesn't work from outside your network then you'll need to check the server firewall (iptables on Linux) to make sure it's not blocking connections. If you can connect from another machine within your network, then the port is either blocked by your network firewall/router, or your ISP is blocking SMTP.

Also, make sure your Elastic IP is correctly associated with your instance. This looks like a pretty complex operation according to the docs here:

share|improve this answer
Thanks for your reply but could you help me with how to go about checking for the firewall and the iptables. Im able to telnet to port 25 too –  sid__ Oct 12 '10 at 13:06
Are you telnetting from outside of Amazon or using telnet localhost from inside of it? If you're able to connect from outside of Amazon and it works, then it's probably not a firewall problem. Otherwise, iptables -nL will tell you if there are any rules active, if the INPUT and OUTPUT policies are ACCEPT and there are no rules, the firewall is off. –  DerfK Oct 12 '10 at 22:46
If you can telnet in from outside of amazon, there is one more thing to try: send email to account@[] (with the square brackets). If it successfully sends it, the problem is with the record either being wrong or cached. Unfortunately a lot of mail applications and servers do not allow the ip address format for mail anymore, if it fails to work, the failure does not help us (unless you see in postfix's log that it did receive the email and rejected it because of the IP address). –  DerfK Oct 12 '10 at 22:54
I managed to fix it apparently I had opened the port but not for everyone and opening it for everyone fixed it. Thank you DerfK and Pjmorse all your suggestions were helpful in solving the problem. I wish I could accept both. Thank you. –  sid__ Oct 13 '10 at 5:24

You say you have doubts about your MX records. It's not easy to check them without knowing the domain, but try dig MX to see what comes up. If that's not the IP of your server, there's your problem.

If you know your MX is correct, the next thing I would try is not just telnetting to port 25, but actually pushing a mail message through using telnet. The SMTP protocol is pretty forgiving of geeks typing in the commands directly. RFC 821 has the details of the protocol; you just send EHLO, then tell it who you're mailing to, what address the message is from, and then DATA to start sending text; close with a . on a line by itself, and it should either accept the message or give you an error message.

I'm betting on the MX records myself, though.

share|improve this answer
; <<>> DiG 9.7.0-P1 <<>> MX ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20311 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ; IN MX ;; ANSWER SECTION: 248 IN MX 10 –  sid__ Oct 12 '10 at 12:58
So then dig produces the IP address of your server? –  pjmorse Oct 12 '10 at 13:01
(Which is to say, that looks right assuming your server is –  pjmorse Oct 12 '10 at 13:01
yeah. I do get an IP, which is correct. –  sid__ Oct 12 '10 at 13:03
Time to try hand-crafting some SMTP, then. –  pjmorse Oct 12 '10 at 13:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.