Hot answers tagged

30

Postfix and Dovecot do different things. Postfix is an MTA, or Mail Transfer Agent. It accepts mail from the outside world and from local sources, and routes it to its destination. This may involve an smtp connection to another machine, or it may involve delivering it to a local delivery agent or writing it directly to an mbox. When an MTA goes wrong, ...


19

No, it is not required to set up a DNS cache on the server. The server should use a caching DNS resolver that's somewhere nearby, but most hosting companies already run their own resolvers for the entire datacenter and configure servers to use them by default. By default, both Postfix and Dovecot use local accounts for everything. If you have a Linux account ...


15

Shorter answer. With a “Host not found, try again.” it could mean that your server is having DNS resolution issues, or Postfix itself is having DNS resolution issues. But that is the core of what has to be cleaned up. As for how to clear it up, your question doesn’t provide enough details on your base OS or setup to give a succinct answer. You seem to be ...


13

Apart from setting recipient_delimiter = + I also had to modify master.cf, so that maildrop gets not only the recipient passed, but the real user: maildrop unix - n n - - pipe flags=DRhu user=Debian-exim argv=/usr/bin/maildrop -d ${user}@${nexthop} ${extension} ${recipient} ${user} ${nexthop} Blog post: http://cweiske.de/...


13

Sometimes the sendmail process refuses to die even if you have removed sendmail, and that could cause such issues. In your case, just see if you have an existing sendmail process $ sudo service sendmail stop $ ps auxwww | grep sendmail If you find one, kill it and the 'No such file..' error should go.


12

I ran into this recently. You can change the address with the generic maps as davidgo mentioned. In /etc/postfix/main.cf Add this line smtp_generic_maps = hash:/etc/postfix/generic And then in /etc/postfix/generic Add the line for the originating email address, and the email address you want it to appear to be from root@system.fqdn noreply@company....


11

I was able to fix my problem by changing the postfix main.cf configuration to read: smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination instead of using smtpd_recipient_resrictions It turns out that after postfix 2.10.0, smtpd_relay_restrictions should be used instead of ...


10

You can disable incoming SMTP by editing master.cf, just comment out the smtp and submission services. This will tell postfix not to spawn an smtpd process, which would listen on port 25 (587 for submission) for incoming SMTP connections.


10

First the essentials: Read the relevant RFC:s such as RFC 5321, and make sure your mails conform to it, Don't leave out any headers such as Date: Subject: or From:, and carefully read the format details of the From: field. Just an email address is not valid anymore. Double-check that the From: address used is a valid address that you can receive mail to. ...


9

If you enable Postfix's message submission service (on port 587), you can separate "message submission from message relay, allowing each service to operate according to its own rules (for security, policy, etc.)" (RFC 4409). Under this configuration, since legitimate users must authenticate to use port 587 for message submission, you can safely reject ...


8

There is no way to monitor the sent mails in a clean way. You can only grep the details from the maillog of postfix. Here is an example: log='logfile of postfix' grep "status=sent" $log | \ egrep -ve 'postfix/(cleanup|pickup|master|qmgr|smtpd|local|pipe)' And also avoid the logs for dkim etc. If you need the count of mails then pipe on wc -l at the end.


8

Problem solved by using correct spacing like so: smtps inet n - - - - smtpd -o syslog_name=postfix/smtps # <<< line 23 -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject


8

Is there a quick postfix configuration item I can add that would reject incoming email which is FROM mydomain and wasn't authenticated? Not so quick, but you could implement a simple SMTPd Policy and pick the sender and sasl_username and check whether the first one comes from your domain and the second one exists and also comes from your domain, if so, ...


7

According to the docs mentioned by Stefan this is now possible but disabled by default. You can add internal_mail_filter_classes = bounce to your config for bounces to be filtered just as any other mail (including signing filter). This will work well if you only have signing filter. Though you may encounter problems when you have other filters. You should ...


6

I've just got sick of all the RBL spammers filling my logs, so I've setup my Postfix to ban them. After doing so, load dropped because they were a lot! Be aware that you have to implement some way of cleaning the banned list. I'm planing to restart fail2ban on weekly basis. Check out these rules: http://www.fail2ban.org/wiki/index.php/Postfix Add them ...


5

Should I change my hostname on the machine to mysubdomain.mydomain.com? Normally, SPAM filter take apart of the domain name, the IP originating the spam (in some cases even the entire ip block or the ASN completly, check UCEPROTECT and Whatsmyip.com blacklist check) What other things do I have to do with the DNS to prevent my email from going into the ...


5

This can be achieved with transport_maps = hash:/etc/postfix/transport in main.cf #/etc/postfix/transport domain1.com local: user1@domain2.com smtp:smart.host1.com:25 domain2.com local: user1@domain3.com smtp:smart.host1.com:25 user2@domain3.com smtp:smart.host2.com:25 domain3.com local:


5

After I posted this question, another idea that might solve this popped into my head. It wasn't the exact solution, but it lead me to the solution all the same. It's actually rather simple: you just have to specify the domain in virtual_mailbox_domains but not in virtual_alias_domains and it'll just work. So: main.cf [..] virtual_mailbox_domains = /etc/...


5

You are connecting to localhost via IPv6 (::1), but that address is not part of the "mynetworks" list. Change it to mynetworks = 127.0.0.0/8, <site IP>, [::1]/128 and it should work.


5

This setting: smtpd_client_restrictions = permit_mynetworks, reject (combined my mynetworks being set to localhost) tells that non-local connection attempts must be rejected. If you want to accept mail from the outside, don't do that, leave smtpd_client_restrictions to its empty default value.


4

A better way is to just use Postfix to filter IPs using blocklists. See http://www.postfix.org/postconf.5.html#smtpd_recipient_restrictions to reject using blocklist(s). If you really wanted to, you could use a Fail2Ban filter like f2b-postfix-rbl (postfix-rbl.conf) to filter the mail log for blocklist/blacklisted IP entries. It would then insert a new ...


4

My solution is to write a wrapper script named postfix.sh as follows: # call "postfix stop" when exiting trap "{ echo Stopping postfix; /usr/sbin/postfix stop; exit 0; }" EXIT # start postfix /usr/sbin/postfix -c /etc/postfix start # avoid exiting sleep infinity After that, modify supervisord.conf: [program:postfix] command=path/to/postfix.sh


4

The problem is that Postfix checks /etc/resolv.conf before the WiFi is connected. Therefore, /var/spool/etc/postfix/resolv.conf stays empty after the boot and mails cannot be sent. To solve the problem, I disabled postfix service: sudo update-rc.d postfix disable …and I wrote this script to wait the end of the Wi-Fi connection before to start Postfix (...


4

Encryption of outgoing traffic has not much to do with any of the above. When sending mail, your Postfix connects to Gmail (so neither port-forwarding nor MX records are involved) and acts like a TLS client (i.e. like a web browser, not a web server); it can provide its own certificate but doesn't need to. Additionally, Postfix has separate settings for ...


4

It seems like since wednesday Google Mail Servers no longer accept intermediate certificates signed using the sha1 hash algorithm. Running the command openssl s_client -connect server.example.com:995 -CAfile cacert.pem -showcerts revealed to me that the mail server was (and still is) providing the sha1 version of the intermediate certificate. I don't know ...


4

SPF provides several different methods for server specification (they're all documented in the aforementioned RFC 4408, although it has since been superseded by RFC 7208). In section 5 of the document, you can see that alongside the "ptr" mechanism you also have "a", "mx", "ip4", "ip6", and some more obscure options available. For example, if your incoming ...


3

You will find that blackhole.securitysage.com is a list of domain names commonly used by spammers, and is thus being blocked by your mail server. You can safely comment out those lines, as they are not a standard method of detecting spam. If you want to do spam filtering, you will want to look at spamassassin (and you may even want to incorporate ...


3

You did not say what mail server is storing your emails. These days, it should be one of the IMAP servers - like Cyrus, Dovecot, Courier, ... I personally like Cyrus IMAP. It supports this with relative ease: Plus addressing - allows direct delivery to a particular mailbox (other than an INBOX). This is done via an address of the form: username+...


3

I would not recommend to call a command like du directly from PHP. The problem is that its execution might take many minutes, and before it finishes your php's execution_timeout or some timeouts of the webserver might be reached. I would rather recommend to do this in some kind of asynchronous way. Like for example having a nightly cronjob, which could run ...


3

i want to be able to send email to my aus vps smtp server, and then have it pass it on to my account at my usa email provider In Postfix, configure the relayhost option: relayhost = [other.server] but they are marked as spoofed due to not actually having been sent by the domain that the email address is of This can be configured in the domain's SPF ...


Only top voted, non community-wiki answers of a minimum length are eligible