Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm having issues sending mail from postfix. I believe my conf. is very standard, at the end it was put together from various guides. I'm trying to send mail from remote client (iOS Mail, and Mac OS X Mail.app, Thunderbird on Linux). From iOS Mail it works ok, it does not for Mail.app and Thunderbird. I'm using SASL authentication (dovecot), and TLS, configuration below along with log message.

Error:

Jan 05 12:27:41 svali postfix/smtpd[26448]: NOQUEUE: reject: RCPT from aaa.chello.sk[89.173.206.108]: 553 5.7.1 <xxx>: Sender address rejected: not owned by user xxx; from=<xxx> to=<yyy> proto=ESMTP helo=<[10.0.2.4]>
Jan 05 12:27:41 svali postfix/smtpd[26448]: disconnect from aaa.chello.sk[89.173.206.108]
Jan 05 12:31:01 svali postfix/anvil[26450]: statistics: max connection rate 2/60s for (submission:89.173.206.108) at Jan  5 12:24:33

When it works (iOS Mail app)

Jan 05 12:45:23 svali postfix/smtpd[26807]: connect from aaa.chello.sk[89.173.206.108]
Jan 05 12:45:24 svali postfix/smtpd[26807]: 1328056578: client=aaa.chello.sk[89.173.206.108], sasl_method=PLAIN, sasl_username=xxx
Jan 05 12:45:24 svali postfix/cleanup[26821]: 1328056578: message-id=<42EC179A-DE92-4526-9F0E-DA3B5EF76B80@aaa>
Jan 05 12:45:24 svali postfix/qmgr[2599]: 1328056578: from=<xxx>, size=650, nrcpt=1 (queue active)
Jan 05 12:45:24 svali postfix/smtp[26824]: 1328056578: to=<yyy>, relay=gmail-smtp-in.l.google.com[2a00:1450:400c:c05::1a]:25, delay=0.71, delays=0.17/0.01/0.04/0.49, dsn=2.0.0, status=sent (250 2.0.0 OK 1388925924 f3si3608555wik.58 - gsmtp)
Jan 05 12:45:24 svali postfix/qmgr[2599]: 1328056578: removed
Jan 05 12:45:26 svali postfix/smtpd[26827]: connect from mail-qe0-f42.google.com[209.85.128.42]
Jan 05 12:45:27 svali postfix/smtpd[26827]: 28DA856578: client=mail-qe0-f42.google.com[209.85.128.42]
Jan 05 12:45:27 svali postfix/cleanup[26821]: 28DA856578: message-id=<42EC179A-DE92-4526-9F0E-DA3B5EF76B80@aaa>
Jan 05 12:45:27 svali postfix/qmgr[2599]: 28DA856578: from=<yyy+caf_=dusan=xxx>, size=2535, nrcpt=1 (queue active)
Jan 05 12:45:27 svali postfix/smtpd[26827]: disconnect from mail-qe0-f42.google.com[209.85.128.42]
Jan 05 12:45:28 svali dovecot[26832]: lda(xxx): sieve: msgid=<42EC179A-DE92-4526-9F0E-DA3B5EF76B80@aaa>: stored mail into mailbox 'INBOX'
Jan 05 12:45:28 svali postfix/pipe[26831]: 28DA856578: to=<xxx>, relay=spamass, delay=1.1, delays=0.69/0.01/0/0.36, dsn=2.0.0, status=sent (delivered via spamass service)
Jan 05 12:45:28 svali postfix/qmgr[2599]: 28DA856578: removed

main.cf

smtpd_banner = $myhostname ESMTP
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/svali.pem
smtpd_tls_key_file=/etc/ssl/private/svali.pem
smtpd_use_tls = yes
smtpd_tls_auth_only = yes

# Enabling SMTP for authenticated users, and handing off authentication to Dovecot
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes

smtpd_recipient_restrictions =
        permit_sasl_authenticated,
        permit_mynetworks,
        reject_unauth_destination

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = $myhostname
mydestination = localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

# Handing off local delivery to Dovecot's LMTP, and telling it where to store mail
# virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_transport = spamass

# Virtual domains, users, and aliases
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf

# Disable TLS for SMTP connections
smtpd_discard_ehlo_keyword_address_maps = hash:/etc/postfix/discard_ehlo

# OpenDKIM
non_smtpd_milters=inet:127.0.0.1:8891
smtpd_milters=inet:127.0.0.1:8891

master.cf

#
# Postfix master process configuration file.  For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet  n       -       n       -       -       smtpd
#smtp      inet  n       -       n       -       1       postscreen
#smtpd     pass  -       -       n       -       -       smtpd
#dnsblog   unix  -       -       n       -       0       dnsblog
#tlsproxy  unix  -       -       n       -       0       tlsproxy
submission inet n       -       n       -       -       smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_sasl_security_options=noanonymous
  -o smtpd_sasl_local_domain=$myhostname
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_sender_login_maps=hash:/etc/postfix/virtual
  -o smtpd_sender_restrictions=reject_sender_login_mismatch
  -o smtpd_recipient_restrictions=reject_unknown_recipient_domain,reject_non_fqdn_recipient,permit_sasl_authenticated,reject
  -o smtpd_milters=inet:127.0.0.1:8891
#  -o syslog_name=postfix/submission
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#smtps     inet  n       -       n       -       -       smtpd
#  -o syslog_name=postfix/smtps
#  -o smtpd_tls_wrappermode=yes
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#628       inet  n       -       n       -       -       qmqpd
pickup    unix  n       -       n       60      1       pickup
cleanup   unix  n       -       n       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
#qmgr     unix  n       -       n       300     1       oqmgr
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
rewrite   unix  -       -       n       -       -       trivial-rewrite
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce
verify    unix  -       -       n       -       1       verify
flush     unix  n       -       n       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       n       -       -       smtp
relay     unix  -       -       n       -       -       smtp
        -o fallback_relay=
        -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       n       -       -       showq
error     unix  -       -       n       -       -       error
retry     unix  -       -       n       -       -       error
discard   unix  -       -       n       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
scache    unix  -       -       n       -       1       scache
spamass   unix  -       n       n       -       -       pipe
    flags=DRhu user=vmail:vmail argv=/usr/bin/vendor_perl/spamc -u ${recipient} -e /usr/lib/dovecot/deliver -d ${recipient}
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent.  See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
#maildrop  unix  -       n       n       -       -       pipe
#  flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
#  mailbox_transport = lmtp:inet:localhost
#  virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus     unix  -       n       n       -       -       pipe
#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
#
# Old example of delivery via Cyrus.
#
#old-cyrus unix  -       n       n       -       -       pipe
#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
#uucp      unix  -       n       n       -       -       pipe
#  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# ====================================================================
#
# Other external delivery methods.
#
#ifmail    unix  -       n       n       -       -       pipe
#  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
#
#bsmtp     unix  -       n       n       -       -       pipe
#  flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
#
#scalemail-backend unix -       n       n       -       2       pipe
#  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
#  ${nexthop} ${user} ${extension}
#
#mailman   unix  -       n       n       -       -       pipe
#  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
#  ${nexthop} ${user}
share|improve this question

2 Answers 2

This error

Sender address rejected: not owned by user xxx;

came from this restriction on submission port (master.cf file)

submission inet n       -       n       -       -       smtpd
  ...
  -o smtpd_sender_restrictions=reject_sender_login_mismatch
  ...

As explained in man 5 postconf,

reject_sender_login_mismatch

Reject the request when $smtpd_sender_login_maps specifies an owner for the MAIL FROM address, but the client is not (SASL) logged in as that MAIL FROM address owner; or when the client is (SASL) logged in, but the client login name doesn't own the MAIL FROM address according to $smtpd_sender_login_maps.

The reason of iOS Mail works but Mail.app and Thunderbird doesn't is likely you didn't specified the right sender address when configured mail client.

share|improve this answer

The issue is with your mynetworks configuration in main.cf: http://www.postfix.org/postconf.5.html#mynetworks

Your mynetworks is set to 127.0.0.1; so the only box allowed to send mail is the postfix box. This means you're unable to connect to relay email based on the current settings.

share|improve this answer
    
I see. So the fact that I have permit_sasl_authenticated doesn't make any difference? What should I set mynetworks and smtpd_recipient_restrictions to, in order to deny relaying for non-authenticated SMTP clients? –  skrat Jan 5 '14 at 17:17
    
Why does it work when sending from iOS Mail.app? –  skrat Jan 5 '14 at 17:22
    
@skrat the mynetworks works in relaying of mail; I don't know how the app works that you're referring to. See serverfault.com/questions/337687/… for permit_sasl_authenticated with mynetworks. You can leave mynetworks to 127.0.0.1 but the server will not relay mail; e.g. you cannot directly connect to it to send mail. If you have a machine that you need to send mail you need to allow it in mynetworks. To verify that mynetworks is the issue set it to 0.0.0.0 to make it an open relay and then try sending –  josten Jan 5 '14 at 21:59
    
Making it an open relay would make it an immediate target for spammers and my server would be black listed in an instant, thanks, I'd rather not. I'd rather understand why permit_sasl_authenticated doesn't work as expected. –  skrat Jan 7 '14 at 11:25
    
@skrat that is why you have a firewall........................................ –  josten Jan 7 '14 at 13:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.