Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been at this for a couple of hours, and apparently I am missing something in newer postfix versions. I have the server set up, and it works locally but when I try to send from a remote network through the submission port, I always get "Relay access denied". I have manually checked that sasl auth and tls are both working properly.

Here is my main.cf: queue_directory = /var/spool/postfix

command_directory = /usr/sbin

daemon_directory = /usr/libexec/postfix

data_directory = /var/lib/postfix
mail_owner = postfix
default_privs = nobody
myhostname = host.mydomain.com
mydomain = mydomain.com
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
local_recipient_maps = unix:passwd.byname $alias_maps

unknown_local_recipient_reject_code = 550
mynetworks_style = class
mynetworks = 127.0.0.0/8, [::ffff:127.0.0.0]/104 [::1]/128
relay_domains = $mydestination
in_flow_delay = 1s
alias_maps = hash:/etc/mail/aliases
alias_database = $alias_maps
mailbox_command = /usr/libexec/dovecot/dovecot-lda -d "$USER"
fast_flush_domains = $relay_domains

sendmail_path = /usr/sbin/sendmail
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop

inet_protocols = ipv4 ipv6
mailbox_size_limit = 0

disable_vrfy_command = yes

smtpd_helo_required = yes

smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_authenticated_header = yes

smtpd_use_tls = yes
smtpd_tls_auth_only = yes

smtpd_tls_loglevel = 1
smtpd_tls_key_file = /etc/ssl/postfix/server.key
smtpd_tls_cert_file = /etc/ssl/postfix/server.pem

bounce_queue_lifetime = 2d

smtpd_client_restrictions =
    permit

smtpd_helo_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    warn_if_reject reject_non_fqdn_hostname,
    reject_invalid_hostname,
    permit

smtpd_sender_restrictions = 
    permit_mynetworks,
    permit_sasl_authenticated,
    warn_if_reject reject_non_fqdn_sender,
    reject_unknown_sender_domain,
    reject_unauth_pipelining,
    permit

smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination,
    reject_non_fqdn_recipient,
    reject_unknown_sender_domain,
    reject_unknown_recipient_domain

smtpd_data_restrictions =
    reject_unauth_pipelining

mua_client_restrictions = 
    permit_sasl_authenticated,
    permit

mua_helo_restrictions = 
    permit

mua_sender_restrictions =
    permit

And my master.cf:

smtp      inet  n       -       n       -       -       smtpd
submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_client_restrictions=$mua_client_restrictions
  -o smtpd_helo_restrictions=$mua_helo_restrictions
  -o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
smtps     inet  n       -       n       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_client_restrictions=$mua_client_restrictions
  -o smtpd_helo_restrictions=$mua_helo_restrictions
  -o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
pickup    unix  n       -       n       60      1       pickup
cleanup   unix  n       -       n       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
rewrite   unix  -       -       n       -       -       trivial-rewrite
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce
verify    unix  -       -       n       -       1       verify
flush     unix  n       -       n       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       n       -       -       smtp
relay     unix  -       -       n       -       -       smtp
showq     unix  n       -       n       -       -       showq
error     unix  -       -       n       -       -       error
retry     unix  -       -       n       -       -       error
discard   unix  -       -       n       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
scache    unix  -       -       n       -       1       scache

And finally the output of dovecot -n:

auth_mechanisms = plain login
hostname = mail.mydomain.com
mail_location = mdbox:~/mdbox
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix = 
}
passdb {
  args = failure_show_msg=yes
  driver = pam
}
plugin {
  quota = fs:User quota:user
  quota_warning2 = storage=80%% quota-warning 80 %u
  sieve = ~/.dovecot.sieve
  sieve_dir = ~/sieve
}
postmaster_address = postmaster@mydomain.com
protocols = imap sieve
quota_full_tempfail = yes
service anvil {
  client_limit = 1024
}
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0660
    user = postfix
  }
  unix_listener auth-userdb {
    mode = 0666
  }
}
service managesieve-login {
  inet_listener sieve {
    port = 4190
  }
}
ssl_cert = </etc/ssl/dovecot/server.pem
ssl_key = </etc/ssl/dovecot/server.key
userdb {
  args = blocking=yes
  driver = passwd
}
verbose_proctitle = yes
protocol lda {
  mail_plugins = sieve quota
}
protocol imap {
  mail_max_userip_connections = 10
  mail_plugins = " quota imap_quota acl"
}
protocol sieve {
  mail_max_userip_connections = 10
}
share|improve this question

1 Answer 1

Take a look at this: http://postfix.1071664.n5.nabble.com/Auth-relaying-issues-with-2-10-0-td58648.html

I recently got bitten by that.

share|improve this answer
2  
Link-only answers are not encouraged. We prefer you to summarise the essence of the answer here in case the link goes dead as well as providing the link for greater detail. –  Ladadadada Jun 28 '13 at 17:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.