Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This morning, in order to correct a problem with a name mismatch in the security certificate, I followed the recommended steps from How to fix mail server SSL?, but now, when attempting to send an email from a client (in this case the client is Windows Mail), I receive the following error.

The rejected e-mail address was ''. Subject 'This is a test. ', Account: '', Server: '', Protocol: SMTP, Server Response: '554 5.7.1 : Relay access denied', Port: 25, Secure(SSL): No, Server Error: 554, Error Number: 0x800CCC79

Edit: I can still retrieve emails from this account, and I send emails to other accounts at the same domain. I just can't send emails to recipients outside of our domain.

I tried disabling TLS altogether but no dice, I still get the same error.

When I check file mail.log, I see the following.

Jul 18 08:24:41 company imapd: LOGIN,, ip=[::ffff:], protocol=IMAP
Jul 18 08:24:42 company imapd: DISCONNECTED,, ip=[::ffff:], headers=0, body=0, rcvd=83, sent=409, time=1
Jul 18 08:25:19 company postfix/smtpd[29282]: connect from[]
Jul 18 08:25:19 company postfix/smtpd[29282]: NOQUEUE: reject: RCPT from[]: 554 5.7.1 <>: Relay access denied; from=<> to=<> proto=ESMTP helo=<UserPC>
Jul 18 08:25:19 company postfix/smtpd[29282]: disconnect from[]
Jul 18 08:25:22 company imapd: DISCONNECTED,, ip=[::ffff:], headers=13, body=142579, rcvd=3289, sent=215892, time=79

File looks like this:

# Postfix MTA Manager Main Configuration File;
# Please do NOT edit this file manually;

# Postfix directory settings; These are critical for normal Postfix MTA functionallity;

command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
program_directory = /usr/lib/postfix

# Some common configuration parameters;

inet_interfaces = all
mynetworks =
mynetworks_style = host

myhostname =
mydomain =
myorigin = $mydomain

smtpd_banner = $myhostname ESMTP (Debian/GNU)
setgid_group = postdrop

# Receiving messages parameters;

mydestination = localhost, company 
append_dot_mydomain = no
append_at_myorigin = yes
transport_maps = mysql:/etc/postfix/

# Delivering local messages parameters;

mail_spool_directory = /var/spool/mail
mailbox_size_limit = 0
mailbox_command = procmail -a "$EXTENSION"

biff = no

alias_database = hash:/etc/aliases

local_recipient_maps =

# Delivering virtual messages parameters;

# SASL paramters;
smtp_use_tls = yes
smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s

smtp_tls_CAfile = /etc/postfix/ssl/smptd.pem
smtp_tls_cert_file = /etc/postfix/ssl/smptd.crt
smtp_tls_key_file = /etc/postfix/ssl/smptd.key

smtpd_tls_CAfile = /etc/postfix/ssl/smptd.pem
smtpd_tls_cert_file = /etc/postfix/ssl/smptd.crt
smtpd_tls_key_file = /etc/postfix/ssl/smptd.key

smtpd_sasl_auth_enable = yes

smtpd_sasl_security_options = noanonymous

smtpd_sasl_local_domain =

broken_sasl_auth_clients = yes

smtpd_sender_restrictions =

smtpd_recipient_restrictions =
        check_recipient_access hash:/etc/postfix/filtered_domains

As a side note, my employer wants to be able to send emails from clients (Thunderbird and Outlook) both from within our local network and outside it.

share|improve this question
Why you no accept? –  Rook Oct 9 '14 at 2:03

5 Answers 5

TLS just enables encryption on the smtp session and doesn't directly affect whether or not Postfix will be allowed to relay a message.

The relaying denied message occurs because the smtpd_recipient_restrictions rules was not matched. One of those conditions must be fulfilled to allow the message to go through:

smtpd_recipient_restrictions =
    check_recipient_access hash:/etc/postfix/filtered_domains

To explain those rules:


permits authenticated senders through SASL. This will be necessary to authenticate users outside of your network which are normally blocked.


This will cause postfix to look in /etc/postfix/filtered_domains for rules based on the recipient address. (Judging by the file name on the file name, it is probably just blocking specific domains... Check to see if is listed in there?)


This will permit hosts by IP address that match IP ranges specified in $mynetworks. In the you posted, $mynetworks was set to, so it will only relay emails generated by the server itself.

Based on that configuration, your mail client will need to use SMTP Authentication before being allowed to relay messages. I'm not sure what database SASL is using. That is specified in /usr/lib/sasl2/smtpd.conf Presumably it also uses the same database as your virtual mailboxes, so you should be able enable SMTP authentication in your mail client and be all set.

share|improve this answer
smtpd_use_tls = no

You've disabled TLS, so you now need to authorise your local network by adding it to mynetworks. For example,

mynetworks =

This will fix sending from your local network only. For sending email from outside your local network, you'll need to get TLS authentication working.

share|improve this answer
I've set smtpd_use_tls = yes because we have to be able to send email from outside the network. However, the problem persists. –  Noah Goodrich Jul 18 '09 at 15:50
Bump smtpd_tls_loglevel up to 3 and see if anything interesting shows up in the logs (and remember to drop it back down to 1 or 0 when you're finished). –  pgs Jul 18 '09 at 16:16
Also, try setting smtp_use_tls to no (for sending external email). See –  pgs Jul 18 '09 at 16:22
-1 because not everyone can disable tls. –  jgifford25 Oct 30 '11 at 23:02
I'm not saying that he should disable tls; I'm saying that since he has already disabled it he then needs to setup mynetworks. And that the full solution is to get tls working again. –  pgs Nov 7 '11 at 3:17

I think you miss you in mydestination, because the default relay_domains=$mydestination, so you you can append you configuration the line:

mydestinations = $mydomain, $myhostname, localhost, localhost.localdomain

or: relay_domains = $mydomain

Dont forget to restart the postfix sever (service postfix restart) every time you edit postfix conf file

share|improve this answer
+ 1 for adding "localhost, localhost.localdomain" to the list of hosts (often a problem on some systems, not clear why it's not an issue on others though) –  Iain Collins May 23 '11 at 4:40

This problem was bugging me for a while. I was trying to connect from to

Here's how I fixed this -

mydomain =
myhostname = $mydomain
virtual_alias_maps = hash:/etc/postfix/virtual
alias_database = hash:/etc/postfix/virtual
myorigin = /etc/mailname
mydestination = localhost.localdomain localhost $mydomain
relayhost =
mynetworks = [::ffff:]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

You also need to make sure that you have set /etc/hosts and /etc/hostname properly and make sure that you run the following after networking changes -

sudo service networking restart

and the following after postfix configuration changes

sudo service postfix reload
share|improve this answer

I had the same issue in Outlook (with dovecote and postfix backend) and I spent two days looking for solution and tweaking my config files. All I needed to do was check "Server requires authentication" in the Outgoing tab in mail settings in outlook and my messages are now sent to gmail. See detailed instruction on how to find the setting here

share|improve this answer

protected by TheCleaner Dec 23 '14 at 14:00

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.