Postfix: relay access denied

Discussion in 'Installation/Configuration' started by Maxman1850, Dec 15, 2011.

  1. Maxman1850

    Maxman1850 New Member

    Hi guys,

    I'm desperately trying to make my SMTP server work correctly but he seems to be not listening to me.

    When I send an e-mail from the webmail he sends it correctly. But when I try to connect with Mail (for Mac) I get an error that the SMTP server is offline.

    Also when I check my SMTP server with this tool: http://www.mxtoolbox.com/
    I get the following error:

    Code:
    HELO please-read-policy.mxtoolbox.com
    250 Webserver002 [125 ms]
    MAIL FROM: <supertool@mxtoolbox.com>
    250 2.1.0 Ok [218 ms]
    RCPT TO: <test@example.com>
    554 5.7.1 <test@example.com>: Relay access denied [140 ms]
    QUIT
    221 2.0.0 Bye [140 ms]
    
    The maillog looks like this:
    Code:
    Dec 15 19:17:53 Webserver002 postfix/smtpd[26175]: warning: 64.20.227.133: address not listed for hostname recover.mxtoolbox.com
    Dec 15 19:17:53 Webserver002 postfix/smtpd[26175]: connect from unknown[64.20.227.133]
    Dec 15 19:17:53 Webserver002 postfix/smtpd[26175]: NOQUEUE: reject: RCPT from unknown[64.20.227.133]: 554 5.7.1 <test@example.com>: Relay access denied; from=<supertool@mxtoolbox.com> to=<test@example.com> proto=SMTP helo=<please-read-policy.mxtoolbox.com>
    Dec 15 19:17:53 Webserver002 postfix/smtpd[26175]: disconnect from unknown[64.20.227.133]
    
    My main.cf looks like this:

    Code:
    myhostname = Webserver002
    mynetworks = 127.0.0.0/8 [::1]/128
    virtual_alias_domains =
    virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, mysql:/etc/postfix/mysql-virtual_email2email.cf
    virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
    virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
    virtual_mailbox_base = /var/vmail
    virtual_uid_maps = static:5000
    virtual_gid_maps = static:5000
    smtpd_sasl_auth_enable = yes
    broken_sasl_auth_clients = yes
    smtpd_sasl_authenticated_header = yes
    smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_recipient_access mysql:/etc/postfix/mysql-virtual_recipient.cf, reject_unauth_destination
    smtpd_use_tls = yes
    smtpd_tls_security_level = may
    smtpd_tls_cert_file = /etc/postfix/smtpd.cert
    smtpd_tls_key_file = /etc/postfix/smtpd.key
    transport_maps = proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
    relay_domains = mysql:/etc/postfix/mysql-virtual_relaydomains.cf
    relay_recipient_maps = mysql:/etc/postfix/mysql-virtual_relayrecipientmaps.cf
    proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $virtual_mailbox_limit_maps
    smtpd_sender_restrictions = check_sender_access mysql:/etc/postfix/mysql-virtual_sender.cf
    smtpd_client_restrictions = check_client_access mysql:/etc/postfix/mysql-virtual_client.cf
    maildrop_destination_concurrency_limit = 1
    maildrop_destination_recipient_limit = 1
    virtual_transport = dovecot
    header_checks = regexp:/etc/postfix/header_checks
    mime_header_checks = regexp:/etc/postfix/mime_header_checks
    nested_header_checks = regexp:/etc/postfix/nested_header_checks
    body_checks = regexp:/etc/postfix/body_checks
    dovecot_destination_recipient_limit = 1
    smtpd_sasl_type = dovecot
    smtpd_sasl_path = private/auth
    receive_override_options = no_address_mappings
    content_filter = amavis:[127.0.0.1]:10024
    relayhost =
    mailbox_size_limit = 0
    message_size_limit = 0
    
    Can please someone help me to find the solution for this?

    Thanks for your help!

    Max
     
  2. falko

    falko Super Moderator

    What are the outputs of
    Code:
    netstat -tap
    and
    Code:
    iptables -L
    ?
     
  3. Maxman1850

    Maxman1850 New Member

    Netstat -tap:
    Code:
    Active Internet connections (servers and established)
    Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
    tcp        0      0 *:imaps                     *:*                         LISTEN      16423/dovecot       
    tcp        0      0 *:pop3s                     *:*                         LISTEN      16423/dovecot       
    tcp        0      0 Webserver002:10024          *:*                         LISTEN      18387/amavisd (mast 
    tcp        0      0 Webserver002:10025          *:*                         LISTEN      26171/master        
    tcp        0      0 *:mysql                     *:*                         LISTEN      16285/mysqld        
    tcp        0      0 *:pop3                      *:*                         LISTEN      16423/dovecot       
    tcp        0      0 Webserver002:dyna-access    *:*                         LISTEN      16410/clamd         
    tcp        0      0 *:imap                      *:*                         LISTEN      16423/dovecot       
    tcp        0      0 *:sunrpc                    *:*                         LISTEN      2768/portmap        
    tcp        0      0 *:723                       *:*                         LISTEN      9445/rpc.statd      
    tcp        0      0 Webserver002:domain         *:*                         LISTEN      16513/named         
    tcp        0      0 Webserver002:domain         *:*                         LISTEN      16513/named         
    tcp        0      0 *:ftp                       *:*                         LISTEN      16458/pure-ftpd (SE 
    tcp        0      0 *:smtp                      *:*                         LISTEN      26171/master        
    tcp        0      0 Webserver002:rndc           *:*                         LISTEN      16513/named         
    tcp        0      0 Webserver002:imap           ip8a.direct-ads:49231 ESTABLISHED 28086/imap          
    tcp        0      0 Webserver002:imap           ip8a.direct-ads:49228 ESTABLISHED 28053/imap          
    tcp        0      0 Webserver002:imap           ip8a.direct-ads:49217 ESTABLISHED 28051/imap          
    tcp        0      0 Webserver002:imap           ip8a.direct-ads:49239 ESTABLISHED 28088/imap          
    tcp        0      0 *:imaps                     *:*                         LISTEN      16423/dovecot       
    tcp        0      0 *:pop3s                     *:*                         LISTEN      16423/dovecot       
    tcp        0      0 *:pop3                      *:*                         LISTEN      16423/dovecot       
    tcp        0      0 *:imap                      *:*                         LISTEN      16423/dovecot       
    tcp        0      0 *:webcache                  *:*                         LISTEN      21606/httpd         
    tcp        0      0 *:http                      *:*                         LISTEN      21606/httpd         
    tcp        0      0 *:work-sol                  *:*                         LISTEN      1971/sshd           
    tcp        0      0 *:tproxy                    *:*                         LISTEN      21606/httpd         
    tcp        0      0 *:domain                    *:*                         LISTEN      16513/named         
    tcp        0      0 *:ftp                       *:*                         LISTEN      16458/pure-ftpd (SE 
    tcp        0      0 localhost6.localdomain:rndc *:*                         LISTEN      16513/named         
    tcp        0   2880 Webserver002:work-sol       ip8a.direct-ads:49670 ESTABLISHED 28374/sshd: max [pr 
    
    iptables -L:
    Code:
    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination         
    RH-Firewall-1-INPUT  all  --  anywhere             anywhere            
    
    Chain FORWARD (policy ACCEPT)
    target     prot opt source               destination         
    RH-Firewall-1-INPUT  all  --  anywhere             anywhere            
    
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination         
    
    Chain RH-Firewall-1-INPUT (2 references)
    target     prot opt source               destination         
    ACCEPT     all  --  anywhere             anywhere            
    ACCEPT     all  --  anywhere             anywhere            
    ACCEPT     icmp --  anywhere             anywhere            icmp any 
    ACCEPT     esp  --  anywhere             anywhere            
    ACCEPT     ah   --  anywhere             anywhere            
    ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns 
    ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp 
    ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp 
    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
    ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:mysql 
    ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
    ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:telnet 
    ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:smtp 
    ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http 
    ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp 
    ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https 
    REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 
    
     
  4. falko

    falko Super Moderator

    Can you disable the firewall for testing purposes?
     
  5. Maxman1850

    Maxman1850 New Member

    Yes, I can, I will check if it'll work when it's disabled
     
  6. Maxman1850

    Maxman1850 New Member

    Nope, even when the firewall is fully disabled I get the same errors.. Looks like it's not a firewall problem..?
     
  7. mike_p

    mike_p New Member

    In your mail client (Mail for Mac?) what address have you given for the SMTP server?
    Have you correctly setup dns for that address?
     
  8. Maxman1850

    Maxman1850 New Member

    I've given my normal domain name and smtp.domain.tld, I think my DNS is alright but now I'm beginning to doubt it.. Should I post my DNS records?
     
  9. gertk

    gertk New Member

    You can try to add to main.cf file your server external ip or network address,
    for example address 10.0.0.0/29

    main.cf file:
    mynetworks = 127.0.0.0/8 [::1]/128 10.0.0.0/29
     
  10. mike_p

    mike_p New Member

    So you've set up a dns A record for either smtp.domain.tld or a wildcard (*.domain.tld)?
    If not simply use domain.tld as the smtp server address in your mail client.
    (or even just use the server's IP address)
     
  11. falko

    falko Super Moderator

    Yes, please try the server's IP address to rule out any DNS misconfigurations.
     

Share This Page