Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This feels like it should have been asked before, maybe I'm using the wrong language, but after 2 hours of searching I can't figure out how to fix this.

I have a message in my outbound postfix email queue where the primary email server is down ("Connection timed out" in the logs), and postfix is never trying the secondary (or lower preference servers).

It retries over and over for days (current config), and then eventually bounces, with out a mention of the secondary server.

I'm running postfix 2.8.

The only options that appear to maybe be related to this are smtp_skip_quit_response and smtp_skip_5xx_greeting (I'm sure there are more, but not sure what it is), but as there is no connection to the server, there is no response code, and these settings are correct I think (both set yes).

What I want to happen is if there is a problem connecting to the primary, it tries connecting to the secondary (it sounds obvious I know).

The other item of note is the A record for the (failing) primary resolves to several IP addresses (it is an A record, not a CNAME).

The logs look like this (with a lot of repetition cut out):

Mar  2 02:00:04 postfix/qmgr[2672]: D78739817D8: from=<>, size=24736, nrcpt=1 (queue active)
Mar  2 02:02:34 postfix/smtp[18263]: D78739817D8: to=<>, relay=none, delay=294106, delays=293955/0.02/151/0, dsn=4.4.1, status=deferred (connect to[]:25: Connection timed out)
Mar  2 03:10:04 postfix/qmgr[2672]: D78739817D8: from=<>, size=24736, nrcpt=1 (queue active)
Mar  2 03:12:35 postfix/smtp[22822]: D78739817D8: to=<>, relay=none, delay=298306, delays=298156/0/151/0, dsn=4.4.1, status=deferred (connect to[]:25: Connection timed out)
Mar  2 04:20:04 postfix/qmgr[2672]: D78739817D8: from=<>, size=24736, nrcpt=1 (queue active)
Mar  2 04:22:05 postfix/smtp[28734]: D78739817D8: to=<>, relay=none, delay=302477, delays=302356/0.01/121/0, dsn=4.4.1, status=deferred (connect to[]:25: Connection timed out)
Mar  3 15:20:03 postfix/qmgr[16791]: D78739817D8: from=<>, size=24736, nrcpt=1 (queue active)
Mar  3 15:22:34 postfix/smtp[20853]: D78739817D8: to=<>, relay=none, delay=428506, delays=428355/0/151/0, dsn=4.4.1, status=deferred (connect to[]:25: Connection timed out)
Mar  3 16:30:03 postfix/qmgr[16791]: D78739817D8: from=<>, size=24736, nrcpt=1 (queue active)
Mar  3 16:31:04 postfix/smtp[30310]: D78739817D8: to=<>, relay=none, delay=432615, delays=432555/0/60/0, dsn=4.4.1, status=deferred (connect to[]:25: Network is unreachable)
Mar  3 16:31:04 postfix/qmgr[16791]: D78739817D8: from=<>, status=expired, returned to sender
Mar  3 16:31:04 postfix/bounce[30772]: D78739817D8: sender non-delivery notification: 3036F14E0002
Mar  3 16:31:04 postfix/qmgr[16791]: D78739817D8: removed
share|improve this question
How many MX records does your destination has? What are their priorities? – clement Mar 6 '14 at 6:10
2 MX records, the primary A record has 5 records, an the secondary 2 A records. The primary has a cost of 10, the secondary a cost of 20. Thanks. – TrentDavis Mar 6 '14 at 9:20
What are the priorities of each mx record? – clement Mar 6 '14 at 9:21
It might be necessary to share the actual domain name in order to resolve this. – Michael Hampton Mar 6 '14 at 11:01
Domain:, first MX is a cost of 10, second a cost of 20. The first MX record has 5 A records, the second MX has 2 A records. Upon close inspection you will note the primary (cost 10) MX entry is actually mis-configured (typo), but I still think that this is a real problem that postfix is not trying the secondaries when it should be. Further comments below as well to the first answer. – TrentDavis Mar 6 '14 at 11:39
up vote 2 down vote accepted

That got me looking in the right direction, the solution in this instance was to set smtp_mx_address_limit = 20 in

To clarify, the domain config was:

  • 2 MX Records (cost 10 and 20).
  • The first MX record has 5 A records.
  • The second MX record has 2 A records.

The default smtp_mx_session_limit value is 5, which you will note matches the number of A records for the primary MX record, so Postfix was never looking beyond the first 5 IP's. Setting this to any value greater than 5 would have helped in this instance, but for our config I'll be leaving it at something a bit larger to help with the number of CDN's etc there are out there these days.

Hopefully someone else finds this useful as I couldn't find it anywhere else!

share|improve this answer
Cool, glad you found a better solution! – NickW Mar 7 '14 at 9:10
Kudos for posting and answering this! I've been doing email for ~15 years and did not know this config detail before... You'll be able to accept your own answer in about a day, it'd be very nice if you could come back to do that - as you say, it will be useful for someone else! – Jenny D Mar 7 '14 at 9:48

I think you may find that you have run into some internal limits of postfix, as Viktor on the postfix list says:

..with a static preference, Postfix may fail deliver mail to a 
reachable destination, just because enough IPv4 or enough IPv6 
addresses are dead.  Remember, Postfix tries a limited number of 
MX addresses per delivery. 

possibly, you may have also delivered a mail successfully to one of those servers in the last 24 hours, and Postfix will cache successful MX records.

I'd say you have two options, flush the queue postqueue -f which will force postfix to do another MX lookup, or set up a temporary transport for that domain, using the secondary MX record as the transport

share|improve this answer
I think the forced override will be a short term work around. Do you know if it tracks this per IP or per MX entry? This site only has 2 MX records, and I can see it trying each of the IP's (randomly selected) every 10 minutes, for days (up to 5 days as configured) until it gives up. I feel like there is just some setting somewhere where it is treating a "Connection timed out" error as a "try this again" error, rather than "I need to go looking else where" (I have no idea what the terminology is here for this type of problem, hopefully it makes sense). – TrentDavis Mar 6 '14 at 11:36
Supposedly, deferred should indicate non deliverable, whether the transport uses the MX record, or just the IP, depends on how you configure it, if you add nexthop (bit after the :) as an ip address or domain name contained in [] braces, it will not do an MX lookup, which may be what you want in this case. – NickW Mar 6 '14 at 11:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.