Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am configuring a Postfix install on Ubuntu Server 12.04 to forward a small volume of mail from a specific address on the server to a specific address at another domain.

$ pwd

$ cat 
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

append_dot_mydomain = no
readme_directory = no

smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

myhostname = awsBeta
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = awsBeta, localhost.localdomain, , localhost,
relayhost = 
mynetworks = [::ffff:]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

virtual_mailbox_domains =
virtual_mailbox_base = /var/mail/vhosts
virtual_mailbox_maps = hash:/etc/postfix/vmailbox
virtual_minimum_uid = 100
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000

virtual_alias_domains =
virtual_alias_maps = hash:/etc/postfix/virtual

$ cat virtual


When I log into the PHP CLI interpreter on the server to send mail, the mail is properly delivered to Note that the is a Google Apps domain, the MX records are hosted at Google.

$ php -a
Interactive shell

php > mail('','Subject','tMessage', 'From: <>');

I can see the mail has arrived in the inbox. This tells me that the forwarder works. Now I try from my desktop's telnet prompt:

$ telnet 25
Trying x.x.x.x...
Connected to
Escape character is '^]'.
220 someHostname ESMTP Postfix (Ubuntu)
250-SIZE 10240000
250 DSN
250 2.1.0 Ok
250 2.1.5 Ok
354 End data with <CR><LF>.<CR><LF>
SUBJECT: Hi, telnet!

This is a second attempt! 
250 2.0.0 Ok: queued as 9851E81579
221 2.0.0 Bye
Connection closed by foreign host.

This mail is not delivered, and I find the following in the postfix logs:

Jul  4 16:02:58 someHostname postfix/smtp[24898]: connect to[2607:f8b0:400c:c03::1b]:25: Network is unreachable
Jul  4 16:02:58 someHostname postfix/smtp[24898]: 935BC81579: to=<>, orig_to=<>,[]:25, delay=15, delays=15/0.02/0.08/0.15, dsn=2.0.0, status=sent (250 2.0.0 OK 1372953778 d3si1064427vck.0 - gsmtp)

That looks like Google got the mail, but decided (probably due to SPF) not to deliver it. It is not in my Spam folder either! Lastly, I try to simply email the domain from an unrelated Hotmail account. This email is not delivered either, but nothing is in the Postfix logs.

For completeness sake, here is the anomitized MX record:

$ dig mx        1800    IN      MX      10

$ dig a
mail.someDomain.   1790    IN      A       x.x.x.x

I can confirm that x.x.x.x is in fact the correct IP address for the server, and it is the same address to which I had done telnet.

Why might the emails from legitimate email accounts (such as the hotmail account) not be delivered to the account?

share|improve this question
If Google received the mail but dropped it on the floor, then you need to take up the matter with them. P.S. your IPv6 connectivity is broken and you should yell at your service provider. – Michael Hampton Jul 4 '13 at 20:10
Thank you Michael. I think that Google did the right thing by dropping the mail on the floor which obviously did not come from an authorized SPF IP address. My question is why aren't emails coming in from legitimate email providers being forwarded. Note that there isn't even a message in the Postfix logs showing that the mail was ever received by the server. – dotancohen Jul 5 '13 at 7:29
The service provider is Amazon Web Services. I do wonder why they don't support IPv6. – dotancohen Jul 5 '13 at 7:31
possible duplicate of ISP blocking port 25 – Jenny D Jul 5 '13 at 12:35
@JennyD Doesn't look like it. – Michael Hampton Jul 5 '13 at 19:00
up vote 2 down vote accepted

This line:

Jul  4 16:02:58 someHostname postfix/smtp[24898]: connect to[2607:f8b0:400c:c03::1b]:25: Network is unreachable

implies that there is an ipv6 routing issue between your SMTP server you telnetted to and 2607:f8b0:400c:c03::1b over at Google. A firewall can certainly report that ICMP message too as a way of blocking a packet, but try pinging it. It's possible for instance that you might have partial or intermittent ipv6 routing going on. If you find you can only ping it sometimes or you can't ping it at all and the reply consistently tells you there is no route, your upstream ISP (or whoever is providing you IPv6 routing) needs to fix their routing issue.

It is also possible that port 25 blocking is going on. This is extremely common; if you are using hurricane electric for IPv6 connectivity, they block port 25 outgoing unless you specifically request it be allowed; this is the case with most ISPs (because without it being the case, spammers flock to them and restrictive policies that don't favour them start popping up everywhere as they get a reputation as a spam haven).

This issue is not caused by SPF or DKIM or content-based spam filtering; it is a network problem.

share|improve this answer
Thank you. The problem was in fact that port 2 was blocked. – dotancohen Jul 7 '13 at 5:44

The problem was that port 25 was firewalled off! My local IP address (where I sit) had all ports open for it, so I could telnet in. Hotmail and other legitimate email providers did not have port 25 access, therefore there was nothing left in the log files!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.