Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're using Postfix with Dovecot and SASL Auth via Dovecot (based on this tutorial). All works like expected. But when Dovecot is down (i.e. for maintenance or other reasons) then clients could not authenticate at Postfix and Postfix rejects client requests because of smtpd_recipient_restrictions that follow after permit_sasl_authenticated.

Is there a ways to temporarily reject mails arriving at Postfix when Dovecot auth is down? Our postfix conf is:

smtpd_restriction_classes = check_sender_auth
check_sender_auth =
smtpd_recipient_restrictions =
   check_sender_access mysql:/etc/postfix/check_sender_domains,

check_sender_domains is a lookup table which return check_sender_auth for sender address claiming to be from us.

share|improve this question
up vote 5 down vote accepted

You could change the reject_code for your submission listener to 450, so it is not a permanent reject but a defer.

check_sender_auth =

See for details.

Unfortunately, this is not simple to update when "dovecot goes down", which I admit has me puzzled; why does dovecot go down ?

If you experience outages due to dovecot maintenance, you should invest effort into not needing maintenance outages on dovecot.

Dovecot can run HA quite well; you could trivially run a secondary instance only for SASL (no IMAP services) on another box.

share|improve this answer
when asking my question, I just realized, that it has to do something with reject after permit_sasl_authenticated. I like the 5xx reject, because senders claiming to be from us would be rejected the hard way. But I believe you're right. I'll give a try to a 4xx code and give feedback – rabudde Jul 26 '12 at 13:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.