Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Unix system where user accounts only exist in LDAP. I'm using libnss-ldapd with nscd to do this and it works quite well. Postfix delivers mail as expected under normal circumstances.

However, in the event that the LDAP server is down and the user map is not fully cached in nscd, users appear not to exist (i.e. getent passwd username returns no results) therefore Postfix's local(8) hard bounces emails with a "unknown user" error. This is very bad.

The current configuration includes:

smtpd_smtpd_reject_unlisted_recipient = yes
local_recipient_maps = $alias_maps, ldap:/etc/postfix/
mailbox_transport_maps = ldap:/etc/postfix/

Mail coming in over SMTP correctly tempfails when the LDAP service is not available. However, mail originating on this host (e.g. using mail(1)) does not.

Apr 25 15:25:33 testmail postfix/local[5972]: warning: dict_ldap_lookup: Search error -1: Can't contact LDAP server
Apr 25 15:25:33 testmail postfix/local[5972]: 29B4847DB: to=<ENVELOPE_TO_ADDRESS>, orig_to=<ENVELOPE_FROM_ADDRESS>, relay=local, delay=0.12, delays=0.01/0/0/0.11, dsn=5.1.1, status=bounced (unknown user: "ENVELOPE_TO_ADDRESS_LOCALPART")

I am fairly certain that the map is configured correctly because everything works if the LDAP service is available, including the case where NSS is unable to see the LDAP map because nslcd is stopped. Leaving mailbox_transport_maps as default (empty) produces the same results except without the LDAP connection error. There is no improvement if proxymap(8) is used.

How do I make Postfix defer (instead of reject) incoming mail when LDAP is down?

This question was edited significantly since it was first asked. The original question asked how to make smtpd(8) tempfail when LDAP is not available; it turns out that it was already doing so. The real problem was later in the delivery process.

Possibly related:

share|improve this question
up vote 1 down vote accepted

It turns out to have been a bug in postfix. The author applied this patch-fix on version 2.8.4, 2.7.5, 2.6.11 and 2.5.14.

Fixed with Postfix version:

  • ...

  • The local(8) delivery agent ignored table lookup errors in mailbox_command_maps, mailbox_transport_maps, fallback_transport_maps and (while bouncing mail to alias) alias owner lookup.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.