Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to setup a Postfix server on a Linux box to relay all mail to our Office365 (Exchange, hosted by Microsoft) mail server, but, I keep getting an error regarding the sending address:

BB338140DC1: to=[]:587, delay=7.6, delays=0.01/0/2.5/5.1, dsn=5.7.1, status=bounced (host[] said: 550 5.7.1 Client does not have permissions to send as this sender (in reply to end of DATA command))

Office 365 requires that the sending address in the MAIL FROM and From: header be the same as the address used to authenticate. I have tried everything I can think of in the config to get this working. My postconf -n:

append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
debug_peer_list =
inet_interfaces = loopback-only
inet_protocols = all
mailbox_size_limit = 0
mydestination = xxxxx, localhost.localdomain, localhost
myhostname = localhost
mynetworks =
recipient_delimiter = +
relay_domains = our.doamin
relayhost = []:587
sender_canonical_classes = envelope_sender
sender_canonical_maps = hash:/etc/postfix/sender_canonical
smtp_always_send_ehlo = yes
smtp_sasl_auth_enable = yes
smtp_sasl_mechanism_filter = login
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options =
smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes



Also, sasl_passwd is set to the correct credentials (tested them using swaks multiple times.) Authentication works, and sends the message when the from headers are correct (also tested using swaks, which works)

The emails are coming from PHP, so I have also tried altering the sendmail path in php.ini to use pass the correct from address via -f

So, for some reason, mail coming from www-data and root are not having the from fields rewritten to Office 365's satisfaction, and it won't send the message.

Any postfix gurus out there that can help me setup this relay?

share|improve this question
up vote 3 down vote accepted

Just in case anyone comes across this later. I DID finally get a proper email relay working. The issues had to do with using an older version of postfix, which formatted the "FROM" element in the envelope in a way that Office 365 didn't like. Updating Postfix to 2.9 or greater (and using a config like the one above) solved the issue.

share|improve this answer
I've spent the last 3 days trying to set this relay with sendmail, ssmtp and now postfix. Can you explain to me a little bit more in depth your sender_canonical? It is necessary for this relay to work? With my setup I get Jan 9 11:03:11 isvahlrtk01 postfix/smtp[12841]: connect to[]:587: Connection timed out – Rhyuk Jan 9 '13 at 15:24
where did you get the smtp_tls_CAfile for ? – pjz Apr 5 '13 at 13:19
I never needed it, it plays nice with what comes with Ubuntu server. – woodsbw Apr 12 '13 at 16:59


  1. Don't send mail to Office365 as a user from your Office365-hosted e-mail domain. Use a subdomain instead, e.g. instead of It wouldn't hurt to set up an SPF record for or whatever you decide to use.

  2. Don't authenticate against as an Office365 user. Just connect on port 25 and deliver the mail to your domain as any foreign SMTP agent would do.

share|improve this answer
Fair enough. I was hoping to get all our mail going through a central point...but after spending 12 hours trying to get this relay working, I'll take it :) – woodsbw Apr 13 '12 at 15:10

I've found that some SASL auth modules were missing. The following fixed it:

yum install cyrus-sasl-plain  cyrus-sasl-scram cyrus-sasl-md5  cyrus-sasl-ntlm

(plain module was probably enough)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.