Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In 2008 I set up a simple mail server (running ubuntu 8.04 LTS) to allow local automation controllers to send email alarms without limits. I used to use gmx, but found that if an account had a ton of alarms, which indicates a problem, that gmx would block it. I set up postfix and got it working. I then needed to be able to allow this type of controller to send alarms from remote sites. I set up firewall rules to my static IP address and all is well.

Now, I have installed a new server, running ubuntu 12.04, doing the exact same thing as before. Local controllers can connect to the server and send emails just fine. However, when the remote controllers try to connect, I see the following in /var/log/mail.log :

Aug 23 16:21:24 localhost postfix/smtpd[6709]: NOQUEUE: reject: RCPT from unknown[xx.xx.xx.xx]: 554 5.7.1 : Relay access denied; from= to= proto=ESMTP helo=

I found that editing a particular line in /etc/postfix/ allows individual remote IP addresses to connect and send mail:

mynetworks =,,xx.xx.xx.xx/32

where xx.xx.xx.xx is the static IP address of the remote location. I compared configuration files between the old server and the new server, and they're basically identical. Does anyone know how to get it to work like it did before?

share|improve this question
Do you just list the static IP (xx.xx.xx.xx) for mynetworks, or is it xx.xx.xx.xx/32 (notice the /32)? – KJ-SRS Aug 24 '12 at 18:25
I do have the cidr notation for the extra network. when I xx'd it out I deleted the /32. – senorsmile Aug 24 '12 at 19:44

"Basically the same" is not the same as "the same." :)

You need to list the authorized IP addresses in mynetworks and tell Postfix to authorize them:

smtpd_recipient_restrictions =
share|improve this answer
What I mean by basically the same is that there seem to be some default options that I had never touched in both versions that didn't appear in the other. So, while I didn't have to specify authorized remote public I.P. addresses in postfix on Ubuntu 8.04, I do now have to do that on 12.04? What if the remote client doesn't have a static Public I.P. address? – senorsmile Aug 24 '12 at 20:19

Check the virtual file for postfix.

#            virtual-alias.domain     anything (right-hand content does not matter)
#            postmaster@virtual-alias.domain  postmaster
#            user1@virtual-alias.domain       address1
#            user2@virtual-alias.domain       address2, address3
#        The  virtual-alias.domain anything entry is required for a
#        virtual alias domain. Without this entry, mail is rejected
#        with  "relay  access  denied", or bounces with "mail loops
#        back to myself".
share|improve this answer
I added the file /etc/postfix/virtual. I tried setting it up with the line virtual-alias.domain anything, as well as with a specific, where that name actually resolves to something in our public DNS records. Same error each time. – senorsmile Aug 24 '12 at 20:00
up vote 0 down vote accepted

So, to fix the problem, SASL had to be set up properly along with the certs. I followed this guide almost exactly and got everything working:

What threw me off is that I didn't need it on 8.04. Clearly a security upgrade in postfix.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.