Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have in /etc/postfix/main.cf:

smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination

and SASL seems to be working:

$ testsaslauthd -u yang -p ... -f /var/spool/postfix/var/run/saslauthd/mux -s smtpd
0: OK "Success."

but I'm getting "Relay access denied" when connecting from outside the network (and e.g. localhost still works fine):

$ telnet blah.com 25
auth plain ...
235 2.7.0 Authentication successful
mail from:<yang@blah.com>
250 2.1.0 Ok
rcpt to:<yang@dest.com>
554 5.7.1 <yang@dest.com>: Relay access denied


Oct 18 21:10:19 blah postfix/smtpd[13882]: connect from unknown[x.x.x.x]
Oct 18 21:10:19 blah postfix/smtpd[13882]: setting up TLS connection from unknown[x.x.x.x]
Oct 18 21:10:19 blah postfix/smtpd[13882]: Anonymous TLS connection established from unknown[x.x.x.x]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
Oct 18 21:10:19 blah postfix/smtpd[13882]: NOQUEUE: reject: RCPT from unknown[x.x.x.x]: 554 5.7.1 <yang@dest.com>: Relay access denied; from=<yang@blah.com> to=<yang@dest.com> proto=ESMTP helo=<[y.y.y.y]>
Oct 18 21:10:19 blah postfix/smtpd[13882]: disconnect from unknown [x.x.x.x]

Been stumped for some time now. Any hints?

My complete configuration follows; it's based on https://help.ubuntu.com/community/Postfix.


OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd"


# See /usr/share/postfix/main.cf.dist for a commented, more complete version

# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = blah.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = localhost.blah.com, localhost
relayhost =
mynetworks = [::ffff:]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

# From <http://www.postfix.org/VIRTUAL_README.html>

virtual_mailbox_domains = blah.com invalid.invalid
virtual_mailbox_base = /var/mail/blah
virtual_mailbox_maps = hash:/etc/postfix/vmailbox
virtual_alias_maps = hash:/etc/postfix/valiases
virtual_minimum_uid = 100
virtual_uid_maps = static:1001
virtual_gid_maps = static:1001

sender_bcc_maps = hash:/etc/postfix/bccmaps

smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

# Enforce SPF
smtpd_recipient_restrictions =
  check_policy_service unix:private/policyd-spf
policyd-spf_time_limit = 3600


pwcheck_method: saslauthd
mech_list: plain login
share|improve this question

1 Answer 1

up vote 6 down vote accepted

you have smtpd_recipient_restrictions twice, and the last one is the one being used and it does not have permit_sasl_authenticated

share|improve this answer
Face palm. Thank you. You have no idea how long I spent debugging this. That's it, calling it a night. –  Yang Oct 19 '10 at 5:40
Thanks, this helped solve my problem aswell, although it showed me that i had missed the smtpd_recipient_restrictions and was only using smtpd_relay_restrictions. –  lfxgroove Feb 9 '13 at 22:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.