1

I am working on building a secure mail server for the first time using Postfix and Dovecot and I have encountered a problem that I cannot surpass.

To avoid the email delivery in the spam box of remote servers I set up a SPF and DKIM following this tutorial. The problem now I have is my server is rejecting the recipient address on my server when delivered from remote services like Gmail.

  • Sending from john@example.com to alex@example.com works.
  • Sending from john@example.com to alex@gmail.com works.
  • Sending from john@gmail.com to alex@example.com fails.
NOQUEUE: reject: RCPT from sonic311-43.consmr.mail.bf2.yahoo.com[74.6.131.217]: 451 4.3.5 <john@example.com>: Recipient address rejected: Server configuration problem;

This is my /etc/postfix/main.cf

# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
#smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
#smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
#smtpd_use_tls=yes
#smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
#smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_cert_file=/etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file=/etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_use_tls=yes
smtpd_tls_auth_only = yes

smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions =
  permit_mynetworks
  permit_sasl_authenticated
  reject_unauth_destination
  check_policy_service unix:private/policyd-spf

# Milter configuration
milter_default_action = accept
milter_protocol = 6
smtpd_milters = local:/opendkim/opendkim.sock
non_smtpd_milters = $smtpd_milters


# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = example.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
# mydestination = $myhostname, localhost.localdomain, localhost
mydestination = localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
home_mailbox = Maildir/
virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf

policyd-spf_time_limit = 3600

Initially, Outbound mail timed out until I added

permit_sasl_authenticated
reject_unauth_destination

under smtpd_recipient_restrictions

How do I get my server to accept mail?

Edit This is what I get when using a testing tool:

CLIENT -> SERVER: MAIL FROM:
SERVER -> CLIENT: 250 2.1.0 Ok
CLIENT -> SERVER: RCPT TO:
SERVER -> CLIENT: 451 4.3.5 : Recipient address rejected: Server configuration problem
SMTP ERROR: RCPT TO command failed: 451 4.3.5 : Recipient address rejected: Server configuration problem
CLIENT -> SERVER: QUIT
SERVER -> CLIENT: 221 2.0.0 Bye
Connection: closed
2019-04-10 19:53:53 SMTP Error: The following recipients failed: john@example.com: : Recipient address rejected: Server configuration problem
Message sending failed.

Edit 2 This is the output in /var/log/mail.log

Apr 11 05:24:17 alice postfix/smtpd[22573]: connect from mail-wr1-f42.google.com[209.85.221.42]
Apr 11 05:24:17 alice postfix/smtpd[22573]: warning: connect to private/policyd-spf: No such file or directory
Apr 11 05:24:18 alice postfix/smtpd[22573]: warning: connect to private/policyd-spf: No such file or directory
Apr 11 05:24:18 alice postfix/smtpd[22573]: warning: problem talking to server private/policyd-spf: No such file or directory
Apr 11 05:24:18 alice postfix/smtpd[22573]: NOQUEUE: reject: RCPT from mail-wr1-f42.google.com[209.85.221.42]: 451 4.3.5 <john@example.com>: Recipient address rejected: Server configuration problem; from=<jonbonsilver@gmail.com> to=<john@example.com> proto=ESMTP helo=<mail-wr1-f42.google.com>
Apr 11 05:24:19 alice postfix/smtpd[22573]: disconnect from mail-wr1-f42.google.com[209.85.221.42] ehlo=2 starttls=1 mail=1 rcpt=0/1 data=0/1 quit=1 commands=5/7
Apr 11 05:27:39 alice postfix/anvil[22498]: statistics: max connection rate 1/60s for (smtp:185.234.217.223) at Apr 11 05:18:44
Apr 11 05:27:39 alice postfix/anvil[22498]: statistics: max connection count 1 for (smtp:185.234.217.223) at Apr 11 05:18:44
Apr 11 05:27:39 alice postfix/anvil[22498]: statistics: max cache size 2 at Apr 11 05:24:17
Apr 11 05:27:44 alice postfix/smtpd[22676]: connect from unknown[185.234.217.223]

Edit 3

This is my /etc/postfix/master.cf

#
# Postfix master process configuration file.  For details on the format
# of the file, see the master(5) manual page (command: "man 5 master" or
# on-line: http://www.postfix.org/master.5.html).
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (no)    (never) (100)
# ==========================================================================
smtp      inet  n       -       y       -       -       smtpd
#  -o content_filter=spamassassin
#smtp      inet  n       -       y       -       1       postscreen
#smtpd     pass  -       -       y       -       -       smtpd
#dnsblog   unix  -       -       y       -       0       dnsblog
#tlsproxy  unix  -       -       y       -       0       tlsproxy
submission inet n       -       -       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject_unauth_destination
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=permit_sasl_authenticated, reject_unauth_destination
#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject_unauth_destination
#  -o milter_macro_daemon_name=ORIGINATING
#smtps     inet  n       -       y       -       -       smtpd
#  -o syslog_name=postfix/smtps
#  -o smtpd_tls_wrappermode=yes
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=
#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#628       inet  n       -       y       -       -       qmqpd
pickup    unix  n       -       y       60      1       pickup
cleanup   unix  n       -       y       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
#qmgr     unix  n       -       n       300     1       oqmgr
tlsmgr    unix  -       -       y       1000?   1       tlsmgr
rewrite   unix  -       -       y       -       -       trivial-rewrite
bounce    unix  -       -       y       -       0       bounce
defer     unix  -       -       y       -       0       bounce
trace     unix  -       -       y       -       0       bounce
verify    unix  -       -       y       -       1       verify
flush     unix  n       -       y       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       y       -       -       smtp
relay     unix  -       -       y       -       -       smtp
#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       y       -       -       showq
error     unix  -       -       y       -       -       error
retry     unix  -       -       y       -       -       error
discard   unix  -       -       y       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       y       -       -       lmtp
anvil     unix  -       -       y       -       1       anvil
scache    unix  -       -       y       -       1       scache

#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent.  See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
#  mailbox_transport = lmtp:inet:localhost
#  virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#

#cyrus     unix  -       n       n       -       -       pipe
#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
# Old example of delivery via Cyrus.
#
#old-cyrus unix  -       n       n       -       -       pipe
#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix  -       n       n       -       2       pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman   unix  -       n       n       -       -       pipe

  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  ${nexthop} ${user}

spamassassin unix -     n       n       -       -       pipe
user=spamd argv=/usr/bin/spamc -f -e
/usr/sbin/sendmail -oi -f ${sender} ${recipient}

policyd-spf  unix  -       n       n       -       0       spawn
    user=policyd-spf argv=/usr/bin/policyd-spf
Improve this question
9
  • Pls ignore my previous comment. Can you see if the file `/usr/bin/policyd-spf´ that main.cf points to really exist?
    – Diamond
    Apr 11, 2019 at 7:24
  • @Diamant Yes I can sudo nano into /usr/bin/policyd-spf and see the code for the software. I did try what you first said first and it gave the same error when the file was genuinely not there. Could there be a permissions issue that I am not aware of?
    – John
    Apr 11, 2019 at 7:31
  • OK. I don't know which how-to you have followed. But according to the main.cf config, there should be a user policyd-spf and it should also have enough permission to the file /usr/bin/policyd-spf I suppose. Can you check that?
    – Diamond
    Apr 11, 2019 at 7:39
  • @Diamant it was -rwxr-xr-x 1 root root - so I ran - chown policyd-spf:policyd-spf /usr/bin/policyd-spf - exactly the same "No such file or directory" so I don't think it is permissions so have reverted back. I am sure this the problem a /policyd-spf is specifically related to incoming mail.
    – John
    Apr 11, 2019 at 8:42
  • may be u can give a try with user=nobody instead of user=policyd-spf in master.cf.
    – Diamond
    Apr 11, 2019 at 9:06

1 Answer 1

Reset to default
0

  • mynetworks is set to 127.0.0.1 ; you should set proper network.

  • check smtpd_sender_restrictions - reject_sender_login_mismatch - This rejects the request when $smtpd_sender_login_maps specifies an owner for the MAIL FROM address, but the client is not (SASL) logged in as that MAIL FROM address owner; or when the client is (SASL) logged in, but the client login name doesn't own the MAIL FROM address according to $smtpd_sender_login_maps (extracted from ).

  • verify check_policy_service destination to see what's there

Improve this answer
3
  • Thanks for your response. I could not find an instance of "smtpd_sender_restrictions" are you suggesting that I add that rule to main.cf? Could you give an example of what should be in mynetworks? I don't know how to verify check_policy_service. I have updated my question to include my master.cf for more detail.
    – John
    Apr 11, 2019 at 7:09
  • "mynetworks" should be the network your server and clients are part of (the IPs and subnets) and that can then be used in many filters, including used as trusted network and it helps in various situations. If at least the server IP is not there, this can lead to various anomalies. You should have sender restrictions in your configuration that should allow things like your network and ssl_auth and deny custom access lists or reject_non_fqdn_sender - but if you did not configure anything there there should be no interference from this aspect.
    – Overmind
    Apr 11, 2019 at 7:27
  • 2
    mynetworks is not related to the problem, even if it's 127.0.0.0/8. There are plenty of standalone mail servers where local loopback is the only own network.
    – Esa Jokinen
    Apr 11, 2019 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.