Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been following this tutorial: http://flurdy.com/docs/postfix/index.html

For some reason, even after making sure that I set it up correctly, it will not send any mail to external domains. It can still receive from them, but sending results in this:

postfix/smtpd[26338]: NOQUEUE: reject: RCPT from localhost[127.0.0.1]: 554 5.7.1 <xxxx@gmail.com>: Relay access denied; from=<user@domain.com> to=<xxxx@gmail.com> proto=ESMTP helo=<domain.com>

I've got TLS enabled, as well as amavis. Disabling either (or both) doesn't change anything. I can also send to my own domain, and it will arrive correctly.

Here's my /etc/postfix/main.cf:

# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
myorigin = domain.com
masquerade_domains = mail.domain.com
masquerade_exceptions = root

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/postfix/postfix.cert
smtpd_tls_key_file=/etc/postfix/postfix.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

smtp_tls_security_level = may

smtpd_tls_security_level = may

smtp_tls_note_starttls_offer = yes

smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = mail.domain.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = mail.domain.com
mydestination = domain.com, localhost, localhost.localdomain
relayhost =
mynetworks = 127.0.0.0/8, [::ffff:127.0.0.0]/104, [::1]/128
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
mynetworks_style = host

local_recipient_maps =
mydestination =
delay_warning_time = 4h
unknown_local_recipient_reject_code = 450
maximum_queue_lifetime = 7d
minimal_backoff_time = 1000s
maximal_backoff_time = 8000s

smtp_helo_timeout = 60s
smtpd_recipient_limit = 32
smtpd_soft_error_limit = 3
smtpd_hard_error_limit = 12

smtpd_helo_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_hostname,  reject_invalid_hostname, permit
smtpd_sender_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_pipelining, permit_sasl_authenticated, permit
smtpd_client_restrictions = reject_rbl_client sbl.spamhaus.org, reject_rbl_client blackholes.easynet.nl, reject_unauth_destination, permit
smtpd_recipient_restrictions = reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, permit
smtpd_data_restrictions = reject_unauth_pipelining

smtpd_helo_required = yes
smtpd_delay_reject = yes
disable_vrfy_command = yes

alias_maps = hash:/etc/postfix/aliases
alias_database = hash:/etc/postfix/aliases

virtual_mailbox_base = /var/spool/mail/virtual
virtual_mailbox_maps = mysql:/etc/postfix/mysql_mailbox.cf

virtual_alias_maps = mysql:/etc/postfix/mysql_alias.cf

virtual_mailbox_domains = mysql:/etc/postfix/mysql_domains.cf

virtual_uid_maps = static:5000
virtual_gid_maps = static:5000

content_filter = amavis:[127.0.0.1]:10024

# SASL
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = no
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = domain.com
share|improve this question
add comment

4 Answers 4

up vote 3 down vote accepted

Remove reject_unauth_destination from smtpd_client_restrictions.

EDIT

You are using SMTP to send email, so postfix still uses all smtpd_*_restrictions even though you are connecting from 127.0.0.1. These smtpd_*_restrictions are applied in following order: client, helo, sender, recipient, data, or end-of-data. reject_unauth_destination rejects any mail unless domain in RCPT TO matches $mydestionation or $relay_domains. In your case, when reject_unauth_destination is used in smtpd_client_restrictions, which is checked first, your mail almost immediately (after checking two RBLs) gets rejected because your postfix obviously isn't final destination for gmail.com and all rules to allow relaying mail from local or authenticated clients (permit_mynetworks, permit_sasl_authenticated) are skipped because you are already got REJECT from smtpd_client_restrictions.

share|improve this answer
    
And then you have to authenticate by SMTP-AUTH to be able to relay mails. –  mailq Oct 16 '11 at 9:00
    
@mailq could you explain that a little bit more? –  AlexD Oct 16 '11 at 9:13
1  
His log message doesn't match the configuration. If he really sends from 127.0.0.1 there shouldn't be a relay problem as it is allowed by permit_mynetworks. But if he sends from "outside" he must SMTP-AUTH to get past permit_sasl_authenticated. –  mailq Oct 16 '11 at 9:37
    
@mailq I've added more detailed explanation to my answer. –  AlexD Oct 16 '11 at 16:32
    
Thanks! This actually fixed it, and now I can send to external domains. –  Eli Oct 16 '11 at 19:32
add comment

I had similar issue, this saved me:

smtpd_relay_restrictions = permit_mynetworks, 
  permit_sasl_authenticated,
  reject_unauth_destination
share|improve this answer
add comment

Thank you, I sortered all smtpd_client_restrictions and my configuration works

This is a configuration should works:

smtpd_recipient_restrictions =    check_policy_service unix:/var/spool/postfix/postgrey/socket,    reject_rbl_client xbl.spamhaus.org,    reject_rbl_client pbl.spamhaus.org,    reject_rbl_client sbl.spamhaus.org,    reject_rbl_client multi.uribl.com,    reject_rbl_client rbl-plus.mail-abuse.org,    reject_rbl_client dialups.mail-abuse.org,    permit_mynetworks,    reject_unauth_destination,    reject_non_fqdn_recipient,    reject_unknown_sender_domain,    reject_unknown_recipient_domain

Sorting is important.

share|improve this answer
add comment

You must configure your server for relaying.

Try to add an external smtp host for the option relayhost:

postconf -e 'relayhost = smtp.example.com'
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.