Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We're having a situation where inbound emails from a specific company to legitimate recipients are bouncing with "Recipient address rejected: Access denied":

Aug 23 09:15:27 extranet postfix/smtpd[20228]: NOQUEUE: reject: RCPT from sender.com[]: 554 5.7.1 <user@example.com>: Recipient address rejected: Access denied; from=<user@sender.com> to=<user@example.com> proto=ESMTP helo=<mg01d1.sender.com>

postconf -d | grep mail_version

mail_version = 2.7.1

postconf -n

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
allow_percent_hack = no
allow_untrusted_routing = yes
append_dot_mydomain = no
biff = no
bounce_queue_lifetime = 24h
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
content_filter = smtp-amavis:[]:10024
delay_warning_time = 4h
disable_vrfy_command = yes
html_directory = /usr/share/doc/postfix/html
inet_interfaces = all
mailbox_size_limit = 0
maximal_queue_lifetime = 24h
mydestination = mail.example.com, extranet.example.com, localhost
myhostname = mail.example.com
mynetworks = [::ffff:]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = /usr/share/doc/postfix
recipient_delimiter = +
relay_domains = $mydestination
relayhost = 
smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_data_restrictions = reject_unauth_pipelining, permit
smtpd_helo_required = yes
smtpd_recipient_restrictions = reject_non_fqdn_recipient, permit_mynetworks, reject_unauth_destination, check_recipient_access hash:/etc/postfix/access,    reject_non_fqdn_sender, check_sender_access hash:/etc/postfix/sender_access,    reject_non_fqdn_hostname, reject_invalid_hostname, check_helo_access hash:/etc/postfix/helo_access, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, permit
smtpd_sasl_auth_enable = no
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/certs/mail.example.com.2013.chain.pem
smtpd_tls_key_file = /etc/ssl/private/example.2013.key
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache
smtpd_use_tls = no
virtual_alias_domains = example.co.uk, example.co
virtual_alias_maps = hash:/etc/postfix/virtual, ldap:/etc/postfix/ldap_virtual_alias_maps.cf, ldap:/etc/postfix/ldap_virtual_groups.cf
virtual_mailbox_domains = ldap:/etc/postfix/ldap_virtual_domains.cf
virtual_mailbox_maps = ldap:/etc/postfix/ldap_virtual_mailbox_maps.cf
virtual_transport = dovecot

Now, we only use smtpd_recipient_restrictions because we're pretty particular about the order of client, helo, recipient restrictions being applied. But, by my (obviously limited) understanding, the only directive in there that should be generating that error is the check_recipient_access hash:/etc/postfix/access directive, but that file is only used to block some commonly spammed addresses at one of our virtual alias domains:

postmaster@example.com.au   REJECT Recipient address rejected. This domain name is only an alias. Please email postmaster @ the primary domain or the mail server hostname.
abuse@example.com.au        REJECT Recipient address rejected. This domain name is only an alias. Please email abuse @ the primary domain or the mail server hostname.
support@example.com.au  REJECT Recipient address rejected. This domain name is only an alias. Please email support @ the primary domain or the mail server hostname.

/etc/postfix/sender_access is empty (lying in wait) and helo_access only contains:

extranet.example.com        REJECT You are not me
www.example.com     REJECT You are not me
mail.example.com        REJECT You are not me

All of the other directives seem to be correctly fulfilled, or I would at least be expecting a different error, like Helo command rejected, User unknown in virtual mailbox table, Service unavailable; Client host [] blocked using zen.spamhaus.org, etc.

Where should I be looking next to see why I'm getting "Recipient address rejected: Access denied"? Would any of those other directives in smtpd_recipient_restrictions issue that error in the case of failure?

share|improve this question
Might be an idea to check that you've run postmap on all hash tables referred to in your configuration and then reload postfix, and test it again. –  Aaron Tate Aug 23 '13 at 1:24
"We're having a situation where inbound emails from a specific company to legitimate recipients are bouncing with "Recipient address rejected: Access denied":" Do you get the error for all legitimate mailboxes in your domain?or only some from that domain? –  Danila Ladner Aug 23 '13 at 2:02
After a certain date, no messages from this sender's company have been successfully delivered to any of the local users. –  jaydisc Aug 23 '13 at 5:30
check_sender_access and check_helo_access could also give 554 code. –  Laurentiu Roescu Aug 23 '13 at 6:50
sender_access is empty, and helo_access is not related. Regardless, tests against helo generate a clearly different log error (Helo command rejected vs Recipient address rejected). What else would generate Recipient address rejected? –  jaydisc Aug 23 '13 at 7:36

2 Answers 2

You are receiving mail addressed to a user @example.com but you haven't configured Postfix for this domain! In your virtual_alias_domains only example.co.uk and example.co are present. Thus Postfix thinks it is not supposed to accept mail for this domain and treats it as a relay situation (which of course is denied).

share|improve this answer
example.com is not a virtual_alias_domain. It is defined in virtual_mailbox_domains. The domains in virtual_alias_domains are literally just that… alias domains. In /etc/postfix/virtual, they are mapped to virtual_mailbox_domains with: @example.co.uk @example.com. –  jaydisc Aug 23 '13 at 23:26
But I stress again, that would not yield a Recipient address rejected: access denied error, would it? Wouldn't it be more like Relay access denied? –  jaydisc Aug 23 '13 at 23:30
up vote 0 down vote accepted

The sending mail server was sending mail on port 465 for some reason, which was invoking a different set of smtpd_recipient_restrictions, the much simpler:

smtps     inet  n       -       -       -       -       smtpd
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o broken_sasl_auth_clients=yes
  -o content_filter=
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

Naturally, their SMTP server was not authenticating, so the Recipient Address was rejected with Access Denied.

Should I be accepting unauthenticated local delivery over 465? I certainly didn't think so.

share|improve this answer
No, delivery on port 587 must always be authenticated. –  Michael Hampton Aug 23 '13 at 23:54
What about 465? I was initially wrong. It was 465 instead of 587. –  jaydisc Aug 24 '13 at 3:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.