Troubleshooting your mail server

General troubleshooting tips

  • Run “postfix check” to make Postfix look for obvious configuration errors. If it returns no output then no problem was found.
  • Read your /var/log/mail.log and look for warnings and errors.

Postfix keeps unwanted emails in the queue

Check that you do not keep soft_bounce enabled. If “postconf soft_bounce” shows “yes” then run “postconf soft_bounce=no”.

I get “Permission denied” from Dovecot in the mail.log file

You have the permissions wrong. Run:

chown -R vmail:vmail /var/vmail

Postfix says: “Mail loops back to myself”

Postfix tried to send an email to the internet because it did not feel responsible for the recipient’s domain. However DNS records pointed it back to itself. So either your DNS record for a certain domain is wrong (unlikely) or your Postfix refuses to receive email for the given domain (very likely). Check that the recipient’s domain is listed in the “virtual_domains” table in the MySQL database. And verify that your CF files are working correctly

28 thoughts on “Troubleshooting your mail server

  • 2015-12-17 at 18:12
    Permalink

    Hello. First let me say that your guides are the best and they are very much appreciated. I have used the squeeze guide and it has been working perfectly for the past few years. Now I decided to follow this guide and everything works fine except the fact that when I login to Roundcube, the email is username@localhost. And when the emails leave, they leave as username@localhost.

    Any thoughts?

    Reply
    • 2015-12-17 at 18:52
      Permalink

      I figured it out and in case someone needs it, just add a new variable in the $config array of roundcube in the file /etc/roundcube/config.inc.php like this:
      $config[‘username_domain’] = array(‘servername’=>’domain.org’,’127.0.0.1’=>’domain.org’,’localhost’=>’domain.org’);

      Reply
  • 2016-01-01 at 16:34
    Permalink

    Hallo Christoph,

    this wonderful guide helped me to build a personal mail server from scratch. Everything is working like a charm and mails can be received and sent using various clients. The only thing missing now is making the MX-record of my domain point to the new server, so that it becomes the primary mail host.

    Before I do so, I’d like to ask you why both – gmail and hotmail – consider mails being sent via this new host as SPAM? Could it be caused by the mismatch in the domain’s mx-record which currently does not point to the new server? I don’t see no other cause, the headers are clean otherwise.

    Viele Grüße und Frohes Neues!

    Christoph

    Reply
  • 2016-01-01 at 19:21
    Permalink

    @Christoph: thanks for the feedback. Nice to hear everything worked well and the time was well-invested. The problem you are facing with GMail and Hotmail is not uncommon. Such large ISPs usually have their own black lists and score IP addresses. A well-known scoring service is https://www.senderscore.org/. I wouldn’t give them money – I don’t like their business model. But you can at least enter your IP address and find out if it’s ocnsidered neutral, good or bad.

    My strategy for introducing a new mail relay is to slowly warm it up. If you send too many emails per time unit and the ISPs never received emails from that gateway then they will be suspicious and quickly throttle the amount of email they take from you.

    Reply
  • 2016-01-08 at 00:56
    Permalink

    Hi Christoph, thank you very much for this how-to! So far, everything is working fine except one thing: When I tell sieve to forward a certain message, I get

    postfix/sendmail[18905]: fatal: open /etc/postfix/main.cf: Permission denied

    It seems like sendmail implementation is part of postfix, but then I don’t know why it can’t access the file. The permissions are:

    /etc # ls -l | grep postfix
    drwxr-x— 1 root postfix 712 7. Jan 22:55 postfix

    /etc/postfix # ls -l grep main.cf
    -rw-r—– 1 root postfix 28020 7. Jan 04:45 main.cf

    Do you have any idea what could be wrong? It works fine when “others” have read access to the file, but that is not what I want, is it? I added the users dovecot and vmail to the postfix group, but that didn’t change anything. Can I figure out as which user the process is running?

    cheers,
    Silvio

    Reply
    • 2016-01-08 at 07:46
      Permalink

      Both the directory /etc/postfix and the main.cf must be others-accessible. I wonder what broke it.

      Reply
      • 2016-01-08 at 09:36
        Permalink

        Thank you very much! I didn’t know that this is okay and even necessary. Now it forwards happily 😉 It’s very likely that I broke it myself in a burst of over-cautiosness when you told us to secure the mysql-* files, so I guess I have to check some more file permissions now :/

        Reply
  • 2016-01-31 at 16:51
    Permalink

    Hello,
    thanks for the great tutorials,
    Hovewer I have a little problem with mailing lists:
    My assumptions:
    1. I created alias:
    managers@mydomain.com -> manager1@mydomain.com, manager2@mydomain.com, manager3@mydomain.com

    2. I want to restrict acces to managers@mydomain.com lsit to let writing messages to it only by:
    boss@mydomain.com
    manager2@mydomain.com

    I tried to do this in this way which doesn’t work properly main.cf :
    smtpd_recipient_restrictions =

    check_sender_access hash:/etc/postfix/access,

    FILE /etc/postfix/access:

    managers@mydomain.com managers_sender_list

    FILE managers_sender_list:
    boss@mydomain.com
    manager2@mydomain.com

    I checked it on http://postfix.cs.utah.edu/RESTRICTION_CLASS_README.html#internal but I think this is not what I’m looking for.
    Am I wrong ? How to implement these assumptions properly ?

    Reply
  • 2016-02-01 at 09:14
    Permalink

    So anybody have idea about creating rules that let only pointed addresses to send message to all@mydomain.com ?

    Reply
    • 2016-02-04 at 11:18
      Permalink

      I tried simple way:
      Fake account + Filters (managesieve) in RC.
      Works great for small no of redirections.
      If you want to use many addresses, you can edit /accountdir/sieve/managesieve.sieve and paste the list in proper format.
      BUT:
      There is one more thing: where to set the limit of max redirections.
      I tried in:
      /etc/dovecot/conf.d/90-sieve.conf
      set:
      sieve_max_redirects = 100
      Doesn’t work.

      Reply
      • 2016-02-08 at 10:05
        Permalink

        That’s work:
        1. Fake account + Filters (managesieve) in RC.
        2. edit:
        /etc/dovecot/conf.d/90-sieve.conf
        set:
        sieve_max_redirects = 100
        sieve_max_actions = 200

        Reply
  • 2016-02-04 at 15:06
    Permalink

    Hi Christoph,
    I’ll repeat what others say – thank you for such a great tutorial! It rocks! I’m just finishing configuration of mail server on AWS t2.micro (free but limited hosting offer from Amazon) and wondering which ports should be opened on firewall to allow communication with mail clients and other mail servers. I consider 25 for transporting between MTA, 587 for submitting and receiving email to and from user, 443 for Roundcube and PhpMyAdmin (although here I consider using some uncommon port) and 22 for SSH. I’m not going to use POP so 110 is not needed. Do you think anything is missing? Regards, Piotr.

    Reply
    • 2016-02-15 at 19:50
      Permalink

      Hi Pjotr,

      I would consider not opening a port for PhpMyAdmin, but instead using port redirection over SSH and then access it locally on your workstation. I always have to look up the syntax, and I am afraid I’ll lead you on the wrong path if I just write down some pseudo-forwarding-rule, so I leave that to you.

      Reply
  • 2016-02-21 at 09:27
    Permalink

    How do I have to configure Thunderbird? I’m on a xxx.ddns.net domain and Thunderbird cannot autoconfigure itself.

    Do I have to use IMAP or IMAPS? Port number? Password: plain text or encoded?
    SMTP port is 25? And password?

    Thank you!

    Reply
    • 2016-11-14 at 00:40
      Permalink

      Did you ever figure out these settings?

      Reply
  • 2016-06-04 at 03:51
    Permalink

    Just wondering. When I set up icedove with imap.example.com and stmp.example.com the setting that was auto detected for both was “normal password”. I know that the server is setup up to encrypt this communication anyway but I was just wondering why “encrypted password” setting fails to work?

    Reply
  • 2016-11-15 at 15:52
    Permalink

    Hi friends,
    I would like to point out this trick, if you does not intend to use IPV6 on your email server and want to delivery email to google server. So because I found myself in this situation.

    If you receive from google server this message:

    Undelivered Mail Returned to Sender
    : host gmail-smtp-in.l.google.com[2a00:1450:400c:c0a::1b]
    said: 550-5.7.1 [2a02:c205:2008:934::1] Our system has detected that this
    message does 550-5.7.1 not meet IPv6 sending guidelines regarding PTR
    records and 550-5.7.1 authentication. Please review 550-5.7.1
    https://support.google.com/mail/?p=IPv6AuthError for more information 550
    5.7.1 . xs6si28642072wjc.244 – gsmtp (in reply to end of DATA command)

    Just add on Postfix main.cf:

    inet_protocols=ipv4

    and restart Postfix

    Reply
    • 2017-01-31 at 10:04
      Permalink

      Hi Davide,
      thank you very much for this hint! It solved me a headhace!

      @Christoph, why don’t include this configuration change in your guide, maybe with a small side note?

      Thank you again guys! 😉

      Reply
      • 2017-01-31 at 10:09
        Permalink

        I considered adding that. However Google says that the forward and reverse DNS records for IPv6 (AAAA and PTR) need to match. We should rather ensure that. Disabling IPv6 seems very wrong and is no long-term solution. If we are using IPv6 to connect to the internet we should rather do it right. Don’t you agree?

        Reply
  • 2017-03-01 at 06:51
    Permalink

    A couple days ago someone noticed that their emails to me were bouncing. While troubleshooting I found the message:

    Feb 28 06:30:53 email postfix/cleanup[6200]: warning: 70A492127F: write queue file: No space left on device

    With further investigation I found that my root drive was full. The `df -i` command showed /dev/vda1 (/) to have 100% in the IUse column. After further troubleshooting without much luck I run the command again and get the following output:

    Filesystem Inodes IUsed IFree IUse% Mounted on
    /dev/vda1 187680 59966 127714 32% /
    udev 60970 315 60655 1% /dev
    tmpfs 63288 478 62810 1% /run
    tmpfs 63288 1 63287 1% /dev/shm
    tmpfs 63288 8 63280 1% /run/lock
    tmpfs 63288 13 63275 1% /sys/fs/cgroup
    /dev/mapper/vg1-mail 997472 141 997331 1% /var/vmail
    /dev/mapper/vg1-tmp 65536 21 65515 1% /tmp

    So somehow the problem resolved itself. Which is sometimes good, but now I have to live with the fear that it will just happen again. Any idea why this would happen?

    Thanks,
    Tom

    Reply
    • 2017-03-01 at 09:16
      Permalink

      @Tom: You could install “ncdu” and run “ncdu -x /” to find which directories use most of the space. Sometimes it is log file. Sometimes it is leftovers from package installations that you can clean out by running “apt-get clean”. On Ubuntu it’s typically leftover Kernel updates that can be cleaned out by running “apt-get autoremove”.

      Reply
      • 2017-03-11 at 05:44
        Permalink

        Thanks for your help! ncdu was very helpful in identifying the bigger directories. Turns out that I was accidentally using `df -i` instead of `df -l` which was why it looked like I was only using 30%. Running clean and autoremove, along with removing some log files and locales cleared up a good bit of space. I should be good for now. Thanks!

        Reply
  • 2017-03-11 at 12:18
    Permalink

    IPv6 get bounced by gmail:

    Diagnostic-Code: smtp; 550-5.7.1 [2001:981:52a5:1:e49b:b257:57eb:c4df] Our
    system has detected that 550-5.7.1 this message does not meet IPv6 sending
    guidelines regarding PTR 550-5.7.1 records and authentication.

    What I understand Christoph is my rdns record is not set. Which is correct while my emailserver is IPv4 natted behind my router. I tried `proxy_interfaces` with no result (I hoped postfix would use modem WAN interface IPv6 address..)

    For now `inet_protocols = ipv4` works.

    Have you got the time to elaborate a little bit more about IPv6?

    Kind regards, Marc

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close