Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've set up a mail server according to this guide.

When I telnet 25 and use the AUTH command it returns:

Error: authentication not enabled

Trying to login via outlook returns an unknown error and when I send an e-mail to an adress I get an relay access denied error.

However, mxtoolbox tells me everything is set up ok.

share|improve this question

closed as off-topic by 84104, masegaloeh, mdpc, Sam, HBruijn May 10 '15 at 5:46

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

If you have checked through the linked document and are sure you have followed it correctly then you should contact it's author and help them correct it. – Iain Dec 15 '13 at 19:21

As you don't see anything in your postfix log, at least postfix must be configured incorrectly.

First, confirm that Dovecot is configured (in dovecot.conf) with something like:

auth default {
    mechanisms = plain login
    passdb pam {
    userdb passwd {
    user = root
    socket listen {
      client {
        path = /var/spool/postfix/private/auth
        mode = 0660
        user = postfix
        group = postfix

Confirm the following in your postfix

smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sender_restrictions = permit_sasl_authenticated`

and in, make sure that your submission port offers the SASL service. You can put this in your smtp service for auth on port 25, but this is unusual. You should also put it in your smtps service for encrypted access:

submission inet n - - - - smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_sasl_security_options=noanonymous
  -o smtpd_sasl_local_domain=$myhostname
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_sender_restrictions=reject_sender_login_mismatch
  -o smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject
share|improve this answer

There are two different things.

1: SSL/TLS support

2: authentication

The are independent, i.e. it is possible to have one of them, and missing the other. Of course it is much better, if authentication happens only over an already encrypted channel.

Probably your postfix haven't the second (the auth), only the TLS.

Authentication on postfix happends through the sasl authentication daemon, which also needs to be configured.

mxtoolbox says everything is O.K., because it doesn't check the auth, only the encryption.

share|improve this answer
I'm using dovecots tls support and smtp_sasl_auth_enable = yes in the postfix config – Frank Astin Dec 15 '13 at 18:18
And this: smtpd_sasl_path = smtpd? – peterh Dec 15 '13 at 18:21
it's set to smtpd_sasl_path = private/auth – Frank Astin Dec 15 '13 at 18:23
How do I debug this? I can't find anything in the mail log. – Frank Astin Dec 15 '13 at 18:28
Then you need to debug, what happens between sasl and postfix. Last time I did this, it wasn't simple. First you need be sure, that sasl is ok. You said, you have a dovecot, and that it works, thus it is probable. Sasl is communicating with dovecot through a unix pipe, so you need strace them, watching what they communicate through this pipe, and also checking the sasld log. – peterh Dec 15 '13 at 18:28

You may has added smtpd_tls_auth_only=yes onto your ?

This option enables that authentication occurs only after tls is set up.

Therefore if you telnet to your smtp port then issue a auth command you will get that not enabled error since it is still not tls connection yet at that time.

share|improve this answer

You're using the wrong port.

Authenticated outgoing email is on port 587, not port 25.

share|improve this answer
I don't get anything when I try to telnet to 587 . – Frank Astin Dec 15 '13 at 18:39
Then you have seriously screwed up your configuration somehow. Post your and check your firewall. – Michael Hampton Dec 15 '13 at 19:25
Authenticated outgoing email can be done on port 25, it's just quite common to only do it on the submission port which is 587. But there is no RFC or other requirement to have it only on port 25. – Quetza Dec 16 '13 at 1:05
Yes, everything can be done on port 25 after a STARTTLS command, just as on port 587. There is a third port number, it is 467(?), on this only SSL communication can go. It is effectively the SMTP version of HTTPS. But these port numbers are about encryption, and not about authentication. Authentication can be done on SMTP many years ago, and it can happen over encrypted and just as on unencrypted channel. It is only our wish, that we (as sysadms) don't want authentication on unencrypted channel because security, theoretically it were possible. – peterh Dec 20 '13 at 12:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.