For some reason, we have three MTA namely MTA-A (IP:10.1.8.1), MTA-B (IP:10.1.9.1), MTA-C (IP:10.1.10.1):- MTA-A is a MX exchange which is responsible for local delivery only MTA-B is a MTA responsbile for out going mail delivery for various servers and services in all subnet while it will only relay mail to MTA-C for actual delivery. MTA-C is a MTA responsible for actual delivery and facing public.
Therefore for general outgoing email, the path would be:-
Server -> MTA-B -> MTA-C -> Internet Users
for internal email, the path would be:-
Server -> MTA-B -> MTA-C -> MTA-A -> Internal User
While I find that I can sent out any email when I telnet to MTA-C 25 port directly but it will simply reject all email when I telnet to MTA-B to sent out the email with error message in MTA-B's mail.log below:-
Nov 1 18:14:27 MTA-B postfix/smtpd[6181]: NOQUEUE: reject: RCPT from server[10.1.8.166]: 550 5.1.1 <exampleuser@exampledomain.com>: Recipient address rejected: [10.1.10.1]; from=<exampleuser@exampledomain.com> to=<exampleuser@anydomain.com> proto=SMTP helo=<exampledomain.com>
When there is error in MTA-B, no message can be logged in MTA-C. The mail.log in MTA-C for successful delivery per below :-
Nov 3 15:27:02 MTA-C postfix/smtpd[71639]: disconnect from server.exampledomain.com[10.1.8.166]
Nov 3 15:27:02 MTA-C postfix/qmgr[71633]: 115B2184A70: from=<root@server.exampledomain.com>, size=1470, nrcpt=1 (queue active)
Nov 3 15:27:02 MTA-C postfix/smtp[71657]: 115B2184A70: to=<exampleuser@anotherdomain.com>, relay=10.1.8.1[10.1.8.1]:25, delay=0.29, delays=0.01/0.01/0.02/0.25, dsn=2.6.0, status=sent (250 2.6.0 <201111030727.pA37R19Q011588@server.exampledomain.com> [InternalId=200981] Queued mail for delivery)
Nov 3 15:27:02 MTA-C postfix/qmgr[71633]: 115B2184A70: removed
The main.cf as per below:-
main.cf of MTA-B (IP: 10.1.9.1)
biff = no
unknown_address_reject_code = 554
unknown_hostname_reject_code = 544
unknown_client_reject_code = 544
mailbox_size_limit = 0
inet_interfaces = all
mynetworks = 127.0.0.0/8, 10.1.8.0/24, 10.1.9.0/24, 10.1.10.0/24
mydomain = exampledomain.com
myhostname = MTA-B.$mydomain
myorigin = $myhostname
mydestination = $myhostname, localhost.localdomain.com, localhost.$mydomain, localhost
smtpd_banner = welcome
unknown_local_recipient_reject_code = 450
alias_maps = hash:/etc/postfix/maps/aliases
alias_database = hash:/etc/postfix/maps/aliases
transport_maps = hash:/etc/postfix/maps/transport
relayhost = [10.1.10.1]
receive_override_options = no_address_mappings
strict_rfc821_envelopes = yes
disable_vrfy_command = yes
smtpd_helo_required = yes
smtpd_client_restrictions=
permit_mynetworks,
reject_invalid_hostname,
reject_unknown_client_hostname,
permit
smtpd_helo_restrictions=
permit_mynetworks,
reject_unauth_pipelining,
reject_non_fqdn_hostname,
reject_unknown_hostname,
reject_unknown_helo_hostname,
reject_invalid_hostname,
permit
smtpd_sender_restrictions=
permit_mynetworks,
reject_unknown_sender_domain,
permit
smtpd_recipient_restrictions=
permit_mynetworks,
reject_unauth_piplining,
reject_unauth_destination,
reject_unknown_recipient_domain,
reject_multi_recipient_bounce,
permit
smtpd_data_restrictions=
permit_mynetworks,
reject_unauth_pipelining,
reject_multi_recipient_bounce,
permit
main.cf of MTA-C (IP: 10.1.10.1)
mailbox_size_limit = 0
mydomain_fallback = localhost
message_size_limit = 0
biff = no
recipient_delimiter = +
enable_server_options = yes
inet_interfaces = all
relayhost =
smtpd_helo_restrictions =
header_checks =
virus_db_update_enabled = 1
myhostname = MTA-C.$mydomain
mydomain = exampledomain.com
mydestination = $myhostname, localhost.$mydomain, localhost
mynetworks = 10.1.8.0/24, 10.1.9.0/24, 10.1.10.0/24, 127.0.0.0/8
smtpd_banner = welcome
unknown_local_recipient_reject_code = 450
alias_maps = hash:/etc/postfix/maps/aliases
alias_database = hash:/etc/postfix/maps/aliases
receive_override_options = no_address_mappings
strict_rfc821_envelopes = yes
transport_maps = hash:/etc/postfix/maps/transport
smtpd_client_restrictions=
permit_mynetworks,
reject_unknown_client_hostname,
reject_unauth_pipelining,
reject_multi_recipient_bounce,
permit
smtpd_helo_required = yes
disable_vrfy_command = yes
smtpd_helo_restrictions=
permit_mynetworks,
reject_unauth_pipelining,
permit
smtpd_sender_restrictions=
permit_mynetworks,
reject_unauth_pipelining,
reject_unknown_sender_domain,
permit
smtpd_recipient_restrictions=
permit_mynetworks,
reject_unauth_pipelining,
reject_unauth_destination,
reject_unknown_recipient_domain,
reject_multi_recipient_bounce,
permit
smtpd_data_restrictions=
permit_mynetworks,
reject_unauth_pipelining,
reject_multi_recipient_bounce,
permit
smtpd_tls_loglevel = 0
Per configuration file above, both file already have permit_mynetworks setup and thus I wonder why would I got an error when I sent thru MTA-B but I can successfuly sent out the email when I sent thru MTA-C directly.
postconf -n for MTA-B
alias_database = hash:/etc/postfix/maps/aliases
alias_maps = hash:/etc/postfix/maps/aliases
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
default_transport = error
disable_vrfy_command = yes
inet_interfaces = all
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
mydestination = $myhostname, localhost.localdomain.com, localhost.$mydomain, localhost
mydomain = exampledomain.com
myhostname = MTA-B.$mydomain
mynetworks = 127.0.0.0/8, 10.1.8.0/24, 10.1.9.0/24, 10.1.10.0/24
myorigin = /etc/mailname
readme_directory = no
receive_override_options = no_address_mappings
recipient_delimiter = +
relay_transport = error
relayhost = [10.1.10.1]
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = welcome
smtpd_client_restrictions = permit_mynetworks, check_client_access hash:/etc/postfix/maps/client_access, reject_invalid_hostname, reject_unknown_client_hostname, permit
smtpd_data_restrictions = permit_mynetworks, reject_unauth_pipelining, reject_multi_recipient_bounce, permit
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, reject_unauth_pipelining, reject_non_fqdn_hostname, reject_unknown_hostname, reject_unknown_helo_hostname, reject_invalid_hostname, permit
smtpd_recipient_restrictions = permit_mynetworks, check_client_access hash:/etc/postfix/maps/client_access, check_recipient_access hash:/etc/postfix/maps/catchall_recipients, reject_unauth_piplining, reject_unauth_destination, reject_unknown_recipient_domain, reject_multi_recipient_bounce, permit
smtpd_sender_restrictions = permit_mynetworks, reject_unknown_sender_domain, permit
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
strict_rfc821_envelopes = yes
transport_maps = hash:/etc/postfix/maps/transport
unknown_address_reject_code = 554
unknown_client_reject_code = 544
unknown_hostname_reject_code = 544
unknown_local_recipient_reject_code = 450
BTW, MTA-B is ubuntu 8.04 and MTA-C is MAC Snow Leopard Server whereas both of them are simply using postfix. Anyway, I have tried to replace MTA-C with another appliance MTA(ironport) which will allow any email from internal network to passthru while the same error encountered. Thus, I guess the problem is mainly on MTA-B instead.
postconf -nand relevant mail excerpts from both MTas, detailing both a successful submission and a failure. – adaptr Nov 2 '11 at 10:45