Troubleshooting
If you are having trouble receiving or sending email you may try these general steps:
Check your /var/log/mail.log. 93.7% of all problems cause a more or less clear error message there. :)
- Run postfix check. No output means everything is well.
- Ask on the #postfix IRC channel on irc.freenode.net. I usually attend there as Signum but please just ask and wait for people to help you. Especially read the hints in the channel's topic and my hints on how to get useful help on IRC.
- Ask on the forums.
- Check the (deprecated) workaround chitchat mailing list archives
- This tutorial is meant for Debian 5.0 "Lenny". If you are trying this setup on any other distribution you are completely on your own.
-
List contents of the mail queue (add -v to be more verbose, add multiple -v's for increased verbosity):
mailq or postqueue -pSchedule immediate delivery of all mail that is queued:
Amavis:
mailq -q
/etc/init.d/amavisd-new stop
/etc/init.d/amavisd-new debug
Sending an email directly to the author asking for help is the worst choice. Sending an email directly to the author giving suggestions or feedback is a good choice. :)
The contents of this web site is Copyright © 2000-2011 Christoph Haas - Impressum/Imprints - Donations welcome
Drupal theme by Kiwi Themes.
22 comments
ISPs blocking port 25
After following this tutorial I managed to get e-mail working on my internal network. I then paid for a domain and set up my MX records and could receive external mail. I however have hit a problem in sending external mail. I have discovered that most large ISPs block outgoing connections on port 25 to stop hackers turning peoples computers into spam bots
This error caused a lot of “no route to host” errors in my log file. You can check if your ISP has blocked port 25 by simply trying to connect to an external mail account (such as Hotmail) with:
telnet mx1.hotmail.com 25
This is obviously very frustrating for legitimate users but what can you do? I’ll have to wait for my contract to expire with my ISP and look for one that has port 25 open and hope they don’t close it
Just thought it may be useful to mention to your readers. Thanks for a great tutorial anyway, I’m sure it will come in useful when I finally get an ISP which allows for me to send outgoing e-mail!
Regards, Kieren Searle
relayhost!
Ask your ISP about their mail relay and set it as "relayhost=..." in your /etc/postfix/main.cf. That way you will forward all outgoing email through your ISP. If in addition your ISP forces your to authenticate then see http://www.postfix.org/SASL_README.html#client_sasl
Good luck!
Christoph
Improving MTA Reputation?
This is the mail system at host wind.localdomain. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system
refused to talk to me: 554-p3pismtp01-029.prod.phx3.secureserver.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.
32 bit and 64 bit
"This tutorial is meant for Debian 5.0 "Lenny". "
Is this tutorial good for 64 bit versions as it is, or 64 bit requires a bit of customization?
Other that that, this is great stuff.
Thanks Christoph.
Nothing special
There is nothing special about 64 bit installations. Your Debian installation automatically pulls in the right packages for your architecture depending on which installation media you used originally.
syslog spam
Hi Christoph,
my syslog has increased by about 600 MB this day!
There are millions of messages like this: Feb 16 21:20:39 vs2227 postfix/error[3545]: 2BF238F8C11: to=<smile7380@yahoo.com.tw>, relay=none, delay=298189, delays=298149/37/0/3.2, dsn=4.7.1, status=deferred (delivery temporarily suspended: host mx2.mail.tw.yahoo.com[203.188.197.10] refused to talk to me: 421 4.7.1 [TS03] All messages from <myip> will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/421-ts03.html)
The mail queue seems not to end including entries like this:
3B3213041279* 5588 Fri Feb 12 18:58:46 edizii@ms34.hinet.net
shower-18@yahoo.com.tw
superloversaiko@yahoo.com.tw
tina123008@yahoo.com.tw
travelblueway@yahoo.com.tw
uncle_koh@yahoo.com.tw
uxcountry@yahoo.com.tw
w19791113@yahoo.com.tw
wc438@yahoo.com.tw
wentunjoy@yahoo.com.tw
wuyuss@yahoo.com.tw
p897040@yahoo.com.tw
veryhappysnow@yahoo.com.tw
wiltproof@yahoo.com.tw
Do I have an error in my configuration?
Kind regards
Oliver
Eeek
That doesn't look good at all. Please immediately check that you are not an open relay:
$> telnet relay-test.mail-abuse.org
(Takes a moment until you see the check results.)
Check where the emails are coming from. Either you are an open relay (the above will tell you) or you have a broken web application that someone abuses to induce emails into your system.
Unusual?
The telnet test returned "System appeared to reject relay attempts".
I have a lot of these entries in my syslog, too:
Feb 16 21:48:17 vs2227 postfix/smtpd[19565]: NOQUEUE: reject: RCPT from 114-36-18-18.dynamic.hinet.net[114.36.18.18]: 554 5.7.1 <http41021@yahoo.com.tw>: Relay access denied; from=<gvatxkqwhulkgn@ms49.hinet.net> to=<http41021@yahoo.com.tw> proto=SMTP helo=<<myip>>
The relay access is denied, but I wonder why every try is logged... is it unusual that servers to to use my server as mail relay every second?
Kind regards
Oliver
Unusual indeed
Yes, totally unusual. I get an illegal relay attempt very now and then, too, but not every second. "gvatxkqwhulkgn@ms49.hinet.net" looks like a typical random spammer address so that's likely spam. As long as you reject those attempts everything is fine. I'm worried though about your full mail queue.
dynamic.hinet.net
I've deleted my whole mail queue in order to see, because it looks like most of the entries are some days old and I configured a lot during the last days...
dynamic.hinet.net seems to be a very dump spam bot, ignoring that relay access is denied on my server. The best solution is to block these attempts in the firewall, isn't it? Or does postfix offer something like a blacklist where I can add rthe host.
Some more information concerning this can be found here (German.
Kind regards
Oliver
Client access
First thing I saw was bogus HELO strings that the remote host was sending. I just know two cases where the HELO string is something random like "HOAGJW" and not something smart like "mx.workaround.org":
My suggestion:
smtpd_helo_restrictions =
permit_mynetworks
permit_sasl_authenticated
reject_non_fqdn_hostname
reject_invalid_hostname
This way you allow authenticated users to pass by this restriction (Outl**k) but otherwise require fully qualified hostnames in the HELO string.
Secondly - regarding your question whether you can block certain IP addresses - you need to add check_client_access in the right place. For example this is part of my configuration:
smtpd_client_restrictions =
sleep 1
permit_sasl_authenticated
check_client_access hash:/etc/postfix/client_access
reject_unauth_pipelining
reject_rbl_client bl.spamcop.net
reject_rbl_client sbl-xbl.spamhaus.org
reject_rbl_client zen.spamhaus.org
And my /etc/postfix/client_access file contains lines like:
web.de OK common ISP that is sometimes blocked by the SORBS blacklist
mail01.hansenet.de OK accidentally blocked by the spamcop blacklist
mail02.hansenet.de OK accidentally blocked by the spamcop blacklist
mail03.hansenet.de OK accidentally blocked by the spamcop blacklist
mail04.hansenet.de OK accidentally blocked by the spamcop blacklist
adsl.tpnet.pl REJECT Please send mail through your internet provider's mail relay. Thanks.
adsl.uni2.pl REJECT Please send mail through your internet provider's mail relay. Thanks.
ppp.tiscali.fr REJECT Please send mail through your internet provider's mail relay. Thanks.
home.ne.jp REJECT Please send mail through your internet provider's mail relay. Thanks.
202.73.32.0/20 REJECT We received too much spam from your network range. If you have questions please contact postmaster@workaround.org
(Don't forget to "postmap /etc/postfix/client_access" after changing this file.)
Such a configuration helps you deal with attackers easily. To be politically correct you would actually need a check_recipient_access before rejecting any IP address to make sure you always receive abuse@ and postmaster@ mails.
(Hmmm, I should write a proper page on smtpd_* restrictions.)
fail2ban
I will try to do so this evening...
What about fail2ban... seems to be an easy dynamic/learning solution. fail2ban scans the logs and updates firewall rules to reject the IP address.I know this solution is on a lower level as requests from the "spam hosts" are rejected by the firewall and won't be passed to postfix.
An additional chapter concerning smtpd_* restrictions would be great. I think security is the most important factor concerning a mail server... even more important than somme adittional features.
Kind regards
Oliver
Tiny fail2ban tutorial
Hello everyone, I've tested fail2ban and it solved all myproblems ;-) I would like to give you a tiny tutorial how to set up fail2ban (for iptables) within 5 minutes.
enabled = true maxretry = 1 // Defines the number of tries until the ip will be banned
bantime = 86400 // How long (in seconds) should an ip be banned? (86400 = 1 day)
One additional comment:
/etc/fail2ban/filter.d/postfix.conf contains the regexp which matches ips which cause an 554 (relay access) error (failregex = reject: RCPT from (.*)\[\]: 554)
Good luck!
Oliver
fail2ban => dovecot
Hello Oliver,
thanks a lot for the idea of using fail2ban. While executing the great ISP-Mail Tutorial I left a "tail -f var/log/mail.log" window open to see what my server does. Unfortunately I already picked up some guy from Romaina (WHOIS - 89.33.79.173 - Location: Romania (high) [City: Bucharest, Bucuresti]) bruteforcing various login/pw combinations. fail2ban cut him off, and this is what I have been doing to get it work (googled for some hints):
$> aptitude install fail2ban
$> nano /etc/fail2ban/filter.d/dovecot-pop3imap.conf
[Definition]
failregex = (?: pop3-login|imap-login): (?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
ignoreregex =
$> nano /etc/fail2ban/jail.conf
### append in Section "MailServer":
[dovecot-pop3imap]
enabled = true
filter = dovecot-pop3imap
action = iptables-multiport[name=dovecot-pop3imap, port="pop3,imap", protocol=tcp]
logpath = /var/log/mail.log
maxretry = 10
findtime = 1200
bantime = 1200
$> fail2ban-client reload
$> iptables -L -n
fail2ban-dovecot-pop3imap tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 110,143
$> cat /var/log/fail2ban.log
...
2010-05-16 01:41:39,011 fail2ban.actions: WARNING [dovecot-pop3imap] Ban 89.33.79.173
so the "Cracker" has been banned from the System after 10 failed login attempts.
Great Tool ^^
Have FUN out there ;)
Yours,
Peter.
P.S.: Christoph, thanks a LOT for your fine tutorial! Although I had to adopt it a little for my "Lucid" Server, I found it very interesting and a really rewarding task to get the different daemons up and running!
smtp_bind_address
Hi,
Thanks for your job, it really helped me ;)
I followed your toturial and on the server I use it I have several network interfaces and I would like to set postfix to
use just one interface for outgoing connections.
On the internet I found that this was done by smtp_bind_address = 1.2.3.4
where 1.2.3.4 its the interface IP. When I use it mail.log tells me:
Jun 3 16:14:38 sleipnir amavis[25373]: (25373-19) (!)DENIED ACCESS from IP 1.2.3.4, policy bank ''
I thinks this could come from the connections between postfix and amavis, setting this, that connections can not be done
, its just an idea, not shure.
I found that people with same problem included on -o mynetworks on master.cf tha IP of that interface, but also with this the mail system
doesn't send the emails.
What I can do¿?
Thanks and regards,
Alberto M.
Re:
Relay access denied
Hi,
Trying to setup mail aliases. I have user@example.com as the canonnical address, with user@example.co.uk as the alias. Locally this works, and mail send to the .co.uk address lands in the .com mailbox. But externally, I get "Undelivered Mail Returned to Sender", here's an example:-
Any assistance would be greatly appreciated. You can also find me on irc.freenode.net nick n1md4.
Thanks,
Jon
Problems with sending mails if mysql fails
I found, if mysql failed, my nagios, that hosted on the same server could not send notification to me, because it as database for mapppings.
I think that postfix could make exceptions for some emails, to send messages without using database.
It will be reallly great, If you help me.
It is not critical now, because I have xmpp notifications too.
postconf -e not working
For some reason my previous comment didn't appear.
Anyway, I'm having issues altering my (working) postfix setup. I tried this:
Doh !
Ok, so figured this out ...
"postconf -d" will display the *default* values. My setting did actually work:
# postconf | grep maximal_queue_lifetime
maximal_queue_lifetime = 1
User without Domain not working
Hi,
if i follow this tutorial which is great, i am unable to have a user without a domain, eg
mysql> select * from virtual_aliases ;
| 3 | 1 | volker@test.domain.de | volker |
If i send a mail to volker@test.domain.de i get the following error:
Jan 12 14:41:46 mail postfix/pickup[1459]: C6BE9A0E37: uid=0 from=<root>
Jan 12 14:41:46 mail postfix/cleanup[1464]: C6BE9A0E37: message-id=<20120112134146.C6BE9A0E37@test.domain.de>
Jan 12 14:41:46 mail postfix/qmgr[1460]: C6BE9A0E37: from=<root@test.domain.de>, size=482, nrcpt=1 (queue active)
Jan 12 14:41:46 mail postfix/local[1466]: C6BE9A0E37: to=<volker@test.domain.de>, orig_to=<volker@test.domain.de>, relay=local, delay=0.04, delays=0.03/0.01/0/0
.01, dsn=5.1.1, status=bounced (unknown user: "volker")
Waht do i have to set in main.cf to send mails to users without domain name if possible?
Regards
Your logs read "relay=local"
Your logs read "relay=local" which means that the user "volker" is looked for on your system. As you don't have a user "volker" in your /etc/passwd the delivery fails.
Technically you won't send an email to a user without a domain. Instead the domain is automatically added. In your example the domain "test.domain.de" seems to be your local domain.
Please re-read the chapter on virtual versus local domains. That should clear it up.