I'm getting the following rather annoying error message:

Sender address rejected: not owned by user subscription@****.ca; from=<subscription@****.ca> to=<webmaster@****.ca> proto=ESMTP helo=<[]>

And my postconf -n:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
canonical_maps = hash:/etc/postfix/canonical
config_directory = /etc/postfix
default_destination_concurrency_limit = 5
disable_vrfy_command = yes
dovecot_destination_recipient_limit = 1
home_mailbox = Maildir/
inet_interfaces = all
mailbox_command = /usr/lib/dovecot/deliver -c /etc/dovecot/conf.d/99-mail-stack-delivery.conf -m "${EXTENSION}"
mailbox_size_limit = 0
message_size_limit = 104857600
milter_connect_macros = j {daemon_name} v {if_name} _
milter_default_action = accept
mydestination = localhost
myhostname = ****.ca
mynetworks = [::ffff:]/104 [::1]/128
myorigin = /etc/mailname
non_smtpd_milters = $smtpd_milters
readme_directory = no
recipient_delimiter = +
relay_destination_concurrency_limit = 1
relayhost =
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks,permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, reject_unknown_helo_hostname, permit
smtpd_milters = unix:/spamass/spamass.sock unix:/opendkim/opendkim.sock
smtpd_recipient_restrictions = reject_unknown_client_hostname, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_invalid_hostname, reject_non_fqdn_sender
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_login_maps = $virtual_mailbox_maps
smtpd_sender_restrictions = reject_unknown_sender_domain, reject_sender_login_mismatch
smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtpd_tls_ask_ccert = yes
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/private/ssl-chain-mail-****.pem
smtpd_tls_ciphers = high
smtpd_tls_key_file = /etc/ssl/private/ssl-key-decrypted-mail-****.key
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
unknown_address_reject_code = 550
unknown_client_reject_code = 550
unknown_hostname_reject_code = 550
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_transport = dovecot

Basically, I can't send mail from outside the local network! If I remove reject_sender_login_mismatch from the options I can, but this seems bad... My mailbox maps has all the main email accounts. (I starred-out my domain)


I changed the query variable in 'mysql-virtual-mailbox-maps.cf'

from: query = SELECT 1 FROM virtual_users WHERE email='%s'

to: query = SELECT email FROM virtual_users WHERE email='%s'.

It didn't work before because it needs to match the 'FROM' header to the return value of the query (reject_sender_login_mismatch) explains this.

  • But you should use virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf. So in master.cf: -o smtpd_sender_login_maps=proxy:mysql:/usr/local/etc/postfix/mysql_virtual_alias_maps.cf – Lexib0y Nov 16 '18 at 10:45

Replace reject_sender_login_mismatch with reject_authenticated_sender_login_mismatch will do the trick.


In postfix main.cf, parameter reject_sender_login_mismatch was an alias for reject_authenticated_sender_login_mismatch, reject_unauthenticated_sender_login_mismatch.

The reason why outside network can't send email is reject_unauthenticated_sender_login_mismatch (which is parts of reject_sender_login_mismatch) will rejects sender which isn't defined in smtpd_sender_login_maps.

For further explanation of this three parameter, I suggest to take a look in this discussion.

  • Alright, I'll try that when I get home. It seems strange though that it doesn't work as is - I should be authenticated, and all the accounts are defined in the MySQL db. – rottweilers_anonymous Oct 30 '14 at 12:05
  • I'm thinking it's because my query is SELECT 1 FROM TABLE WHERE email=%s. I'll change it to SELECT email FROM TABLE WHERE email=%s and let you know if that works – rottweilers_anonymous Oct 30 '14 at 17:41

Please check your master.cf,you seem to be using the wrong map.

You should use virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf. So in master.cf:

  -o smtpd_sender_login_maps=proxy:mysql:/usr/local/etc/postfix/mysql_virtual_alias_maps.cf

and not /usr/local/etc/postfix/mysql_virtual_mailbox_maps.cf

It uses this query to see if the email belongs to the mailbox owner (the goto):

query = SELECT goto FROM mail2_alias WHERE address='%s' AND active = 1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.