Troubleshooting

If you are having trouble receiving or sending email you may try these general steps:
Check your /var/log/mail.log. 93.7% of all problems cause a more or less clear error message there. :)

  • Run postfix check. No output means everything is well.
  • Ask on the #postfix IRC channel on irc.freenode.net. I usually attend there as Signum but please just ask and wait for people to help you. Especially read the hints in the channel's topic and my hints on how to get useful help on IRC.
  • Ask on the forums.
  • Check the (deprecated) workaround chitchat mailing list archives
  • This tutorial is meant for Debian 5.0 "Lenny". If you are trying this setup on any other distribution you are completely on your own.
  • List contents of the mail queue (add -v to be more verbose, add multiple -v's for increased verbosity):
    mailq or postqueue -p

    Schedule immediate delivery of all mail that is queued:
    mailq -q

    Amavis:
    /etc/init.d/amavisd-new stop
    /etc/init.d/amavisd-new debug

Sending an email directly to the author asking for help is the worst choice. Sending an email directly to the author giving suggestions or feedback is a good choice. :)

22 Comments

ISPs blocking port 25

After following this tutorial I managed to get e-mail working on my internal network. I then paid for a domain and set up my MX records and could receive external mail. I however have hit a problem in sending external mail. I have discovered that most large ISPs block outgoing connections on port 25 to stop hackers turning peoples computers into spam bots

 

This error caused a lot of “no route to host” errors in my log file. You can check if your ISP has blocked port 25 by simply trying to connect to an external mail account (such as Hotmail) with:

 

telnet mx1.hotmail.com 25

 

This is obviously very frustrating for legitimate users but what can you do? I’ll have to wait for my contract to expire with my ISP and look for one that has port 25 open and hope they don’t close it

 

Just thought it may be useful to mention to your readers. Thanks for a great tutorial anyway, I’m sure it will come in useful when I finally get an ISP which allows for me to send outgoing e-mail!

 

Regards, Kieren Searle

Improving MTA Reputation?

This is the mail system at host wind.localdomain. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system  

 

refused to talk to me: 554-p3pismtp01-029.prod.phx3.secureserver.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.

	Reporting-MTA: dns; wind.localdomain


What is the problem? How to change my MTA reputation? Thanks.

32 bit and 64 bit

"This tutorial is meant for Debian 5.0 "Lenny". "

Is this tutorial good for 64 bit versions as it is, or 64 bit requires a bit of customization?

Other that that, this is great stuff.

Thanks Christoph.

syslog spam

Hi Christoph,

 

my syslog has increased by about 600 MB this day!

There are millions of messages like this: Feb 16 21:20:39 vs2227 postfix/error[3545]: 2BF238F8C11: to=<smile7380@yahoo.com.tw>, relay=none, delay=298189, delays=298149/37/0/3.2, dsn=4.7.1, status=deferred (delivery temporarily suspended: host mx2.mail.tw.yahoo.com[203.188.197.10] refused to talk to me: 421 4.7.1 [TS03] All messages from <myip> will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/421-ts03.html)
 

The mail queue seems not to end including entries like this:

3B3213041279*    5588 Fri Feb 12 18:58:46  edizii@ms34.hinet.net
                                         shower-18@yahoo.com.tw
                                         superloversaiko@yahoo.com.tw
                                         tina123008@yahoo.com.tw
                                         travelblueway@yahoo.com.tw
                                         uncle_koh@yahoo.com.tw
                                         uxcountry@yahoo.com.tw
                                         w19791113@yahoo.com.tw
                                         wc438@yahoo.com.tw
                                         wentunjoy@yahoo.com.tw
                                         wuyuss@yahoo.com.tw
                                         p897040@yahoo.com.tw
                                         veryhappysnow@yahoo.com.tw
                                         wiltproof@yahoo.com.tw
 

Do I have an error in my configuration?

Kind regards

Oliver

Unusual?

The telnet test returned "System appeared to reject relay attempts".

I have a lot of these entries in my syslog, too:

Feb 16 21:48:17 vs2227 postfix/smtpd[19565]: NOQUEUE: reject: RCPT from 114-36-18-18.dynamic.hinet.net[114.36.18.18]: 554 5.7.1 <http41021@yahoo.com.tw>: Relay access denied; from=<gvatxkqwhulkgn@ms49.hinet.net> to=<http41021@yahoo.com.tw> proto=SMTP helo=<<myip>>


The relay access is denied, but I wonder why every try is logged... is it unusual that servers to to use my server as mail relay every second?

Kind regards

Oliver

dynamic.hinet.net

I've deleted my whole mail queue in order to see, because it looks like most of the entries are some days old and I configured a lot during the last days...

dynamic.hinet.net seems to be a very dump spam bot, ignoring that relay access is denied on my server. The best solution is to block these attempts in the firewall, isn't it? Or does postfix offer something like a blacklist where I can add rthe host.

Some more information concerning this can be found here (German.

Kind regards

Oliver

fail2ban

I will try to do so this evening...

What about fail2ban... seems to be an easy dynamic/learning solution. fail2ban scans the logs and updates firewall rules to reject the IP address.I know this solution is on a lower level as requests from the "spam hosts" are rejected by the firewall and won't be passed to postfix.

An additional chapter concerning smtpd_* restrictions would be great. I think security is the most important factor concerning a mail server... even more important than somme adittional features.

Kind regards

Oliver

Tiny fail2ban tutorial

Hello everyone, I've tested fail2ban and it solved all myproblems ;-) I would like to give you a tiny tutorial how to set up fail2ban (for iptables) within 5 minutes.

  1. Install fail2ban: aptitude install fail2ban
  2. Create custom config file: touch /etc/fail2ban/jail.local
  3. Add the following lines to /etc/fail2ban/jail.local: [postfix]
    enabled = true maxretry = 1 // Defines the number of tries until the ip will be banned
    bantime = 86400 // How long (in seconds) should an ip be banned? (86400 = 1 day)
  4. Reload configuration: fail2ban-client reload
  5. Check iptables: iptables -L -n You should find an entry like this: Chain fail2ban-postfix
  6. That's it

One additional comment:

/etc/fail2ban/filter.d/postfix.conf contains the regexp which matches ips which cause an 554 (relay access) error (failregex = reject: RCPT from (.*)\[\]: 554)

If you want to ban all ips which cause an fatal error (5xx) use this regexp: failregex = reject: RCPT from (.*)\[\]: 5[05][0-4]. I did so and it just works.

I hope this helps.

Btw. fail2ban offers a lot of features... you can parse other logs as well, there are many predefined regexps for Apache, Exim, ssh,...

Good luck!
Oliver

fail2ban => dovecot

Hello Oliver,

thanks a lot for the idea of using fail2ban. While executing the great ISP-Mail Tutorial I left a "tail -f var/log/mail.log" window open to see what my server does. Unfortunately I already picked up some guy from Romaina (WHOIS - 89.33.79.173 - Location: Romania (high) [City: Bucharest, Bucuresti]) bruteforcing various login/pw combinations. fail2ban cut him off, and this is what I have been doing to get it work (googled for some hints):

$> aptitude install fail2ban
$> nano /etc/fail2ban/filter.d/dovecot-pop3imap.conf
[Definition]
failregex = (?: pop3-login|imap-login): (?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
ignoreregex =

$> nano /etc/fail2ban/jail.conf
### append in Section "MailServer":
[dovecot-pop3imap]
enabled = true
filter = dovecot-pop3imap
action = iptables-multiport[name=dovecot-pop3imap, port="pop3,imap", protocol=tcp]
logpath = /var/log/mail.log
maxretry = 10
findtime = 1200
bantime = 1200

$> fail2ban-client reload
$> iptables -L -n
fail2ban-dovecot-pop3imap  tcp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 110,143
$> cat /var/log/fail2ban.log
...
2010-05-16 01:41:39,011 fail2ban.actions: WARNING [dovecot-pop3imap] Ban 89.33.79.173

so the "Cracker" has been banned from the System after 10 failed login attempts.

Great Tool ^^

Have FUN out there ;)

Yours,
Peter.

P.S.: Christoph, thanks a LOT for your fine tutorial! Although I had to adopt it a little for my "Lucid" Server, I found it very interesting and a really rewarding task to get the different daemons up and running!

smtp_bind_address

Hi,

Thanks for your job, it really helped me ;)

I followed your toturial and on the server I use it I have several network interfaces and I would like to set postfix to

use just one interface for outgoing connections.

On the internet I found that this was done by smtp_bind_address = 1.2.3.4

where 1.2.3.4 its the interface IP. When I use it mail.log tells me:

Jun  3 16:14:38 sleipnir amavis[25373]: (25373-19) (!)DENIED ACCESS from IP 1.2.3.4, policy bank ''

I thinks this could come from the connections between postfix and amavis, setting this, that connections can not be done

, its just an idea, not shure.

I found that people with same problem included on -o mynetworks on master.cf tha IP of that interface, but also with this the mail system

doesn't send the emails.

 

What I can do¿?

Thanks and regards,

Alberto M.

Re:


If some one has more than one network interface and wants to configure the mail system(configured like this tutorial) to use one especific network interface for outgoing connections they need to set: 
/etc/amavis/conf.d/01-debian
@inet_acl = qw( 127.0.0.0/8 1.2.3.4/32 );

and on /etc/postfix/main.cf
inet_interfaces = 1.2.3.4, 127.0.0.1
smtp_bind_address = 1.2.3.4

Regards,
Alberto M.




Relay access denied

Hi,

 

  Trying to setup mail aliases.  I have user@example.com as the canonnical address, with user@example.co.uk as the alias.  Locally this works, and mail send to the .co.uk address lands in the .com mailbox.  But externally, I get "Undelivered Mail Returned to Sender", here's an example:-

host mail.example.co.uk [X.X.X.X] said: 554 5.7.1 user@example.co.uk: Relay access denied (in reply to RCPT TO command)

 

Any assistance would be greatly appreciated.  You can also find me on irc.freenode.net nick n1md4.

 

Thanks,

Jon

Problems with sending mails if mysql fails

I found, if mysql failed, my nagios, that hosted on the same server could not send notification to me, because it as database for mapppings.

I think that postfix could make exceptions for some emails, to send messages without using database.

It will be reallly great, If you help me.

It is not critical now, because I have xmpp notifications too.

postconf -e not working

For some reason my previous comment didn't appear.

Anyway, I'm having issues altering my (working) postfix setup. I tried this:

 

#  postconf -e maximal_queue_lifetime=1d
#  postconf -d | grep maximal_queue_lifetime
maximal_queue_lifetime = 5d
 
#  postfix reload
postfix/postfix-script: refreshing the Postfix mail system
# postconf -d | grep maximal_queue_lifetime
maximal_queue_lifetime = 5d
 
I also tried with ' ' and " " - no change. 
 
Can anyone tell me what I did wrong ? Many thanks !

Doh !

Ok, so figured this out ...

"postconf -d" will display the *default* values. My setting did actually work:

# postconf | grep maximal_queue_lifetime
maximal_queue_lifetime = 1

User without Domain not working

Hi,

if i follow this tutorial which is great, i am unable to have a user without a domain, eg

mysql> select * from virtual_aliases ;

|  3 |         1 | volker@test.domain.de | volker                    |

If i send a mail to volker@test.domain.de i get the following error:

 

Jan 12 14:41:46 mail postfix/pickup[1459]: C6BE9A0E37: uid=0 from=<root>
Jan 12 14:41:46 mail postfix/cleanup[1464]: C6BE9A0E37: message-id=<20120112134146.C6BE9A0E37@test.domain.de>
Jan 12 14:41:46 mail postfix/qmgr[1460]: C6BE9A0E37: from=<root@test.domain.de>, size=482, nrcpt=1 (queue active)
Jan 12 14:41:46 mail postfix/local[1466]: C6BE9A0E37: to=<volker@test.domain.de>, orig_to=<volker@test.domain.de>, relay=local, delay=0.04, delays=0.03/0.01/0/0
.01, dsn=5.1.1, status=bounced (unknown user: "volker")

Waht do i have to set in main.cf to send mails to users without domain name if possible?

Regards