Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For some reason, we have three MTA namely MTA-A (IP:10.1.8.1), MTA-B (IP:10.1.9.1), MTA-C (IP:10.1.10.1):- MTA-A is a MX exchange which is responsible for local delivery only MTA-B is a MTA responsbile for out going mail delivery for various servers and services in all subnet while it will only relay mail to MTA-C for actual delivery. MTA-C is a MTA responsible for actual delivery and facing public.

Therefore for general outgoing email, the path would be:-

Server -> MTA-B -> MTA-C -> Internet Users

for internal email, the path would be:-

Server -> MTA-B -> MTA-C -> MTA-A -> Internal User

While I find that I can sent out any email when I telnet to MTA-C 25 port directly but it will simply reject all email when I telnet to MTA-B to sent out the email with error message in MTA-B's mail.log below:-

Nov  1 18:14:27  MTA-B postfix/smtpd[6181]: NOQUEUE: reject: RCPT from server[10.1.8.166]: 550 5.1.1 <exampleuser@exampledomain.com>: Recipient address rejected: [10.1.10.1]; from=<exampleuser@exampledomain.com> to=<exampleuser@anydomain.com> proto=SMTP helo=<exampledomain.com>

When there is error in MTA-B, no message can be logged in MTA-C. The mail.log in MTA-C for successful delivery per below :-

Nov  3 15:27:02 MTA-C postfix/smtpd[71639]: disconnect from server.exampledomain.com[10.1.8.166]
Nov  3 15:27:02 MTA-C postfix/qmgr[71633]: 115B2184A70: from=<root@server.exampledomain.com>, size=1470, nrcpt=1 (queue active)
Nov  3 15:27:02 MTA-C postfix/smtp[71657]: 115B2184A70: to=<exampleuser@anotherdomain.com>, relay=10.1.8.1[10.1.8.1]:25, delay=0.29, delays=0.01/0.01/0.02/0.25, dsn=2.6.0, status=sent (250 2.6.0 <201111030727.pA37R19Q011588@server.exampledomain.com> [InternalId=200981] Queued mail for delivery)
Nov  3 15:27:02 MTA-C postfix/qmgr[71633]: 115B2184A70: removed

The main.cf as per below:-

main.cf of MTA-B (IP: 10.1.9.1)

biff = no
unknown_address_reject_code = 554
unknown_hostname_reject_code = 544
unknown_client_reject_code = 544
mailbox_size_limit = 0
inet_interfaces = all
mynetworks = 127.0.0.0/8, 10.1.8.0/24, 10.1.9.0/24, 10.1.10.0/24
mydomain = exampledomain.com
myhostname = MTA-B.$mydomain
myorigin = $myhostname
mydestination = $myhostname, localhost.localdomain.com, localhost.$mydomain, localhost
smtpd_banner = welcome
unknown_local_recipient_reject_code = 450
alias_maps = hash:/etc/postfix/maps/aliases
alias_database = hash:/etc/postfix/maps/aliases
transport_maps = hash:/etc/postfix/maps/transport
relayhost = [10.1.10.1]
receive_override_options = no_address_mappings
strict_rfc821_envelopes = yes
disable_vrfy_command = yes
smtpd_helo_required = yes
smtpd_client_restrictions=
        permit_mynetworks,
        reject_invalid_hostname,
        reject_unknown_client_hostname,
        permit
smtpd_helo_restrictions=
        permit_mynetworks,
        reject_unauth_pipelining,
        reject_non_fqdn_hostname,
        reject_unknown_hostname,
        reject_unknown_helo_hostname,
        reject_invalid_hostname,
        permit
smtpd_sender_restrictions=
        permit_mynetworks,
        reject_unknown_sender_domain,
        permit
smtpd_recipient_restrictions=
        permit_mynetworks,
        reject_unauth_piplining,
        reject_unauth_destination,
        reject_unknown_recipient_domain,
        reject_multi_recipient_bounce,
        permit
smtpd_data_restrictions=
        permit_mynetworks,
        reject_unauth_pipelining,
        reject_multi_recipient_bounce,
        permit

main.cf of MTA-C (IP: 10.1.10.1)

mailbox_size_limit = 0
mydomain_fallback = localhost
message_size_limit = 0
biff = no
recipient_delimiter = +
enable_server_options = yes
inet_interfaces = all
relayhost =
smtpd_helo_restrictions =
header_checks =
virus_db_update_enabled = 1
myhostname = MTA-C.$mydomain
mydomain = exampledomain.com
mydestination = $myhostname, localhost.$mydomain, localhost
mynetworks = 10.1.8.0/24, 10.1.9.0/24, 10.1.10.0/24, 127.0.0.0/8
smtpd_banner = welcome
unknown_local_recipient_reject_code = 450
alias_maps = hash:/etc/postfix/maps/aliases
alias_database = hash:/etc/postfix/maps/aliases
receive_override_options = no_address_mappings
strict_rfc821_envelopes = yes
transport_maps = hash:/etc/postfix/maps/transport
smtpd_client_restrictions=
        permit_mynetworks,
        reject_unknown_client_hostname,
        reject_unauth_pipelining,
        reject_multi_recipient_bounce,
        permit
smtpd_helo_required = yes
disable_vrfy_command = yes
smtpd_helo_restrictions=
        permit_mynetworks,
        reject_unauth_pipelining,
        permit
smtpd_sender_restrictions=
        permit_mynetworks,
        reject_unauth_pipelining,
        reject_unknown_sender_domain,
        permit
smtpd_recipient_restrictions=
        permit_mynetworks,
        reject_unauth_pipelining,
        reject_unauth_destination,
        reject_unknown_recipient_domain,
        reject_multi_recipient_bounce,
        permit
smtpd_data_restrictions=
        permit_mynetworks,
        reject_unauth_pipelining,
        reject_multi_recipient_bounce,
        permit
smtpd_tls_loglevel = 0

Per configuration file above, both file already have permit_mynetworks setup and thus I wonder why would I got an error when I sent thru MTA-B but I can successfuly sent out the email when I sent thru MTA-C directly.

postconf -n for MTA-B

alias_database = hash:/etc/postfix/maps/aliases
alias_maps = hash:/etc/postfix/maps/aliases
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
default_transport = error
disable_vrfy_command = yes
inet_interfaces = all
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
mydestination = $myhostname, localhost.localdomain.com, localhost.$mydomain, localhost
mydomain = exampledomain.com
myhostname = MTA-B.$mydomain
mynetworks = 127.0.0.0/8, 10.1.8.0/24, 10.1.9.0/24, 10.1.10.0/24
myorigin = /etc/mailname
readme_directory = no
receive_override_options = no_address_mappings
recipient_delimiter = +
relay_transport = error
relayhost = [10.1.10.1]
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = welcome
smtpd_client_restrictions = permit_mynetworks,        check_client_access hash:/etc/postfix/maps/client_access,        reject_invalid_hostname,        reject_unknown_client_hostname,        permit
smtpd_data_restrictions = permit_mynetworks,        reject_unauth_pipelining,        reject_multi_recipient_bounce,        permit
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks,        reject_unauth_pipelining,        reject_non_fqdn_hostname,        reject_unknown_hostname,        reject_unknown_helo_hostname,        reject_invalid_hostname,        permit
smtpd_recipient_restrictions = permit_mynetworks,        check_client_access hash:/etc/postfix/maps/client_access,        check_recipient_access hash:/etc/postfix/maps/catchall_recipients,    reject_unauth_piplining,        reject_unauth_destination,        reject_unknown_recipient_domain,        reject_multi_recipient_bounce,        permit
smtpd_sender_restrictions = permit_mynetworks,        reject_unknown_sender_domain,        permit
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
strict_rfc821_envelopes = yes
transport_maps = hash:/etc/postfix/maps/transport
unknown_address_reject_code = 554
unknown_client_reject_code = 544
unknown_hostname_reject_code = 544
unknown_local_recipient_reject_code = 450

BTW, MTA-B is ubuntu 8.04 and MTA-C is MAC Snow Leopard Server whereas both of them are simply using postfix. Anyway, I have tried to replace MTA-C with another appliance MTA(ironport) which will allow any email from internal network to passthru while the same error encountered. Thus, I guess the problem is mainly on MTA-B instead.

share|improve this question
    
Your single log entry is obfuscated beyond salvation. Please provide the output of postconf -n and relevant mail excerpts from both MTas, detailing both a successful submission and a failure. –  adaptr Nov 2 '11 at 10:45
    
revised with postconf -n as well as successful submission. –  frankcheong Nov 7 '11 at 4:36

1 Answer 1

According to your provided configuration the error message is inexplicable.

share|improve this answer
    
That means my configuration above should work as expected? –  frankcheong Nov 3 '11 at 3:43
    
@frankcheong Yes, it should. Either this is not your configuration, or your network setup or something completely different. But your configuration is OK. –  mailq Nov 3 '11 at 12:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.