There is a newer issue of thie ISPmail guide available if you are using Debian Jessie!
General troubleshooting tips
- Run “postfix check” to make Postfix look for obvious configuration errors. If it returns no output then no problem was found.
- Read your /var/log/mail.log and look for warnings and errors.
Common problems and solutions
ClamAV fails to scan for viruses
May 7 12:42:28 debian amavis[1834]: (01834-01) (!)run_av (ClamAV-clamd) FAILED – unexpected , output=”/var/lib/amavis/tmp/amavis-20110507T124228-01834/parts: lstat() failed: Permission denied. ERROR\n”
You forgot to run
adduser clamav amavis
Missing indentation in the master.cf
The /etc/postfix/master.cf file needs proper indentation. The first line of each service starts in the first column. Additional lines of the same service need to be indented by spaces.
Postfix keeps unwanted emails in the queue
Check that you do not keep soft_bounce enabled. If “postconf soft_bounce” shows “yes” then run “postconf soft_bounce=no”.
I get “Permission denied” from Dovecot in the mail.log file
You have the permissions wrong. Run:
chown -R vmail:vmail /var/vmail
Postfix says: “Mail loops back to myself”
Postfix tried to send an email to the internet because it did not feel responsible for the recipient’s domain. However DNS records pointed it back to itself. So either your DNS record for a certain domain is wrong (unlikely) or your Postfix refuses to receive email for the given domain (very likely). Check that the recipient’s domain is listed in the “virtual_domains” table in the MySQL database. And verify that your CF files are working correctly.
General questions
Why is the database not normalized (email addresses with domain in virtual_users table)?
It’s possible to normalize the database and use the JOIN syntax to get the domain name from the virtual_domains table. But that would lead to string operations when Postfix and Dovecot look up a certain email address. This quickly becomes a performance penalty when you have many users. So in this case performance wsas rated higher than strict normalisation.
Why are the passwords stored in unsalted MD5 hashes? Isn’t that insecure?
Yes, that’s indeed less secure than using salted hashes. The password storage format has been kept unchanged though for server administrators that kept upgrading their Debian mail server from previous Debian versions.
If you are interested in making your mail server more secure and don’t have any legacy users then consider the Dovecot documentation on passwords schemes to use saltes hashes.
I think the “chmod -R vmail:vmail /var/vmail” line that appears above really should be “chown -R vmail:vmail /var/vmail”.
Whoa… stupid typo. Thanks – just corrected it.
Hi,
Have been using a web server, build with the help of your previous workaround tutorial running fine for a few years. Now after upgrading Debian to Wheezy, I used your new tutorial to get things working again. Now I encounter some (hopefully small) problems in getting postfix working again.
Main problem I have right now is this error, which keep popping up:
~# postfix check
/usr/sbin/postconf: fatal: file /etc/postfix/master.cf: line 89: bad field count
postfix/postfix-script: fatal: cannot execute /usr/sbin/postconf!
So I did have a look at all the files and settings again and again. But did not find anything what seems to be wrong. So maybe you have a Idea what might be the case? I am using the database I already had in place before.
Would be very pleased if you or someone can help me with this. Thanks.
Let's see. What did you put into that respective line?
(/usr/sbin/postconf: fatal: file /etc/postfix/master.cf: line 89: bad field count)
Hi, thanks for your quick reply,
I had an other look at the file and added an space before one line, since that seems to be important in this file. And than after restarting postfix it did not give me the error any more. Now that looks promising isn’t it.
So now things should work, but no.
I tried this:
Trying 127.0.0.1…
telnet: Unable to connect to remote host: Connection refused
hocom-advies:~# lsof -i tcp:25
Hi,
The strange thing is that nothing new appears in the mail.log So that’s why I think postfix is not running at all?
so postfix check: gives nothing. Trying 127.0.0.1…
telnet: Unable to connect to remote host: Connection refused ~# lsof -i tcp:25
telnet: Unable to connect to remote host: Connection refused
master 16211 root 11u IPv4 2064969283 0t0 TCP *:smtp (LISTEN)
master 16211 root 12u IPv6 2064969285 0t0 TCP *:smtp (LISTEN)
I get this:
# lsof -i tcp:25
Are you sure you didn't accidentally comment out the "smtpd" in the master.cf?
As far as I can see I did not do that but might it be the wrong (old) file I am using? Where to find an “original” master.cf file
In /usr/share/postfix/master.cf.dist
Or purge the postfix package and reinstall it.
I replaced the master.cf with the one from /usr/share/postfix/master.cf.dist and uncomment the smtpd. And restarted postfix. Now I do not get anything when lsof -i tcp:25
Now I did some purging and changed some settings in the config files. Now I can send an mail with telnet localhost smtp. I see it appear in the mail.log, than when looking with mutt in var/vmail/.. it’s not there. So somewhere something goes wrong. Can I send my mail.log or settings by mail or so?
I have it working now. Did again apt-get –purge remove dovecot.* which really removed all older files. And to be sure mannually removed some remaining files from /etc/dovecot Than did a fresh install and made all the changes from your tuttorial. Last thing for now is amavis and clamav. These are already there from last install. Can still use that? Or need do do an update for Wheezy? How can I find out if it works? I do not see anything mentioned in the mail.log? Look like it runs at: tcp 0 0 127.0.0.1:10024 0.0.0.0:* LISTEN 2209/amavisd-new (m
So I just tried and seems that the Amavis I have stille works. First I had an error in the maillog and all mail stopped working. Than I found that in /etc/amavis/conf.d/50-user (seems to be an older file 🙂 There was a part for connecting to the Msql database, which I needed to change with the new password for the dbase. After some restarting it seems to work now. So in the Wheezy tuttorial I did not see anything about the 50-user file and an Mysql connection? Is that no longer needed in a newer version of Amavis?
StartTLS.com has two free test tools for testing email sending and receiving.
It showed me that l receive email using StartTLS but that my server isn’t issuing the StartTLS command upon sending.
Hope this helps others as well,
chip
checktls.com not starttls.com
Sorry,
chip
Mail server is generally working, but regularly emitting a message:
mx lda: Fatal: Internal error occurred. Refer to server log for more information.
I can’t find anything more in the logs – what could it be?
Sorry, more information. There is also an error “user joe@example.com: Auth USER lookup failed” although the mail user in question is in the database and comes up on a check.
“joe@example.com” is just an example. You need to test with your own domain.
Connection dovecot/postfix to mysql
I’ve had this set-up working before, but I am stuck no with a mailserver not accepting mail and keeping everything in /var/spool/postfix/deferred. I think the issue is that dovecot (or maybe) postfix doesn’t connect to mysql for a user check. It therefore checks in the DNS and gets looped back to itself…. The main clues in /var/log/messages are:
hash map “Alias0”: missing map file /etc/mail/aliases.db: No such file or directory
I can’t find where this is referred to.
When I try to deliver a mail, I _don’t_ get anything like:
dovecot: auth-worker(22635): mysql(127.0.0.1): Connected to database mailserver
From /var/log/maillog I get, that postfix/dovecot doesn’t feel responsible for the user:
doveconf: Fatal: Error in configuration file /usr/local/etc/dovecot/dovecot.conf line 100: No matches
This loops back to dovecot-sql.conf.ext, which is exactly as in the guide. I’ve done all the mysql tests using postmap and they work fine. Do you have any ideas or directions for me to look in?
Thanks in advance!
Vincent
P.S. I’m building it on FreeBSD now instead of linux, but I’ve gotten it working before. I don’t think this error has something to do with the OS; I just don’t get enough info from the logs and/or settings
Could you paste a few lines from your mail.log?
While is will surely work on FreeBSD you may easily screw up the paths to sockets that connect Postfix and Dovecot. This is the main pitfall.
The recurring error part from /var/log/maillog:
postfix/pipe[67058]: BF2463C48CE: to=, relay=dovecot, delay=420369, delays=420369/0.02/0/0.1, dsn=4.3.0, status=deferred (temporary failure. Command output: doveconf: Fatal: Error in configuration file /usr/local/etc/dovecot/dovecot.conf line 100: No matches )
Line 100 comes down to conf.c/10-auth.conf:
auth_mechanisms = plain login
..
!include auth-sql.conf.ext
auth-sql-conf.ext:
passdb {
driver = sql
args = /usr/local/etc/dovecot/dovecot-sql.conf.ext
}
userdb {
driver = static
args = uid=vmail gid=vmail home=/home/vmail/%d/%n /usr/local/etc/dovecot/dovecot-sql.conf.ext
}
I’ve had it running with and without the “/usr/local/etc/dovecot/dovecot-sql.conf.ext” part in the args line. Overall there is no big difference…
dovecot-sql.conf.ext:
driver = mysql
connect = host=127.0.0.1 dbname=mailserver user=mailuser password=zzz
default_pass_scheme = PLAIN-MD5
password_query = SELECT email as user, password FROM virtual_users WHERE email=’%u’;
All the database checks with postfix in the previous parts work fine. I have both postfix and dovecot built with mysql support and virtual aliases work.
Rights of spool
srw-rw—- 1 postfix postfix 0 Mar 2 12:59 /var/spool/postfix/private/auth
drwx—— 2 postfix postfix 512 Mar 2 12:59 private
drwxr-xr-x 16 root postfix 512 Feb 14 22:29 postfix
i can’t find the mail.log at /var/log/ … is it possible, that there is another log-file?
…tried to send an email with “echo test | mail john@example.org” but nothing happens…
There should be a /var/log/mail.log. Are you using Debian? Did you install Postfix and Dovecot? Is your syslog daemon running?
First thanks for your fast answer – deleted the “#” in /etc/init.d/rsyslog, restarted daemon – now it works!
Wow great article, thanks a lot for this.
I’ve got a couple of questions. when testing, i can send mails from shell and receive them. I can even receive mails from other accounts in the domain. But for the love of god, i cannot receive mails from other servers, say another linux box, or gmail or hotmail or whatever…
What I might be doing wrong?
Where will the mails would be if they are not delivered to account mailboxes? are they totaly lost?
Btw, I have setup the dns properly,
when i do host -t MX domain-name.com
i get
domain-name.com mail is handled by 0 domain-name.com
Does "domain-name.com" point to an IP address that has Postfix listening on port 25?
Can you access TCP port 25 from the internet? (If not… check your firewall… and make sure that you don't have a crappy ISP who blocks port 25…)
Do you see any connection/delivery attempts in your mail.log?
…Christoph
I’m sorry, I haven’t been clear. I’m trying to receive mail, not send it. For smtp, I’ve changed the smtp port to 26 btw.
this is what writes in my master.cf now.
#smtp inet n – – – – smtpd
26 inet n – – – – smtpd
and when i send mail with osx mail client, this is what it says on mail.log
relay=dovecot, delay=0.18, delays=0.03/0/0/0.15, dsn=2.0.0, status=sent (delivered via dovecot service)
I can connect with mail clients and send mail. I can also receive mails from my mail clients.
The problem is, when I try to send mail FROM my gmail account to this setup nothing. nada. zip. nothing on logs. nothing on mailboxes. in junk folders. nothing.
But when i do
echo test | mail info@domain.com
mail comes to my inbox…
thank you very much for helping me
hi,
after I’ve read what I’ve written, and the fact that you have asked about port 25 made me realise I’ve made a huge mistake on master.cf .
I’ve set it up as
smtp inet n – – – – smtpd
again. Now I can receive mails again. \o/
This has been a great tutorial. I’ve learned a lot from this.
Now moar questions 🙂
How can I change smtp port to 26 so that
telnet ip 26
will work
I got some warnings which i dont understan also.
this is in my mail.warn
warning: do not list domain domain-name.com in BOTH mydestination and virtual_mailbox_domains
Ok, but what i must set them?
also when i do
telnet localhost 25
ehlo localhost
250-domain-name.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
I got the 250-AUTH PLAIN LOGIN ???
and in mail clients i can join using ssl..
Thanks in advance
hob
Good to hear that it works again. SMTP always runs through TCP port 25. So even if you run your listener on port 26 you won't be able to tell the rest of the world to use that port instead. It's just not specified and the MX record cannot define an alternative TCP port. So if your ISP blocks port 25 you are screwed.
"warning: do not list domain domain-name.com in BOTH mydestination and virtual_mailbox_domains" totally means what it says. You have to decide what kind of domain "domain-name.com" is supposed to be. Re-read the chapter about domain types if you are still unsure what I'm talking about.
"I got the 250-AUTH PLAIN LOGIN ???
and in mail clients i can join using ssl.."
=> So?
Cant i mean i cant join using ssl. Sorry, its a typo.
I’ve somehow managed to corrupt the vmdk file, i’ll reinstall wheezy and re do the installation, now. Part if the learning curve i guess. 🙂
“So if your ISP blocks port 25 you are screwed”
Or I need to get the ssl to work, right? Because ssl uses a different port? Or is it still the same port?
You can use SSL. But other servers will still try TCP port 25 and then switch to SSL. So if port 25 is blocked you stay screwed. 🙂
Getting this error and no luck in tracking it down:
May 18 16:02:13 server dovecot: auth-worker(13054): mysql(127.0.0.1): Connected to database mailserver
May 18 16:02:13 server dovecot: auth-worker(13054): Warning: mysql: Query failed, retrying: Table ‘mailserver.users’ doesn’t exist
May 18 16:02:13 server dovecot: auth-worker(13054): Error: sql(test@example.com): User query failed: Table ‘mailserver.users’ doesn’t exist (using built-in default user_query: SELECT home, uid, gid FROM users WHERE username = ‘%n’ AND domain = ‘%d’)
I can’t figure out where it is getting Table ‘mailserver.users’. I’ve gone through the config files and over the tutorial several times and can’t figure it out. Any ideas?
Thanks.
SMTP time out
I have an error somewhere. Roundcube works fine, but when I use an email client like thunderbird, opera or Microsoft office, I can recieve emails, but cannot send. The email client connects to the server, then I get this returned from the client:
The message could not be sent because the connection to SMTP server 192.168.0.197 timed out. Try again or contact your network administrator.
On the server side, this is in the mail.log:
May 26 20:54:59 mail1 postfix/smtpd[3620]: connect from unknown[192.168.0.10]
May 26 20:55:01 mail1 postfix/smtpd[3620]: lost connection after UNKNOWN from unknown[192.168.0.10]
May 26 20:55:01 mail1 postfix/smtpd[3620]: disconnect from unknown[192.168.0.10]
Which I am finding it hard to decipher where I should be looking. Any ideas?
I’m totally cofused about which part of the package “postfix, postfixadmin, dovecot, …” is responsible for creating new mail-directories. As I only had installed postfix and postfixadmin, new mail-accounts where produced in /var/mail/.
However, even mbox was used. I did not run the full (mis-)configuration until then.
Now, under /var/vmail nothing happens.
I tried to combine both installation instructions (my old and this one) for preserving the database and interface of postfixadmin.
I’m 98% shure having done the the proper adjustments. Now I’m looking for the 2% ;-O
tschmieder@online.de
Hi Thomas,
Dovecot will create the mail directories as it is the service that receives the emails from Postfix and is supposed to store them to disk. Are you sure that you have followed this tutorial closely? Dovecot won't write mbox files or use /var/mail if you do.
I'm not sure that any of my tutorial revisions has ever worked with PostfixAdmin. So you seem to have taken parts of two different setups.
Yes, I’ve mixed both tutorials and additionallly the relevant parts of the postfix manual.
Postfix check doesn”t find any failure.
Due to missing certs it refuses to work. Watching ps -F ax there is no dovecot running.
I’ve produced a deadlock. Wirhout LDA I cannot get the confirmatin email for the domain cert. Without the cert, dovecot refuses to start.
What to do? ;-| Disable dovecot again?
Regards
Thomas
Sorry, there was deleted one line. Im writing on my tablet at the moment.
Dovecut refuses to work. Postfix is running an trying all the time to handover the mail for delivery.33
I’m still stucking on some error messages:
Jan 16 09:18:14 example.org dovecot: auth: Error: static(tschmieder@example.org): passdb doesn’t support lookups, can’t verify user’s existence
Jan 16 09:18:14 example.org dovecot: lda: Error: user tschmieder@example.org: Auth USER lookup failed
There’s no more idea where to search for the failure.
Thomas
Up to the LDA it works now. The mailboxes are created and saved the emails there.
still missing:
– The certificate of startssl
– Access to the mailboxes via IMAP and POP3
Do I still get all the bugs out of my notes and fact files together, I do not know yet. I’ll try and describe the alternate installation.
Thank you for your patience and your answers.
tschmieder@bitworks.de
I deaspair!
postfix/smtpd[17610]: warning: cannot get RSA private key from file /etc/ssl/postfix/mailserver.pem: disabling TLS support
postfix/smtpd[17610]: warning: TLS library problem: 17610:error:0906406D:PEM routines:PEM_def_callback:problems getting password:pem_lib.c:111:
postfix/smtpd[17610]: warning: TLS library problem: 17610:error:0906A068:PEM routines:PEM_do_header:bad password read:pem_lib.c:458:
postfix/smtpd[17610]: warning: TLS library problem: 17610:error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib:ssl_rsa.c:669:
Nowbody knows, and Jesus is not available…
What can be the reason? Only SMTP can not authenticate.
IMAP and POP3 are working. The HTTP server for Postfixadmin is also working on HTTPS. Keys must therefore be alright.
tschmieder@online.de
Does your key file /etc/ssl/postfix/mailserver.pem exist? Check if the key file is okay:
openssl rsa -in /etc/ssl/postfix/mailserver.pem -noout -text
The key file is existing and accessible.
Unfortunately, the key file itself has again a key
For Apache and Dovecot that ist no problem, but postfix doesn’t accept encrypted public keys. I didn’t know that.
Now I have to try to get another certificate for free without encrypted key.
Thank You
Thomas
Decrypting a key is simple:
After all you made the key – not your certification authority. Don't mix that up. Whether the key is encrypted or not does not do anything to the certificate.
Just make sure that the key has 0666 permissions so that nobody else can accidentally use it.
Decryption was helpful. But now there remains the message
“postfix/smtp[–pid–] Untrusted TLS connection established” in the mail.log
and my thunderbird wants to have accepted the exclusion rule.
I kindly recall: the certificate has been establioshed by STARTSSL :-O
Thanks a lot
tschmieder@online.de
Thank you for your great tutorial. I’ve followed all the steps and everything works great. I’ve got secure smtp, I am using imaps, I am using dkim and spif. But the problem is that I end up in spam when I send mail to google. There is no problem with yahoo, hotmail or other providers. Just google.
This is an e-mail sent to google:
Delivered-To: mihailescualexandra@gmail.com;; Mon, 4 May 2015 12:47:35 +0200 (CEST)
Received: by 10.70.69.195 with SMTP id g3csp1586348pdu;
Mon, 4 May 2015 03:47:38 -0700 (PDT)
X-Received: by 10.42.52.4 with SMTP id h4mr28099155icg.32.1430736457554;
Mon, 04 May 2015 03:47:37 -0700 (PDT)
Return-Path:
Received: from debian (popescu.eu.com. [104.167.113.132])
by mx.google.com with ESMTP id kb9si4742532igb.48.2015.05.04.03.47.36
for
Mon, 04 May 2015 03:47:36 -0700 (PDT)
Received-SPF: pass (google.com: domain of cosmin@popescu.eu.com designates 104.167.113.132 as permitted sender) client-ip=104.167.113.132;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of cosmin@popescu.eu.com designates 104.167.113.132 as permitted sender) smtp.mail=cosmin@popescu.eu.com;
dkim=pass header.i=@popescu.eu.com
Received: from popescu.eu.com (popescu.eu.com [104.167.113.132])
by debian (Postfix) with ESMTPSA id BC8B03FD3D
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=popescu.eu.com;
s=mail; t=1430736455;
bh=Lnjr0NJtT0UIvC2m0Z/n0hvgMSr4OB2M6R1fKK/4VQk=;
h=Date:From:To:Subject:From;
b=FLlubETxdE9gVKQmU5WGvKmqEb6YS8IT8IvdV0twmkzonBOk5cJDw2izZgxX8rkMp
DU/WB52GAPThHGRc30oKPxKAkD4eZiau8zxHl8owvKRxPqCAfcbVtDq6e4K42A5f40
TSuOGhbslcGmNA25yIEAiRlGbJy7KiPjmuw2MLyY=
Date: Mon, 4 May 2015 12:47:34 +0200
From: cosmin@popescu.eu.com
To: mihailescualexandra@gmail.com
Subject: vim profile
Message-ID: <20150504104734.GA3982@popescu.eu.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.23 (2014-03-12)
git clone https://github.com/cosminadrianpopescu/vim-profile
To me, everything looks fine. Still it ended up in the receiver’s spam.
Thank you,
Cosmin Popescu
For local postfixadmin db
mysql-virtual-alias-maps.cf
user = user
password = pass
hosts = 127.0.0.1
dbname = postfixadmin
query = select `goto` from `alias` where `address` = ‘%s’
mysql-virtual-mailbox-domains.cf
user = user
password = pass
hosts = 127.0.0.1
dbname = postfixadmin
query = select `domain` from `domain` where `domain` = ‘%s’
mysql-virtual-mailbox-maps.cf
user = user
password = pass
hosts = 127.0.0.1
dbname = postfixadmin
query = select `username` from `mailbox` where `username` = ‘%s’
That configuration may be appropriate for postfixadmin-compatible setups. But it does not match the database schema in this guide. Why did you post it?
I post it for those who want use postfixadmin ))
Thank you for your guide )))
By default in Debian GNU/Linux 7.9 (wheezy) postfix
default_transport = error
!!!!
Dear sirs, you are my last hope:
I have a domain example.org with several addresses. After the DNS provider forgot to renew domain and later recover it something really odd happens.
One and only one address at that domain foo@example.org cannot receive email from outside.
Can receive from other emails at example.org
Can receive from others domains hosted at same server.
Cannot receive from domains outside the server, not only gmail, no one.
Jul 12 11:58:39 mail3 postfix/smtpd[5298]: NOQUEUE: reject: RCPT from mail-wm0-f44.google.com[74.125.82.44]: 550 5.1.1 : Recipient address rejected: undeliverable address: mail for example.org loops back to myself; from= to= proto=ESMTP helo=
Server is setup following this tutorial and suspect some cache is corrupt though.
Any ideas?
Without knowing your exact configuration I’d say that you didn’t define “example.org” as a virtual domain. The “loops back to myself” means: Postfix didn’t feel responsible for that address and wanted to find the right server on the internet to send to (using DNS). But it found out that according to MX records it’s indeed responsible.
Hi Christoph:
As I stated incoming mail from other domains to test@example.org, fu2@example.org, etc gets in without any problem. This only happens with one email address.
Thanks anyway 🙂
Also, if test2@example.org address doesn’t exist postfix answers properly.
Solution found!
transport file once had an entry for this email address and for some reason transport.db (after postmap) was corrupt. I did several postmap transport since yesterday and I got not indication of error. After deletetion anad postmap email is received again!
Seems to help to explain a problem to others because it makes you double-check all your configuration. 🙂