Postfix: relay access denied

[Maxman1850]

Hi guys,

I'm desperately trying to make my SMTP server work correctly but he seems to be not listening to me.

When I send an e-mail from the webmail he sends it correctly. But when I try to connect with Mail (for Mac) I get an error that the SMTP server is offline.

Also when I check my SMTP server with this tool: http://www.mxtoolbox.com/
I get the following error:

HELO please-read-policy.mxtoolbox.com
250 Webserver002 [125 ms]
MAIL FROM: <supertool@mxtoolbox.com>
250 2.1.0 Ok [218 ms]
RCPT TO: <test@example.com>
554 5.7.1 <test@example.com>: Relay access denied [140 ms]
QUIT
221 2.0.0 Bye [140 ms]

The maillog looks like this:

Dec 15 19:17:53 Webserver002 postfix/smtpd[26175]: warning: 64.20.227.133: address not listed for hostname recover.mxtoolbox.com
Dec 15 19:17:53 Webserver002 postfix/smtpd[26175]: connect from unknown[64.20.227.133]
Dec 15 19:17:53 Webserver002 postfix/smtpd[26175]: NOQUEUE: reject: RCPT from unknown[64.20.227.133]: 554 5.7.1 <test@example.com>: Relay access denied; from=<supertool@mxtoolbox.com> to=<test@example.com> proto=SMTP helo=<please-read-policy.mxtoolbox.com>
Dec 15 19:17:53 Webserver002 postfix/smtpd[26175]: disconnect from unknown[64.20.227.133]

My main.cf looks like this:

myhostname = Webserver002
mynetworks = 127.0.0.0/8 [::1]/128
virtual_alias_domains =
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, mysql:/etc/postfix/mysql-virtual_email2email.cf
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
virtual_mailbox_base = /var/vmail
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_authenticated_header = yes
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_recipient_access mysql:/etc/postfix/mysql-virtual_recipient.cf, reject_unauth_destination
smtpd_use_tls = yes
smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
transport_maps = proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
relay_domains = mysql:/etc/postfix/mysql-virtual_relaydomains.cf
relay_recipient_maps = mysql:/etc/postfix/mysql-virtual_relayrecipientmaps.cf
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $virtual_mailbox_limit_maps
smtpd_sender_restrictions = check_sender_access mysql:/etc/postfix/mysql-virtual_sender.cf
smtpd_client_restrictions = check_client_access mysql:/etc/postfix/mysql-virtual_client.cf
maildrop_destination_concurrency_limit = 1
maildrop_destination_recipient_limit = 1
virtual_transport = dovecot
header_checks = regexp:/etc/postfix/header_checks
mime_header_checks = regexp:/etc/postfix/mime_header_checks
nested_header_checks = regexp:/etc/postfix/nested_header_checks
body_checks = regexp:/etc/postfix/body_checks
dovecot_destination_recipient_limit = 1
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
receive_override_options = no_address_mappings
content_filter = amavis:[127.0.0.1]:10024
relayhost =
mailbox_size_limit = 0
message_size_limit = 0

Can please someone help me to find the solution for this?

Thanks for your help!

Max

[falko]

Originally Posted by Maxman1850

But when I try to connect with Mail (for Mac) I get an error that the SMTP server is offline.

What are the outputs of

netstat -tap

and

iptables -L

?

[Maxman1850]

Netstat -tap:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
tcp        0      0 *:imaps                     *:*                         LISTEN      16423/dovecot       
tcp        0      0 *:pop3s                     *:*                         LISTEN      16423/dovecot       
tcp        0      0 Webserver002:10024          *:*                         LISTEN      18387/amavisd (mast 
tcp        0      0 Webserver002:10025          *:*                         LISTEN      26171/master        
tcp        0      0 *:mysql                     *:*                         LISTEN      16285/mysqld        
tcp        0      0 *:pop3                      *:*                         LISTEN      16423/dovecot       
tcp        0      0 Webserver002:dyna-access    *:*                         LISTEN      16410/clamd         
tcp        0      0 *:imap                      *:*                         LISTEN      16423/dovecot       
tcp        0      0 *:sunrpc                    *:*                         LISTEN      2768/portmap        
tcp        0      0 *:723                       *:*                         LISTEN      9445/rpc.statd      
tcp        0      0 Webserver002:domain         *:*                         LISTEN      16513/named         
tcp        0      0 Webserver002:domain         *:*                         LISTEN      16513/named         
tcp        0      0 *:ftp                       *:*                         LISTEN      16458/pure-ftpd (SE 
tcp        0      0 *:smtp                      *:*                         LISTEN      26171/master        
tcp        0      0 Webserver002:rndc           *:*                         LISTEN      16513/named         
tcp        0      0 Webserver002:imap           ip8a.direct-ads:49231 ESTABLISHED 28086/imap          
tcp        0      0 Webserver002:imap           ip8a.direct-ads:49228 ESTABLISHED 28053/imap          
tcp        0      0 Webserver002:imap           ip8a.direct-ads:49217 ESTABLISHED 28051/imap          
tcp        0      0 Webserver002:imap           ip8a.direct-ads:49239 ESTABLISHED 28088/imap          
tcp        0      0 *:imaps                     *:*                         LISTEN      16423/dovecot       
tcp        0      0 *:pop3s                     *:*                         LISTEN      16423/dovecot       
tcp        0      0 *:pop3                      *:*                         LISTEN      16423/dovecot       
tcp        0      0 *:imap                      *:*                         LISTEN      16423/dovecot       
tcp        0      0 *:webcache                  *:*                         LISTEN      21606/httpd         
tcp        0      0 *:http                      *:*                         LISTEN      21606/httpd         
tcp        0      0 *:work-sol                  *:*                         LISTEN      1971/sshd           
tcp        0      0 *:tproxy                    *:*                         LISTEN      21606/httpd         
tcp        0      0 *:domain                    *:*                         LISTEN      16513/named         
tcp        0      0 *:ftp                       *:*                         LISTEN      16458/pure-ftpd (SE 
tcp        0      0 localhost6.localdomain:rndc *:*                         LISTEN      16513/named         
tcp        0   2880 Webserver002:work-sol       ip8a.direct-ads:49670 ESTABLISHED 28374/sshd: max [pr

iptables -L:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
RH-Firewall-1-INPUT  all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
RH-Firewall-1-INPUT  all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     icmp --  anywhere             anywhere            icmp any 
ACCEPT     esp  --  anywhere             anywhere            
ACCEPT     ah   --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:mysql 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:telnet 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:smtp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

[falko]

Can you disable the firewall for testing purposes?

[Maxman1850]

Yes, I can, I will check if it'll work when it's disabled

[Maxman1850]

Nope, even when the firewall is fully disabled I get the same errors.. Looks like it's not a firewall problem..?

[mike_p]

In your mail client (Mail for Mac?) what address have you given for the SMTP server?
Have you correctly setup dns for that address?

[Maxman1850]

I've given my normal domain name and smtp.domain.tld, I think my DNS is alright but now I'm beginning to doubt it.. Should I post my DNS records?

[gertk]

You can try to add to main.cf file your server external ip or network address,
for example address 10.0.0.0/29

main.cf file:
mynetworks = 127.0.0.0/8 [::1]/128 10.0.0.0/29

[mike_p]

Originally Posted by Maxman1850

I've given my normal domain name and smtp.domain.tld

So you've set up a dns A record for either smtp.domain.tld or a wildcard (*.domain.tld)?
If not simply use domain.tld as the smtp server address in your mail client.
(or even just use the server's IP address)