Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm creating an e-mail server with postfix (v2.7.1 on Debian 6.0) where users and groups are stored in an LDAP server.

Users accounts works fine but I want to create e-mail aliases from group (any e-mail addressed to groupAbc@domain.tld would be sent to the e-mail address of each member of the groupAbc group).

My groups are posixGroup whose members are listed by a memberUid attribute:

dn: cn=groupAbc,ou=Groups,dc=domain,dc=tld
objectClass: CourierMailAlias
objectClass: posixGroup
objectClass: top
cn: groupAbc
gidNumber: 1001
maildrop: groupabc@domain.tld
memberUid: john-doe
memberUid: jane-doe

Here is my

# cat /etc/postfix/
server_host =
version = 3
bind = yes
bind_dn = cn=ldap-reader,dc=domain,dc=tld
bind_pw = SECRET
search_base = dc=domain,dc=tld
query_filter = (&(objectClass=posixGroup)(mail=%s))
result_attribute = mail
special_result_attribute = memberUid
leaf_result_attribute = mail

When I try to send an e-mail to I get the following errors in syslog:

... postfix/cleanup[6601]: warning: dict_ldap_get_values[1]: search error 34: Invalid DN syntax
... postfix/cleanup[6601]: warning: dict_ldap_lookup: Had some trouble with entries returned by search: Invalid DN syntax
... postfix/cleanup[6601]: warning: 40ACF12106E: virtual_alias_maps map lookup problem for groupabc@domain.tld

Postfix is excepting a DN in the attribute I defined with special_result_attribute parameter. If I change the memberUid from "john-doe" to "uid=john-doe,ou=Users,dc=domain,dc=tld", e-mails sent to "groupabc@domain.tld" are delivered to john-doe's e-mail address.

I'm looking for a way to make Postfix do an LDAP search of the UID stored in memberUid attribute. I know it's possible on Zarafa's postfix flavour ( with options ldap_groupmembers_attribute, ldap_groupmembers_attribute_type and ldap_groupmembers_relation_attribute but can't find how to do it properly on standard Postfix.

share|improve this question
I didn't see the mail attribute in your ldif file. – quanta Jun 8 '12 at 6:26

Your ldap config is wrong. Please use:

server_host =
version = 3
bind = no
query_filter = (&(objectClass=posixGroup)(maildrop=%s))
result_attribute = memberUid, mail

You can't use "bind = yes" here - this can't work. No group can/should bind (authenticate).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.