Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I understand that I need SMTP on port 25 to receive email, but I do not want this to be a relay port. Instead I would port 587 to be used for registered (SASL-authenticated) users to relay email from any IP address, through my server, and to any email server (e.g. GMail, Yahoo).

I have set up Postfix to receive email, and authenticate users, but I am utterly confused about the difference between port 25 and 587, and how to use one for receiving and one for relaying.

Here is the relevant part of my currently.

myhostname =
mydomain =
#myorigin = $mydomain
mydestination = localhost localhost.localdomain
mynetworks_style = host

smtpd_sender_restrictions = reject_unknown_sender_domain

smtpd_relay_restrictions = permit_mynetworks, 

smtpd_recipient_restrictions = permit_mynetworks, 
        # reject_unauth_destination is not needed here if the mail
        # relay policy is specified under smtpd_relay_restrictions
        # (available with Postfix 2.10 and later).


smtp      inet  n       -       -       -       -       smtpd
#smtp      inet  n       -       -       -       1       postscreen
#smtpd     pass  -       -       -       -       -       smtpd
#dnsblog   unix  -       -       -       -       0       dnsblog
#tlsproxy  unix  -       -       -       -       0       tlsproxy
submission inet n - - - - smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_sasl_security_options=noanonymous
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_sender_restrictions=reject_sender_login_mismatch

Unfortunately I get this error when trying to send on port 587 with my mail client from a different IP address.

NOQUEUE: reject: RCPT from unknown[XXX.XXX.XXX.XXX]: 553 5.7.1 <>: Sender address rejected: not owned by user; from=<> to=<test@domain.tld> proto=ESMTP helo=<[]>
share|improve this question

migrated from Jun 16 '14 at 8:12

This question came from our site for computer enthusiasts and power users.

up vote 2 down vote accepted

Per-port configuration is done in, not The default Postfix configuration files already have good example settings, they just need to be uncommented. Port 587 is labelled as the submission port there (port 25 is of course smtp).

Your settings could be somewhat simplified. In, specify the default policy (for port 25) only as recipient_restrictions, nothing more than that is necessary:

smtpd_recipient_restrictions =

In, override it by removing the previously set restrictions and allowing unrestricted relaying for authenticated users:

smtp      inet  n       -       n       -       -       smtpd
submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_recipient_restrictions=
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.