Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've setup a working postfix server except that all incoming mail is rejected.

When I try to send mail via telnet:

MAIL FROM: <tom@valid.domain.com>
250 2.1.0 Ok
RCPT TO: <tom@mydomain.com>
554 5.7.1 <my.host.name[1.2.3.4]>: Client host rejected: Access denied

My postconf -n

alias_database = hash:/etc/postfix/aliases
alias_maps = hash:/etc/postfix/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = no
config_directory = /etc/postfix
delay_warning_time = 4h
inet_interfaces = all
mailbox_size_limit = 0
masquerade_domains = mail.mydomain.com www.mydomain.com
maximal_backoff_time = 8000s
maximal_queue_lifetime = 7d
minimal_backoff_time = 1000s
mydestination = 
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = techxonline.net
readme_directory = no
recipient_delimiter = +
relayhost = 
smtp_helo_timeout = 60s
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_client_restrictions = reject_rbl_client sbl.spamhaus.org,         reject_rbl_client blackholes.easynet.nl,        reject_rbl_client dnsbl.njabl.org
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_hard_error_limit = 12
smtpd_helo_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_hostname,       reject_invalid_hostname, permit
smtpd_recipient_limit = 16
smtpd_recipient_restrictions = reject_unauth_pipelining, permit_mynetworks,         permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain,      reject_unauth_destination, check_policy_service inet:127.0.0.1:10023, permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = 
smtpd_sasl_security_options = noanonymous
smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks,       warn_if_reject reject_non_fqdn_sender, reject_unknown_sender_domain,        reject_unauth_pipelining, permit
smtpd_soft_error_limit = 3
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
unknown_local_recipient_reject_code = 450
virtual_alias_maps = mysql:/etc/postfix/mysql_alias.cf
virtual_gid_maps = static:5000
virtual_mailbox_base = /var/spool/mail/virtual
virtual_mailbox_domains = mysql:/etc/postfix/mysql_domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql_mailbox.cf
virtual_uid_maps = static:5000

In /var/log/syslog after sending from Gmail:

Oct 18 21:30:01 appman postfix/smtpd[25307]: connect from mail-gx0-f181.google.com[209.85.161.181]
Oct 18 21:30:01 appman postfix/smtpd[25307]: NOQUEUE: reject: RCPT from mail-gx0-f181.google.com[209.85.161.181]: 554 5.7.1 <mail-gx0-f181.google.com[209.85.161.181]>: Client host rejected: Access denied; from=<tom@valid.domain.com> to=<tom@mydomain.com> proto=ESMTP helo=<mail-gx0-f181.google.com>
Oct 18 21:30:01 appman postfix/smtpd[25307]: disconnect from mail-gx0-f181.google.com[209.85.161.181]

How can I get my postfix server to accept mail? If there is any other information I can provide please let me know.

EDIT: It seems like the server is requiring authentication to receive mail here. It doesn't seem to be host-restricted—using telnet from the server itself still causes the mail to be rejected. Authenticating with SASL and then sending the email works fine.

So, it seems that the problem is the server expects authentication for mail to be delivered at the final destination, which it shouldn't. Ideas?

share|improve this question
    
Did you build it based on an existing document or did you set this up without assistance? –  Rilindo Oct 19 '11 at 2:23

2 Answers 2

up vote 0 down vote accepted

I think you need to put mydestination = mydomain.com in your config.


Next guess: We know the domain is right and that SASL works... so what I now suspect is that we're seeing an error in your restrictions. I'd start with recipient_restrictions and remove every rejection after permit_sasl_authenticated. If that works, add them back one at a time. If not, your next test is sender_restrictions.

share|improve this answer
    
I did, and got this message: Oct 18 21:51:04 appman postfix/trivial-rewrite[2210]: warning: do not list domain mydomain.com in BOTH mydestination and virtual_mailbox_domains. Same problem. –  Tom Marthenal Oct 19 '11 at 1:51
    
this warning: warning: do not list domain mydomain.com in BOTH mydestination and virtual_mailbox_domains is displayed whenever you have an alias with the same name of a domain –  gbuzogany Jul 1 at 12:02

First delete the policy delegation mechanism check_policy_service inet:127.0.0.1:10023. Then retry. Chances are very high that this is blocking your delivery.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.