0

I have two CentOS 6.6 servers configured with Postfix for sending email. I have everything working great, SPF entries, Domain Keys and OpenDKIM configured and working, but I'm trying to perfect my backup mail server. Currently, if I shutdown mx1 and send an email, it gets queued up on mx2 like it's supposed to. Once I start Postfix on mx1, the mail gets sent out, but mx1 rejects it because of the SPF filter. I've tried everything I can to get this working, but it's just not working the way it's supposed to.

mx2 is configured to relay mail for the domain I'm sending to. I also have the IP of the backup MX in mynetwork in my main.cf

mx1 = bluemoon.domain.tld

mx2 = surly.domain.tld

Logs:

mx2:

Apr 28 08:23:31 surly postfix/smtpd[13015]: 4B37B35E1092E: client=sender1.zohomail.com[74.201.84.162]
Apr 28 08:23:31 surly postfix/cleanup[13020]: 4B37B35E1092E: message-id=<004d01d081b6$847140b0$8d53c210$@larsonit.net>
Apr 28 08:23:31 surly /usr/lib64/plesk-9.0/psa-pc-remote[23410]: handlers_stderr: SKIP
Apr 28 08:23:31 surly /usr/lib64/plesk-9.0/psa-pc-remote[23410]: SKIP during call 'limit-out' handler
Apr 28 08:23:31 surly /usr/lib64/plesk-9.0/psa-pc-remote[23410]: handlers_stderr: SKIP
Apr 28 08:23:31 surly /usr/lib64/plesk-9.0/psa-pc-remote[23410]: SKIP during call 'check-quota' handler
Apr 28 08:23:31 surly spf filter[13024]: Starting spf filter...
Apr 28 08:23:32 surly spf filter[13024]: SPF result: pass
Apr 28 08:23:32 surly spf filter[13024]: SPF status: PASS
Apr 28 08:23:32 surly /usr/lib64/plesk-9.0/psa-pc-remote[23410]: handlers_stderr: PASS
Apr 28 08:23:32 surly /usr/lib64/plesk-9.0/psa-pc-remote[23410]: PASS during call 'spf' handler
Apr 28 08:23:32 surly opendkim[680]: 4B37B35E1092E: sender1.zohomail.com [<IP ADDR>] not internal
Apr 28 08:23:32 surly opendkim[680]: 4B37B35E1092E: not authenticated
Apr 28 08:23:32 surly opendkim[680]: 4B37B35E1092E: no signature data
Apr 28 08:23:32 surly postfix/qmgr[2080]: 4B37B35E1092E: from=<jon@otherdomain.tld>, size=3236, nrcpt=1 (queue active)
Apr 28 08:23:32 surly postfix/smtp[13025]: connect to mx1.domain.tld[<IP ADDR>]:25: Connection refused
Apr 28 08:23:32 surly postfix/smtpd[13015]: disconnect from sender1.zohomail.com[74.201.84.162]
Apr 28 08:23:32 surly postfix/smtp[13025]: 4B37B35E1092E: to=<jon@MAILDOMAIN.TLD>, relay=none, delay=1.4, delays=1.3/0.01/0.02/0, dsn=4.4.1, status=deferred (connect to mx1.domain.tld[<ip addr>]:25: Connection refused)
Apr 28 08:24:21 surly postfix/qmgr[2080]: 4B37B35E1092E: from=<jon@larsonit.net>, size=3236, nrcpt=1 (queue active)
Apr 28 08:24:21 surly postfix/smtp[13025]: 4B37B35E1092E: to=<jon@maildomain.tld>, relay=mx1.domain.tld[<ip addr>]:25, delay=51, delays=50/0/0.04/0.6, dsn=5.7.1, status=bounced (host mx1.domain.tld[<ip adr>] said: 550 5.7.1 Command rejected (in reply to end of DATA command))
Apr 28 08:24:21 surly postfix/cleanup[13020]: D1B1C35E10940: message-id=<20150428132421.D1B1C35E10940@surly.larsonit-hosts.net>
Apr 28 08:24:21 surly postfix/qmgr[2080]: D1B1C35E10940: from=<>, size=5422, nrcpt=1 (queue active)
Apr 28 08:24:21 surly postfix/bounce[13050]: 4B37B35E1092E: sender non-delivery notification: D1B1C35E10940
Apr 28 08:24:21 surly postfix/qmgr[2080]: 4B37B35E1092E: removed

mx1:

Apr 28 08:24:21 s18267928 postfix/smtpd[27039]: connect from surly.domain.tld[<ip>]
Apr 28 08:24:21 s18267928 postfix/smtpd[27039]: 3A2F9708C90E: client=surly.domain.tld[<Ip>]
Apr 28 08:24:21 s18267928 postfix/cleanup[27044]: 3A2F9708C90E: message-id=<004d01d081b6$847140b0$8d53c210$@larsonit.net>
Apr 28 08:24:21 s18267928 /usr/lib64/plesk-9.0/psa-pc-remote[19488]: handlers_stderr: SKIP
Apr 28 08:24:21 s18267928 /usr/lib64/plesk-9.0/psa-pc-remote[19488]: SKIP during call 'limit-out' handler
Apr 28 08:24:21 s18267928 /usr/lib64/plesk-9.0/psa-pc-remote[19488]: handlers_stderr: SKIP
Apr 28 08:24:21 s18267928 /usr/lib64/plesk-9.0/psa-pc-remote[19488]: SKIP during call 'check-quota' handler
Apr 28 08:24:21 s18267928 spf filter[27047]: Starting spf filter...
Apr 28 08:24:21 s18267928 spf filter[27047]: SPF result: softfail
Apr 28 08:24:21 s18267928 spf filter[27047]: SPF status: REJECT
Apr 28 08:24:21 s18267928 /usr/lib64/plesk-9.0/psa-pc-remote[19488]: handlers_stderr: REJECT
Apr 28 08:24:21 s18267928 /usr/lib64/plesk-9.0/psa-pc-remote[19488]: REJECT during call 'spf' handler
Apr 28 08:24:21 s18267928 postfix/cleanup[27044]: 3A2F9708C90E: milter-reject: END-OF-MESSAGE from surly.<domain.tld>[<ip addr>]: 5.7.1 Command rejected; from=<jon@othedomain.tld> to=<jon@maildomain.tld> proto=ESMTP helo=<surly.domain.tld>
1
  • 2
    Backup MX hosts shouldn't be necessary anymore. They're more often than not used to deliver spam as the backup is either configured less stringently than the primary and/or because the primary doesn't check what comes in from the backup MX. I don't use them anymore, I just trust I can get the primary back online within 48 hours if anything bad happens. – wurtel Apr 29 '15 at 12:24
1

Based on this log

Apr 28 08:24:21 s18267928 postfix/cleanup[27044]: 3A2F9708C90E: milter-reject: END-OF-MESSAGE from surly.<domain.tld>[<ip addr>]: 5.7.1 Command rejected; from=<jon@othedomain.tld> to=<jon@maildomain.tld> proto=ESMTP helo=<surly.domain.tld>

apparently the email rejected by Plesk milter that invoked by postfix. So we have two options here:

  1. Exclude IP address from so postfix won't deliver email to milter-checking.

    Unfortunately there are no direct parameter to control this. There are workaround involving setup new smtpd service in master.cf and add no_milters parameter. See this documentation for example.

  2. Tell plesk to whitelist the particular IP Address from SPF Checks.

According to this thread: Any way to turn off SPF checking on Plesk for a specific IP?, it is possible to whitelist the particular IP Address from SPF Checks. Just set

ip4:a.b.c.d

in SPF local rules option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.