Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I administer a server (Ubuntu 12.04 LTS) running a web server and a mail server - The web server is running all fine, but the mail server is a problem. I have Dovecot installed and configured correctly - i can connect to it with Thunderbird (my client is in another network, so it is no internal network) and see all folders etc. Mail from external is also received.

Postfix smtp authentication seems to work (using STARTTLS), as i can write emails from Thunderbird in external network to localhost and the domain of the server. But when I try to send an email to another address, for example to gmail, i get the following error:

An error occurred while sending mail. The mail server responded:  5.7.1 <***@gmail.com>:
Relay access denied. Please check the message recipient ***@gmail.com and try again.

I use a smtp relay on the postfix itself, when i log in with ssh I can write emails. I think the problem is somewhere here - does smtp connections to postfix also use this configured relay?

Here is my main.cf: (hostnames, domains etc. replaced by fictional data)

# See /usr/share/postfix/main.cf.dist for a commented, more complete version
# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = mydomain.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = mydomain.com, localhost, myhostname
relayhost = smtp.myrelayhoster.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all



smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noplaintext noanonymous
smtp_sasl_password_maps = hash:/etc/postfix/sasl_password

sender_canonical_maps = hash:/etc/postfix/sender_canonical

As said, basic smtp auth seems to be working - does the relay need to be configured for smtp seperately?

These are the important lines of the /var/log/mail.log:

Sep  5 09:19:21 myhostname postfix/smtpd[9086]: connect from isp-ip.net[123.456.789.123]
Sep  5 09:19:22 myhostname postfix/smtpd[9086]: NOQUEUE: reject: RCPT from isp-ip.net[123.456.789.123]: 554 5.7.1 <example@gmail.com>: Relay access denied; from=<user@mydomain.com> to=<example@gmail.com> proto=ESMTP helo=<thunderbird>
Sep  5 09:19:22 myhostname postfix/smtpd[9086]: disconnect from isp-ip.net[123.456.789.123]
share|improve this question
    
What is in your mailserverlogs (usually /var/log/mail.log) for the failed attempt? –  Jenny D Sep 5 '13 at 7:32
    
see edited question –  PDev Sep 5 '13 at 7:42
1  
It would help if you would not obfuscate all names with "***". To protect your privacy, just make up imaginary or better descriptive names ("myhostname", "remotemailserver1", ...) and replace them consistently. That way it is easier to read and follow the flow of the logic. –  Isaac Sep 5 '13 at 8:01
    
And just guessing: is your relayhost accepting mails from your server in general? You could connect to the relayhost form your server via telnet and do smtp by hand (e.g. like yuki-onna.co.uk/email/smtp.html) to test this. –  Isaac Sep 5 '13 at 8:04
    
okay, wait a second - i will replace *** the smtp relay is accepting mails from my server - when i use the mail command i can write mails to external and php can also write mails. –  PDev Sep 5 '13 at 8:18

1 Answer 1

Sep  5 09:19:22 myhostname postfix/smtpd[9086]: NOQUEUE: reject: RCPT from isp-ip.net[123.456.789.123]: 554 5.7.1 <example@gmail.com>: Relay access denied; from=<user@mydomain.com> to=<example@gmail.com> proto=ESMTP helo=<thunderbird>

Try to emulate smtp session via telnet and add the output to the question. Also you can use swaks, it's just a perl script

# swaks -s isp-ip.net --helo thunderbird --to example@gmail.com --from user@mydomain.com --auth PLAIN --auth-user user@mydomain.com --auth-password 7654321 --auth-hide-password

Host did not advertise authentication

it seems that relay host doesn't support authentication. May be it does, but only over encrypted channel. Try to use 465/587 ports instead, for e.g.

# swaks -s isp-ip.net -tlsc -p 465 --helo thunderbird --to example@gmail.com --from user@mydomain.com --auth PLAIN --auth-user user@mydomain.com --auth-password 7654321 --auth-hide-password

# swaks -s isp-ip.net -tls -p 587 --helo thunderbird --to example@gmail.com --from user@mydomain.com --auth PLAIN --auth-user user@mydomain.com --auth-password 7654321 --auth-hide-password
share|improve this answer
    
Thanks for your answer! Here the output of your swaks-command with my data === Trying smtp.myhostname.com:25... === Connected to smtp.myhostname.com. <- 220 myhostname.com ESMTP Postfix (Ubuntu) -> EHLO thunderbird <- 250-myhostname.com <- 250-PIPELINING <- 250-SIZE 10240000 <- 250-VRFY <- 250-ETRN <- 250-STARTTLS <- 250-ENHANCEDSTATUSCODES <- 250-8BITMIME <- 250 DSN *** Host did not advertise authentication -> QUIT <- 221 2.0.0 Bye === Connection closed with remote host. –  PDev Sep 5 '13 at 14:41
    
It is not even able to connect: === Trying smtp.mydomain.com:587... *** Error connecting to smtp.mydomain.com:587: *** IO::Socket::INET6: connect: Connection refused The same also with the other port –  PDev Sep 5 '13 at 17:26
    
So you must contact with your ISP and clarify details about smtp settings –  ALex_hha Sep 5 '13 at 18:37
    
To avoid misunderstandings: I used swaks for my own server - did you wanted me to to it by my relay provider? –  PDev Sep 5 '13 at 20:06
    
Of course you should specify ip of the isp relay host –  ALex_hha Sep 5 '13 at 20:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.