There is a newer issue of thie ISPmail guide available if you are using Debian Jessie!

General troubleshooting tips

  • Run “postfix check” to make Postfix look for obvious configuration errors. If it returns no output then no problem was found.
  • Read your /var/log/mail.log and look for warnings and errors.

Common problems and solutions

ClamAV fails to scan for viruses

May  7 12:42:28 debian amavis[1834]: (01834-01) (!)run_av (ClamAV-clamd) FAILED – unexpected , output=”/var/lib/amavis/tmp/amavis-20110507T124228-01834/parts: lstat() failed: Permission denied. ERROR\n”

You forgot to run

adduser clamav amavis

Missing indentation in the

The /etc/postfix/ file needs proper indentation. The first line of each service starts in the first column. Additional lines of the same service need to be indented by spaces.

Postfix keeps unwanted emails in the queue

Check that you do not keep soft_bounce enabled. If “postconf soft_bounce” shows “yes” then run “postconf soft_bounce=no”.

I get “Permission denied” from Dovecot in the mail.log file

You have the permissions wrong. Run:

chown -R vmail:vmail /var/vmail

Postfix says: “Mail loops back to myself”

Postfix tried to send an email to the internet because it did not feel responsible for the recipient’s domain. However DNS records pointed it back to itself. So either your DNS record for a certain domain is wrong (unlikely) or your Postfix refuses to receive email for the given domain (very likely). Check that the recipient’s domain is listed in the “virtual_domains” table in the MySQL database. And verify that your CF files are working correctly.

General questions

Why is the database not normalized (email addresses with domain in virtual_users table)?

It’s possible to normalize the database and use the JOIN syntax to get the domain name from the virtual_domains table. But that would lead to string operations when Postfix and Dovecot look up a certain email address. This quickly becomes a performance penalty when you have many users. So in this case performance wsas rated higher than strict normalisation.

Why are the passwords stored in unsalted MD5 hashes? Isn’t that insecure?

Yes, that’s indeed less secure than using salted hashes. The password storage format has been kept unchanged though for server administrators that kept upgrading their Debian mail server from previous Debian versions.

If you are interested in making your mail server more secure and don’t have any legacy users then consider the Dovecot documentation on passwords schemes to use saltes hashes.

58 thoughts on “Troubleshooting”

  1. I think the “chmod -R vmail:vmail /var/vmail” line that appears above really should be “chown -R vmail:vmail /var/vmail”.

  2. Hi,

    Have been using a web server, build with the help of your previous workaround tutorial running fine for a few years. Now after upgrading Debian to Wheezy, I used your new tutorial to get things working again. Now I encounter some (hopefully small) problems in getting postfix working again.

    Main problem I have right now is this error, which keep popping up:

    ~# postfix check
    /usr/sbin/postconf: fatal: file /etc/postfix/ line 89: bad field count
    postfix/postfix-script: fatal: cannot execute /usr/sbin/postconf!

    So I did have a look at all the files and settings again and again. But did not find anything what seems to be wrong. So maybe you have a Idea what might be the case? I am using the database I already had in place before.

    Would be very pleased if you or someone can help me with this. Thanks.

    1. Christoph Haas

      Let's see. What did you put into that respective line?

      (/usr/sbin/postconf: fatal: file /etc/postfix/ line 89: bad field count)

      1. Hi, thanks for your quick reply,

        I had an other look at the file and added an space before one line, since that seems to be important in this file. And than after restarting postfix it did not give me the error any more. Now that looks promising isn’t it.
        So now things should work, but no.

        I tried this:
        telnet: Unable to connect to remote host: Connection refused
        hocom-advies:~# lsof -i tcp:25

        1. Christoph Haas
          • Nothing obvious (error messages) in the mail.log?
          • "postfix check" outputs nothing?
          • Postfix is running at all?
          1. Hi,

            The strange thing is that nothing new appears in the mail.log So that’s why I think postfix is not running at all?
            so postfix check: gives nothing. Trying…
            telnet: Unable to connect to remote host: Connection refused ~# lsof -i tcp:25

          2. telnet: Unable to connect to remote host: Connection refused
            master 16211 root 11u IPv4 2064969283 0t0 TCP *:smtp (LISTEN)
            master 16211 root 12u IPv6 2064969285 0t0 TCP *:smtp (LISTEN)

          3. Christoph Haas

            I get this:

            # lsof -i tcp:25

            master  4854    root   12u  IPv4  10778      0t0  TCP *:smtp (LISTEN)
            master  4854    root   13u  IPv6  10780      0t0  TCP *:smtp (LISTEN)
            smtpd   5073 postfix    6u  IPv4  10778      0t0  TCP *:smtp (LISTEN)
            smtpd   5073 postfix    7u  IPv6  10780      0t0  TCP *:smtp (LISTEN)

            Are you sure you didn't accidentally comment out the "smtpd" in the


          4. As far as I can see I did not do that but might it be the wrong (old) file I am using? Where to find an “original” file

          5. Christoph Haas

            In /usr/share/postfix/

            Or purge the postfix package and reinstall it.

          6. I replaced the with the one from /usr/share/postfix/ and uncomment the smtpd. And restarted postfix. Now I do not get anything when lsof -i tcp:25

          7. Now I did some purging and changed some settings in the config files. Now I can send an mail with telnet localhost smtp. I see it appear in the mail.log, than when looking with mutt in var/vmail/.. it’s not there. So somewhere something goes wrong. Can I send my mail.log or settings by mail or so?

          8. I have it working now. Did again apt-get –purge remove dovecot.* which really removed all older files. And to be sure mannually removed some remaining files from /etc/dovecot Than did a fresh install and made all the changes from your tuttorial. Last thing for now is amavis and clamav. These are already there from last install. Can still use that? Or need do do an update for Wheezy? How can I find out if it works? I do not see anything mentioned in the mail.log? Look like it runs at: tcp 0 0* LISTEN 2209/amavisd-new (m

          9. So I just tried and seems that the Amavis I have stille works. First I had an error in the maillog and all mail stopped working. Than I found that in /etc/amavis/conf.d/50-user (seems to be an older file 🙂 There was a part for connecting to the Msql database, which I needed to change with the new password for the dbase. After some restarting it seems to work now. So in the Wheezy tuttorial I did not see anything about the 50-user file and an Mysql connection? Is that no longer needed in a newer version of Amavis?

  3. has two free test tools for testing email sending and receiving.
    It showed me that l receive email using StartTLS but that my server isn’t issuing the StartTLS command upon sending.
    Hope this helps others as well,

  4. Mail server is generally working, but regularly emitting a message:
    mx lda: Fatal: Internal error occurred. Refer to server log for more information.

    I can’t find anything more in the logs – what could it be?

  5. Sorry, more information. There is also an error “user Auth USER lookup failed” although the mail user in question is in the database and comes up on a check.

  6. Connection dovecot/postfix to mysql

    I’ve had this set-up working before, but I am stuck no with a mailserver not accepting mail and keeping everything in /var/spool/postfix/deferred. I think the issue is that dovecot (or maybe) postfix doesn’t connect to mysql for a user check. It therefore checks in the DNS and gets looped back to itself…. The main clues in /var/log/messages are:

    hash map “Alias0”: missing map file /etc/mail/aliases.db: No such file or directory

    I can’t find where this is referred to.
    When I try to deliver a mail, I _don’t_ get anything like:
    dovecot: auth-worker(22635): mysql( Connected to database mailserver

    From /var/log/maillog I get, that postfix/dovecot doesn’t feel responsible for the user:

    doveconf: Fatal: Error in configuration file /usr/local/etc/dovecot/dovecot.conf line 100: No matches

    This loops back to dovecot-sql.conf.ext, which is exactly as in the guide. I’ve done all the mysql tests using postmap and they work fine. Do you have any ideas or directions for me to look in?

    Thanks in advance!


    P.S. I’m building it on FreeBSD now instead of linux, but I’ve gotten it working before. I don’t think this error has something to do with the OS; I just don’t get enough info from the logs and/or settings

  7. Christoph Haas

    Could you paste a few lines from your mail.log?

    While is will surely work on FreeBSD you may easily screw up the paths to sockets that connect Postfix and Dovecot. This is the main pitfall.

    1. The recurring error part from /var/log/maillog:

      postfix/pipe[67058]: BF2463C48CE: to=, relay=dovecot, delay=420369, delays=420369/0.02/0/0.1, dsn=4.3.0, status=deferred (temporary failure. Command output: doveconf: Fatal: Error in configuration file /usr/local/etc/dovecot/dovecot.conf line 100: No matches )

      Line 100 comes down to conf.c/10-auth.conf:
      auth_mechanisms = plain login
      !include auth-sql.conf.ext

      passdb {
      driver = sql
      args = /usr/local/etc/dovecot/dovecot-sql.conf.ext

      userdb {
      driver = static
      args = uid=vmail gid=vmail home=/home/vmail/%d/%n /usr/local/etc/dovecot/dovecot-sql.conf.ext

      I’ve had it running with and without the “/usr/local/etc/dovecot/dovecot-sql.conf.ext” part in the args line. Overall there is no big difference…

      driver = mysql
      connect = host= dbname=mailserver user=mailuser password=zzz
      default_pass_scheme = PLAIN-MD5
      password_query = SELECT email as user, password FROM virtual_users WHERE email=’%u’;

      All the database checks with postfix in the previous parts work fine. I have both postfix and dovecot built with mysql support and virtual aliases work.

      Rights of spool
      srw-rw—- 1 postfix postfix 0 Mar 2 12:59 /var/spool/postfix/private/auth
      drwx—— 2 postfix postfix 512 Mar 2 12:59 private
      drwxr-xr-x 16 root postfix 512 Feb 14 22:29 postfix

  8. i can’t find the mail.log at /var/log/ … is it possible, that there is another log-file?
    …tried to send an email with “echo test | mail” but nothing happens…

  9. Christoph Haas

    There should be a /var/log/mail.log. Are you using Debian? Did you install Postfix and Dovecot? Is your syslog daemon running?

    1. First thanks for your fast answer – deleted the “#” in /etc/init.d/rsyslog, restarted daemon – now it works!

  10. Wow great article, thanks a lot for this.
    I’ve got a couple of questions. when testing, i can send mails from shell and receive them. I can even receive mails from other accounts in the domain. But for the love of god, i cannot receive mails from other servers, say another linux box, or gmail or hotmail or whatever…
    What I might be doing wrong?
    Where will the mails would be if they are not delivered to account mailboxes? are they totaly lost?

    1. Btw, I have setup the dns properly,
      when i do host -t MX
      i get mail is handled by 0

      1. Christoph Haas

        Does "" point to an IP address that has Postfix listening on port 25?

        Can you access TCP port 25 from the internet? (If not… check your firewall… and make sure that you don't have a crappy ISP who blocks port 25…)

        Do you see any connection/delivery attempts in your mail.log?


        1. I’m sorry, I haven’t been clear. I’m trying to receive mail, not send it. For smtp, I’ve changed the smtp port to 26 btw.
          this is what writes in my now.
          #smtp inet n – – – – smtpd
          26 inet n – – – – smtpd

          and when i send mail with osx mail client, this is what it says on mail.log
          relay=dovecot, delay=0.18, delays=0.03/0/0/0.15, dsn=2.0.0, status=sent (delivered via dovecot service)

          I can connect with mail clients and send mail. I can also receive mails from my mail clients.

          The problem is, when I try to send mail FROM my gmail account to this setup nothing. nada. zip. nothing on logs. nothing on mailboxes. in junk folders. nothing.
          But when i do
          echo test | mail
          mail comes to my inbox…

          thank you very much for helping me

          1. hi,
            after I’ve read what I’ve written, and the fact that you have asked about port 25 made me realise I’ve made a huge mistake on .
            I’ve set it up as
            smtp inet n – – – – smtpd
            again. Now I can receive mails again. \o/
            This has been a great tutorial. I’ve learned a lot from this.
            Now moar questions 🙂
            How can I change smtp port to 26 so that
            telnet ip 26
            will work

            I got some warnings which i dont understan also.
            this is in my mail.warn
            warning: do not list domain in BOTH mydestination and virtual_mailbox_domains
            Ok, but what i must set them?

            also when i do
            telnet localhost 25
            ehlo localhost
            250-SIZE 10240000
            250-AUTH PLAIN LOGIN
            250 DSN

            I got the 250-AUTH PLAIN LOGIN ???
            and in mail clients i can join using ssl..

            Thanks in advance

          2. Christoph Haas

            Good to hear that it works again. SMTP always runs through TCP port 25. So even if you run your listener on port 26 you won't be able to tell the rest of the world to use that port instead. It's just not specified and the MX record cannot define an alternative TCP port. So if your ISP blocks port 25 you are screwed.

            "warning: do not list domain in BOTH mydestination and virtual_mailbox_domains" totally means what it says. You have to decide what kind of domain "" is supposed to be. Re-read the chapter about domain types if you are still unsure what I'm talking about.

            "I got the 250-AUTH PLAIN LOGIN ???
            and in mail clients i can join using ssl.."

            => So?

          3. Cant i mean i cant join using ssl. Sorry, its a typo.

            I’ve somehow managed to corrupt the vmdk file, i’ll reinstall wheezy and re do the installation, now. Part if the learning curve i guess. 🙂

            “So if your ISP blocks port 25 you are screwed”
            Or I need to get the ssl to work, right? Because ssl uses a different port? Or is it still the same port?

  11. Christoph Haas

    You can use SSL. But other servers will still try TCP port 25 and then switch to SSL. So if port 25 is blocked you stay screwed. 🙂

  12. Getting this error and no luck in tracking it down:

    May 18 16:02:13 server dovecot: auth-worker(13054): mysql( Connected to database mailserver
    May 18 16:02:13 server dovecot: auth-worker(13054): Warning: mysql: Query failed, retrying: Table ‘mailserver.users’ doesn’t exist
    May 18 16:02:13 server dovecot: auth-worker(13054): Error: sql( User query failed: Table ‘mailserver.users’ doesn’t exist (using built-in default user_query: SELECT home, uid, gid FROM users WHERE username = ‘%n’ AND domain = ‘%d’)

    I can’t figure out where it is getting Table ‘mailserver.users’. I’ve gone through the config files and over the tutorial several times and can’t figure it out. Any ideas?


  13. SMTP time out

    I have an error somewhere. Roundcube works fine, but when I use an email client like thunderbird, opera or Microsoft office, I can recieve emails, but cannot send. The email client connects to the server, then I get this returned from the client:

    The message could not be sent because the connection to SMTP server timed out. Try again or contact your network administrator.

    On the server side, this is in the mail.log:

    May 26 20:54:59 mail1 postfix/smtpd[3620]: connect from unknown[]
    May 26 20:55:01 mail1 postfix/smtpd[3620]: lost connection after UNKNOWN from unknown[]
    May 26 20:55:01 mail1 postfix/smtpd[3620]: disconnect from unknown[]

    Which I am finding it hard to decipher where I should be looking. Any ideas?

  14. Thomas Schmieder

    I’m totally cofused about which part of the package “postfix, postfixadmin, dovecot, …” is responsible for creating new mail-directories. As I only had installed postfix and postfixadmin, new mail-accounts where produced in /var/mail/.
    However, even mbox was used. I did not run the full (mis-)configuration until then.

    Now, under /var/vmail nothing happens.

    I tried to combine both installation instructions (my old and this one) for preserving the database and interface of postfixadmin.
    I’m 98% shure having done the the proper adjustments. Now I’m looking for the 2% ;-O

  15. Christoph Haas

    Hi Thomas,

    Dovecot will create the mail directories as it is the service that receives the emails from Postfix and is supposed to store them to disk. Are you sure that you have followed this tutorial closely? Dovecot won't write mbox files or use /var/mail if you do.

    I'm not sure that any of my tutorial revisions has ever worked with PostfixAdmin. So you seem to have taken parts of two different setups.

    1. Thomas Schmieder

      Yes, I’ve mixed both tutorials and additionallly the relevant parts of the postfix manual.
      Postfix check doesn”t find any failure.

      Due to missing certs it refuses to work. Watching ps -F ax there is no dovecot running.

      I’ve produced a deadlock. Wirhout LDA I cannot get the confirmatin email for the domain cert. Without the cert, dovecot refuses to start.

      What to do? ;-| Disable dovecot again?


      1. Thomas Schmieder

        Sorry, there was deleted one line. Im writing on my tablet at the moment.
        Dovecut refuses to work. Postfix is running an trying all the time to handover the mail for delivery.33

  16. Thomas Schmieder

    I’m still stucking on some error messages:

    Jan 16 09:18:14 dovecot: auth: Error: static( passdb doesn’t support lookups, can’t verify user’s existence
    Jan 16 09:18:14 dovecot: lda: Error: user Auth USER lookup failed

    There’s no more idea where to search for the failure.


    1. Thomas Schmieder

      Up to the LDA it works now. The mailboxes are created and saved the emails there.

      still missing:
      – The certificate of startssl
      – Access to the mailboxes via IMAP and POP3

      Do I still get all the bugs out of my notes and fact files together, I do not know yet. I’ll try and describe the alternate installation.

      Thank you for your patience and your answers.

  17. Thomas Schmieder

    I deaspair!

    postfix/smtpd[17610]: warning: cannot get RSA private key from file /etc/ssl/postfix/mailserver.pem: disabling TLS support
    postfix/smtpd[17610]: warning: TLS library problem: 17610:error:0906406D:PEM routines:PEM_def_callback:problems getting password:pem_lib.c:111:
    postfix/smtpd[17610]: warning: TLS library problem: 17610:error:0906A068:PEM routines:PEM_do_header:bad password read:pem_lib.c:458:
    postfix/smtpd[17610]: warning: TLS library problem: 17610:error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib:ssl_rsa.c:669:

    Nowbody knows, and Jesus is not available…

    What can be the reason? Only SMTP can not authenticate.
    IMAP and POP3 are working. The HTTP server for Postfixadmin is also working on HTTPS. Keys must therefore be alright.

  18. Christoph Haas

    Does your key file /etc/ssl/postfix/mailserver.pem exist? Check if the key file is okay:

    openssl rsa -in /etc/ssl/postfix/mailserver.pem -noout -text

    1. Thomas Schmieder

      The key file is existing and accessible.
      Unfortunately, the key file itself has again a key

      For Apache and Dovecot that ist no problem, but postfix doesn’t accept encrypted public keys. I didn’t know that.
      Now I have to try to get another certificate for free without encrypted key.

      Thank You

  19. Christoph Haas

    Decrypting a key is simple:

    openssl rsa -in /etc/ssl/postfix/mailserver.pem -out /etc/ssl/postfix/mailserver-unencrypted.pem

    After all you made the key – not your certification authority. Don't mix that up. Whether the key is encrypted or not does not do anything to the certificate.

    Just make sure that the key has 0666 permissions so that nobody else can accidentally use it.

  20. Thomas Schmieder

    Decryption was helpful. But now there remains the message

    “postfix/smtp[–pid–] Untrusted TLS connection established” in the mail.log
    and my thunderbird wants to have accepted the exclusion rule.
    I kindly recall: the certificate has been establioshed by STARTSSL :-O

    Thanks a lot

  21. Cosmin Popescu

    Thank you for your great tutorial. I’ve followed all the steps and everything works great. I’ve got secure smtp, I am using imaps, I am using dkim and spif. But the problem is that I end up in spam when I send mail to google. There is no problem with yahoo, hotmail or other providers. Just google.

    This is an e-mail sent to google:

    Received: by with SMTP id g3csp1586348pdu;
    Mon, 4 May 2015 03:47:38 -0700 (PDT)
    X-Received: by with SMTP id h4mr28099155icg.32.1430736457554;
    Mon, 04 May 2015 03:47:37 -0700 (PDT)
    Received: from debian ( [])
    by with ESMTP id kb9si4742532igb.48.2015.
    for ;
    Mon, 04 May 2015 03:47:36 -0700 (PDT)
    Received-SPF: pass ( domain of designates as permitted sender) client-ip=;
    spf=pass ( domain of designates as permitted sender);
    Received: from ( [])
    by debian (Postfix) with ESMTPSA id BC8B03FD3D
    for ; Mon, 4 May 2015 12:47:35 +0200 (CEST)
    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;;
    s=mail; t=1430736455;
    Date: Mon, 4 May 2015 12:47:34 +0200
    Subject: vim profile
    Message-ID: <>
    MIME-Version: 1.0
    Content-Type: text/plain; charset=us-ascii
    Content-Disposition: inline
    User-Agent: Mutt/1.5.23 (2014-03-12)

    git clone

    To me, everything looks fine. Still it ended up in the receiver’s spam.

    Thank you,
    Cosmin Popescu

  22. For local postfixadmin db
    user = user
    password = pass
    hosts =
    dbname = postfixadmin
    query = select `goto` from `alias` where `address` = ‘%s’
    user = user
    password = pass
    hosts =
    dbname = postfixadmin
    query = select `domain` from `domain` where `domain` = ‘%s’
    user = user
    password = pass
    hosts =
    dbname = postfixadmin
    query = select `username` from `mailbox` where `username` = ‘%s’

    1. Christoph Haas

      That configuration may be appropriate for postfixadmin-compatible setups. But it does not match the database schema in this guide. Why did you post it?

  23. Néstor Díaz

    Dear sirs, you are my last hope:

    I have a domain with several addresses. After the DNS provider forgot to renew domain and later recover it something really odd happens.

    One and only one address at that domain cannot receive email from outside.
    Can receive from other emails at
    Can receive from others domains hosted at same server.
    Cannot receive from domains outside the server, not only gmail, no one.

    Jul 12 11:58:39 mail3 postfix/smtpd[5298]: NOQUEUE: reject: RCPT from[]: 550 5.1.1 : Recipient address rejected: undeliverable address: mail for loops back to myself; from= to= proto=ESMTP helo=

    Server is setup following this tutorial and suspect some cache is corrupt though.

    Any ideas?

    1. Christoph Haas

      Without knowing your exact configuration I’d say that you didn’t define “” as a virtual domain. The “loops back to myself” means: Postfix didn’t feel responsible for that address and wanted to find the right server on the internet to send to (using DNS). But it found out that according to MX records it’s indeed responsible.

          1. Néstor Díaz

            Solution found!

            transport file once had an entry for this email address and for some reason transport.db (after postmap) was corrupt. I did several postmap transport since yesterday and I got not indication of error. After deletetion anad postmap email is received again!

          2. Christoph Haas

            Seems to help to explain a problem to others because it makes you double-check all your configuration. 🙂

Leave a Reply

Your email address will not be published. Required fields are marked *

Scroll to Top