1

I am trying to configure Postfix for the first time. I do not need mailboxes, I want only virtual aliases, forwarding [email protected] --> [email protected]

My Postfix is running in a Docker container on a Digital Ocean droplet.

I have got as far as:

$ postalias -q [email protected]
[email protected]

...from inside the container, i.e. my /etc/postfix/virtual file is working.

Also, from outside the container on the droplet:

telnet example.com 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 example.com ESMTP Postfix (Ubuntu)

But from my own computer:

$ telnet example.com 25
Trying <droplet IP>...
telnet: connect to address <droplet IP>: Operation timed out
telnet: Unable to connect to remote host

I think this is expected and correct as a result of the mynetworks config setting (see below) which is as recommended by Digital Ocean - I don't want to host an 'open' SMTP relay.

I have an MX record for example.com. set up and I can ping example.com just fine and access websites on it. Also (from my computer):

$ host -t mx example.com
example.com mail is handled by 1 example.com.

So that looks right.

But if I send a test message to [email protected] nothing comes through and I don't see anything in Postfix logs either... I can't tell at what point it failed.

I am uncertain if the problem is in my Postfix configuration or in the routing into the container.

The container exposes port 25 (only) and is run via Fig with

ports:
  - "25:25"

From shell in the droplet:

$ netstat -tulpn | grep 25
tcp6       0      0 :::25                   :::*                    LISTEN      10680/docker-proxy

My /etc/postfix/main.cf has this in it:

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = example.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = /etc/mailname, <container id>, localhost.localdomain, localhost, example.com
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
virtual_alias_domains = example.com
virtual_alias_maps = hash:/etc/postfix/virtual
inet_protocols = ipv4

I'm not really clear of the distinction between myhostname (which was originally set to <container id>) mydestination and virtual_alias_domains

Updated

with output from http://mxtoolbox.com/SuperTool.aspx

Connecting to <server IP>

220 example.com ESMTP Postfix (Ubuntu) [733 ms]
EHLO MXTB-PWS3.mxtoolbox.com
250-example.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN [714 ms]
MAIL FROM: <[email protected]>
250 2.1.0 Ok [722 ms]
RCPT TO: <[email protected]>
454 4.7.1 <[email protected]>: Relay access denied [715 ms]

MXTB-PWS3v2 4006ms

Update
As @masegaloeh helped me discover, my postfix server was basically working. I had two problems that confused things though:

  1. Due to mistake in my Dockerfile I had /var/log/mail.log owned by root user... this is why it stayed empty. I didn't see any errors about it but basically rsyslog couldn't write to it. A chown syslog:adm /var/log/mail.log step fixed that, and I was able to see that indeed postfix was handling and forwarding mail to the alias.

  2. I mistakenly believed I was able to telnet to other servers on port 25 from my laptop, just because I thought I'd done stuff in the past that would need that to work. But actually I can't. However I was able to telnet example.com 25 from another server so, again, stuff was actually working.

  3. Sending mail to the alias from another server works, and comes through to my Gmail destination address.

  4. It seems my problem is actually with Gmail... when I send the message to [email protected] from my Gmail account it does not show up. I since tried with aliases I had setup on another hosting... some work and some don't... leading to:

Conclusion:
it seems that Gmail will only accept mail for aliases that are configured under Settings > Accounts and Import > Send mail as ...unfortunately Gmail now requires you to specify a 3rd party SMTP server for it when setting up a new one, so it looks I will have to get to grips with TLS etc in my postfix install.

1
  • If you want to obfuscate the domain, don't just pick a random domain name that belongs to someone else - use example.(com|net|org) which is meant for this.
    – masegaloeh
    Jan 21, 2015 at 21:25

1 Answer 1

3

This Telnet log message

telnet: connect to address <droplet IP>: Operation timed out

isn't caused by mynetworks configuration in postfix! The error indicated that either your telnet packet doesn't reach the docker IP address or postfix in docker doesn't respond to your telnet.

As you mention that you telnet from your own computer, then maybe your ISP is blocking port 25. However, because you mention that the email from outside can't go through and even the postfix log was empty then maybe the postfix container doesn't respond at all. Maybe you fail to bind DO droplet port to postfix docker port. Try to run netstat -tulpn | grep 25 from DO droplets to confirm that postfix is reachable from outside.

As I wasn't familiar with docker, then I can't offer exact solution here. However some googling result indicated that you have set the IPtables to do masquerading like the official documentation: Binding container ports to the host

Edit
Anyway your netstat output looks fine. It's indicated that it listen in IPv6 only. But this post and this post indicated that Ubuntu/Debian use IPv4-mapped IPv6 addresses method to provide the connection so maybe it is reachable from the outside IPv4 too.

For further troubleshooting, here I gave the least requirement to send email

  • Some MTA (postfix,exim, IIS) listen on port 25. You can confirm this by run netstat and telnet to localhost
  • MX record/A record must be properly configured.
  • Internet host can reach port 25 on your server. This is means no firewall issue that dropped SMTP packet.

Because you introduced docker proxy to your stack then you must confirm

  1. Packet received in DO droplet port 25. Try to run tcpdump port 25 when you send email to confirm that your host received the packet.
  2. Docker proxy actually forward packet to postfix. Postfix always logs incoming SMTP connection.
18
  • it's not my ISP, I can connect to the SMTP server on my other virtual hosting provider
    – Anentropic
    Jan 21, 2015 at 21:30
  • Should my Postfix be reachable via telnet to port 25 in order to forward virtual aliases as described in question? I do not need or want to be able to send mail through it, i.e. use it as SMTP server from a mail client.
    – Anentropic
    Jan 21, 2015 at 21:33
  • OK. Thanks for confirming this as you doesn't indicated in the question :). Try to run netstat -tulpn | grep 25 to confirm that postfix was reachable from outside. And yes postfix must reachable from the outside. If my mail server wants to send email to your domain, then it must telnet to port 25, doing some weird conversation with SMTP language then voila the email was magically forwarding :)
    – masegaloeh
    Jan 21, 2015 at 21:35
  • the part in my question about Fig ports: "25:25" is where port 25 is bound from the host to the Docker container... I have used same on an Nginx container to bind port 80 and website works from outside
    – Anentropic
    Jan 21, 2015 at 21:37
  • Your netstat output indicated that postfix was listening on port 25, but it listen on IPv6 not IPv4. So IPv4 mail server can't telnet to your server. Did docker have some magic configuration to force listening to both IP stack?
    – masegaloeh
    Jan 21, 2015 at 21:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .