Skip to content

Get a lot of errors when trying to set up an SMTP server #4416

@Smokietr

Description

@Smokietr

📝 Preliminary Checks

  • I tried searching for an existing issue and followed the debugging docs advice, but still need assistance.

👀 What Happened?

We are encountering the "Recipient address rejected: Access denied" error during email delivery. Additionally, some emails are timing out or the connection is being rejected.

Test Command

swaks --to [email protected] --from [email protected] --server xxx.xxx.net --port 587 -tls -a LOGIN -au [email protected] -ap Password

Main.cf File

smtpd_banner = $myhostname ESMTP
biff = no
append_dot_mydomain = no
readme_directory = no

# Disabled as not compatible with Dovecot
smtputf8_enable = no

# Basic configuration
# myhostname =
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
# Take the following concerns into consideration if adjusting `mydestination`:
# https://github.com/docker-mailserver/docker-mailserver/pull/3264#pullrequestreview-1396816109
# https://github.com/docker-mailserver/docker-mailserver/pull/3264#issuecomment-1518993555
mydestination = $myhostname, localhost.$mydomain, localhost
relayhost =
mynetworks = 0.0.0.0/0 #For testing, my networks is set to 0.0.0.0/0.
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4

# TLS parameters
# These [snakeoil files actually exist](https://askubuntu.com/questions/396120/what-is-the-purpose-of-the-ssl-cert-snakeoil-key), but shouldn't ever be used in production!
# If no `SSL_TYPE` env is set, "plaintext" is configured, but still accepts SSL with these:
smtpd_tls_chain_files = /etc/letsencrypt/live/mail.xxx.net/privkey.pem /etc/letsencrypt/live/mail.xxx.net/fullchain.pem
#smtpd_tls_CAfile =
#smtp_tls_CAfile =
smtpd_tls_security_level = may
smtpd_tls_loglevel = 1
smtp_tls_security_level = may
smtp_tls_loglevel = 1

# Reduces CPU overhead with `NO_COMPRESSION`, SMTP not at risk of CRIME attack (see git blame for details)
# Reduce opportunities for a potential CPU exhaustion attack with `NO_RENEGOTIATION`
tls_ssl_options = NO_COMPRESSION, NO_RENEGOTIATION

tls_high_cipherlist = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256
tls_preempt_cipherlist = yes
smtpd_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtp_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_exclude_ciphers = aNULL, SEED, CAMELLIA, RSA+AES, SHA1
smtpd_tls_dh1024_param_file = /etc/postfix/dhparams.pem
smtpd_tls_CApath = /etc/ssl/certs
smtp_tls_CApath = /etc/ssl/certs

# Settings to prevent SPAM early
smtpd_helo_required = yes
smtpd_delay_reject = yes
smtpd_helo_restrictions = permit_mynetworks, permit
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_client_restrictions =  permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sender_restrictions = $dms_smtpd_sender_restrictions
smtpd_discard_ehlo_keywords = silent-discard, dsn
smtpd_data_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining
disable_vrfy_command = yes

# Security - Prevent SMTP Smuggling attack
# https://www.postfix.org/smtp-smuggling.html#long
smtpd_forbid_bare_newline = yes
# It is possible to exclude clients on trusted networks from this restriction (the upstream default is `$mynetwork`):
# smtpd_forbid_bare_newline_exclusions = $mynetworks

# Custom defined parameters for DMS:
# reject_unknown_sender_domain: https://github.com/docker-mailserver/docker-mailserver/issues/3716#issuecomment-1868033234
dms_smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks
# Submission ports 587 and 465 support for SPOOF_PROTECTION=1
mua_sender_restrictions = $dms_smtpd_sender_restrictions

# Postscreen settings to drop zombies/open relays/spam early
postscreen_dnsbl_action = ignore
postscreen_dnsbl_sites =
postscreen_dnsbl_threshold = 3
postscreen_dnsbl_allowlist_threshold = -1
postscreen_greet_action = enforce
postscreen_bare_newline_action = enforce

# SASL
smtpd_sasl_auth_enable = yes

smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $mydomain
broken_sasl_auth_clients = yes

# Postfix lookup tables for verifying valid users and managed mail domains:
# Populated during startup in: scripts/helpers/postfix.sh
virtual_mailbox_domains = /etc/postfix/vhost
# Populated during startup in: scripts/helpers/aliases.sh
virtual_alias_maps = texthash:/etc/postfix/virtual

# Milters used by DKIM
milter_protocol = 6
milter_default_action = accept
smtpd_milters = $dkim_milter $dmarc_milter
non_smtpd_milters = $dkim_milter

# Header checks for content inspection on receiving
header_checks = pcre:/etc/postfix/maps/header_checks.pcre

# Remove unwanted headers that reveal our privacy
smtp_header_checks = pcre:/etc/postfix/maps/sender_header_filter.pcre

# The default compatibility_level is 0 - which retains legacy settings defaults:
# http://www.postfix.org/COMPATIBILITY_README.html
# If backwards-compatibility log messages appear, fix them by explicitly adding
# the legacy or new default value (alternatively raise the compatibility_level)
compatibility_level = 3.6
dkim_milter = inet:localhost:8891
dmarc_milter = inet:localhost:8893
policyd-spf_time_limit = 3600
content_filter = smtp-amavis:[127.0.0.1]:10024
myhostname = mail.xxx.xxx
mydomain = xxx.xxx
message_size_limit = 10240000
virtual_mailbox_limit = 0
virtual_mailbox_maps = texthash:/etc/postfix/vmailbox
virtual_transport = lmtp:unix:/var/run/dovecot/lmtp

Master.cf File

127.0.0.1:10025 inet    n       -       n       -       -       smtpd
  -o syslog_name=postfix/smtpd-amavis
  -o content_filter=
  -o local_recipient_maps=
  -o relay_recipient_maps=
  -o smtpd_restriction_classes=
  -o smtpd_delay_reject=no
  -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
  -o mynetworks=0.0.0.0/0 #For testing, my networks is set to 0.0.0.0/0.
  -o smtpd_helo_restrictions=
  -o smtpd_sender_restrictions=
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  -o smtpd_data_restrictions=reject_unauth_pipelining
  -o smtpd_end_of_data_restrictions=
  -o smtpd_error_sleep_time=0
  -o smtpd_soft_error_limit=1001
  -o smtpd_hard_error_limit=1000
  -o smtpd_client_connection_count_limit=0
  -o smtpd_client_connection_rate_limit=0
  -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
  -o smtp_tls_security_level=none

👟 Reproduction Steps

  1. Server and Port Connection Check:

    • We checked that the Postfix and Amavis services used for email delivery are correctly configured.
    • We verified that Postfix is properly routing to Amavis running on port 10024.
    • We ensured that the necessary connections are made on 127.0.0.1.
  2. Firewall and Network Configuration:

    • We reviewed the firewall settings on the server and ensured that ports 25, 465, and 587 are open.
    • We confirmed that there were no firewall rules blocking outgoing connections for Postfix.
  3. Amavis and Postfix Integration:

    • We verified that Amavis is correctly receiving emails from Postfix and forwarding them.
    • We encountered "Connection refused" errors, which seem to be related to Amavis failing to connect to the 127.0.0.1 port.
  4. Email Sending Tests:

    • During testing with providers like Gmail, we encountered "554 5.7.1" and "Connection timed out" errors.
    • We observed that emails, especially those sent to external services (e.g., Gmail), were timing out.
  5. Log Files and Error Analysis:

    • Postfix logs: We recorded "554 5.7.1 id=00432-01 - Rejected by next-hop MTA on relaying" errors, which generally indicate that the recipient address was rejected.
    • Amavis logs: We observed email blocks, with messages such as "Blocked MTA-BLOCKED {RejectedInbound}".
  6. SPF, DKIM, and DMARC Configurations:

    • We checked the SPF, DKIM, and DMARC records and ensured that SPF and DKIM configurations were correct.
    • However, despite these configurations, some emails were still being rejected by recipient servers.

Errors Encountered:

  1. "554 5.7.1 id=00432-01 - Rejected by next-hop MTA on relaying"

    • This error indicates that the recipient address was rejected by the recipient server. This is usually due to the recipient servers' security policies blocking the incoming emails.
  2. "Connection refused" and "Connection timed out" errors:

    • These errors show that the connection to external services, particularly Gmail, is failing, with emails timing out during delivery.
  3. "Blocked MTA-BLOCKED {RejectedInbound}":

    • This indicates that Amavis blocked an incoming email, likely due to the system detecting the email as potentially malicious.

🐋 DMS Version

v15.0.0

💻 Operating System and Architecture

Docker

⚙️ Container configuration files

services:
  mailserver:
    image: ghcr.io/docker-mailserver/docker-mailserver:latest
    container_name: mailserver
    hostname: xxx.xxx.net
    environment:
      - LOG_LEVEL=debug
      - SSL_TYPE=letsencrypt
      - ENABLE_FAIL2BAN=1
      - PERMIT_DOCKER=none
      - ENABLE_SASLAUTHD=1
      - SASLAUTHD_MECHANISMS=rimap
      - SASLAUTHD_MECH_OPTIONS=127.0.0.1
      - POSTFIX_INET_PROTOCOLS=ipv4
      - TLS_LEVEL=intermediate
      - DKIM_SELECTOR=mail
      - POSTFIX_REJECT_UNKNOWN_CLIENT_HOSTNAME=0
    env_file: ./mailserver.env
    ports:
      - "25:25"
      - "465:465"
      - "587:587"
      - "993:993"
    volumes:
      - ./docker/dms/mail-data/:/var/mail/
      - ./docker/dms/mail-state/:/var/mail-state/
      - ./docker/dms/mail-logs/:/var/log/mail/
      - ./docker/dms/config/:/tmp/docker-mailserver/
      - ./docker/postfix/config/main.cf:/etc/postfix/main.cf:ro
      - ./certs/certbot/certs/:/etc/letsencrypt
      - ./docker/saslauthd:/var/spool/postfix/var/run/saslauthd:rw
      - /etc/localtime:/etc/localtime:ro
    restart: always
    stop_grace_period: 1m
    healthcheck:
      test: "ss --listening --tcp | grep -P 'LISTEN.+:smtp' || exit 1"
      timeout: 3s

📜 Relevant log output

2025-03-16 05:28:48+00:00 DEBUG start-mailserver.sh: Handling general environment variable setup
2025-03-16 05:28:48+00:00 DEBUG start-mailserver.sh: Setting SASLAUTHD-related environment variables now
2025-03-16 05:28:48+00:00 DEBUG start-mailserver.sh: Exporting environment variables now (creating '/etc/dms-settings')
2025-03-16 05:28:48+00:00 INFO  start-mailserver.sh: Welcome to docker-mailserver v15.0.0
2025-03-16 05:28:48+00:00 DEBUG start-mailserver.sh: Registering functions
2025-03-16 05:28:48+00:00 INFO  start-mailserver.sh: Checking configuration
2025-03-16 05:28:48+00:00 DEBUG start-mailserver.sh: Checking that hostname/domainname is provided or overridden
2025-03-16 05:28:48+00:00 DEBUG start-mailserver.sh: Domain has been set to xxx.net
2025-03-16 05:28:48+00:00 DEBUG start-mailserver.sh: Hostname has been set to mail xxx.net
2025-03-16 05:28:48+00:00 INFO  start-mailserver.sh: Container was restarted. Skipping most setup routines.
2025-03-16 05:28:48+00:00 DEBUG start-mailserver.sh: Checking /var/mail permissions
2025-03-16 05:28:48+00:00 DEBUG start-mailserver.sh: Removing files and directories from older versions
2025-03-16 05:28:48+00:00 DEBUG start-mailserver.sh: Ensuring /var/log/mail owneership + permissions are correct
/usr/local/bin/start-mailserver.sh: line 184: _setup_adjust_state_permissions: command not found
2025-03-16 05:28:48+00:00 DEBUG print-environment: Printing environment variables. Make sure no sensitive data is copied.
ACCOUNT_PROVISIONER='FILE'
AMAVIS_LOGLEVEL='0'
CLAMAV_MESSAGE_SIZE_LIMIT='25M'
DEFAULT_RELAY_HOST=''
DMS_VMAIL_GID='5000'
DMS_VMAIL_UID='5000'
DOVECOT_INET_PROTOCOLS='all'
DOVECOT_MAILBOX_FORMAT='maildir'
DOVECOT_TLS='no'
ENABLE_AMAVIS='1'
ENABLE_CLAMAV='0'
ENABLE_DNSBL='0'
ENABLE_FAIL2BAN='1'
ENABLE_FETCHMAIL='0'
ENABLE_GETMAIL='0'
ENABLE_IMAP='1'
ENABLE_MANAGESIEVE='0'
ENABLE_OAUTH2='0'
ENABLE_OPENDKIM='1'
ENABLE_OPENDMARC='1'
ENABLE_POLICYD_SPF='1'
ENABLE_POP3='0'
ENABLE_POSTGREY='0'
ENABLE_QUOTAS='1'
ENABLE_RSPAMD='0'
ENABLE_RSPAMD_REDIS='0'
ENABLE_SASLAUTHD='1'
ENABLE_SPAMASSASSIN='0'
ENABLE_SPAMASSASSIN_KAM='0'
ENABLE_SRS='0'
ENABLE_UPDATE_CHECK='1'
FAIL2BAN_BLOCKTYPE='drop'
FETCHMAIL_PARALLEL='0'
FETCHMAIL_POLL='300'
GETMAIL_POLL='5'
LOGROTATE_COUNT='4'
LOGROTATE_INTERVAL='weekly'
LOGWATCH_INTERVAL='none'
LOGWATCH_RECIPIENT='[email protected]'
LOGWATCH_SENDER='[email protected]'
LOG_LEVEL='debug'
MARK_SPAM_AS_READ='0'
MOVE_SPAM_TO_JUNK='1'
NETWORK_INTERFACE='eth0'
OVERRIDE_HOSTNAME='mail.xxx.net'
PERMIT_DOCKER='none'
PFLOGSUMM_RECIPIENT='[email protected]'
PFLOGSUMM_SENDER='[email protected]'
PFLOGSUMM_TRIGGER='none'
POSTFIX_DAGENT=''
POSTFIX_INET_PROTOCOLS='ipv4'
POSTFIX_MAILBOX_SIZE_LIMIT='0'
POSTFIX_MESSAGE_SIZE_LIMIT='10240000'
POSTFIX_REJECT_UNKNOWN_CLIENT_HOSTNAME='0'
POSTGREY_AUTO_WHITELIST_CLIENTS='5'
POSTGREY_DELAY='300'
POSTGREY_MAX_AGE='35'
POSTGREY_TEXT='Delayed by Postgrey'
POSTMASTER_ADDRESS='[email protected]'
POSTSCREEN_ACTION='enforce'
RELAY_HOST=''
REPORT_RECIPIENT='[email protected]'
REPORT_SENDER='[email protected]'
RSPAMD_CHECK_AUTHENTICATED='0'
RSPAMD_GREYLISTING='0'
RSPAMD_HFILTER='1'
RSPAMD_HFILTER_HOSTNAME_UNKNOWN_SCORE='6'
RSPAMD_LEARN='0'
RSPAMD_NEURAL='0'
SASLAUTHD_MECHANISMS='rimap'
SA_KILL='10.0'
SA_TAG2='6.31'
SA_TAG='2.0'
SMTP_ONLY='0'
SPAMASSASSIN_SPAM_TO_INBOX='1'
SPAM_SUBJECT=''
SPOOF_PROTECTION='0'
SRS_DOMAINNAME='xxx.net'
SRS_EXCLUDE_DOMAINS=''
SRS_SECRET=''
SRS_SENDER_CLASSES='envelope_sender'
SSL_TYPE='letsencrypt'
SUPERVISOR_LOGLEVEL='warn'
TLS_LEVEL='intermediate'
TZ=''
UPDATE_CHECK_INTERVAL='1d'
VIRUSMAILS_DELETE_DELAY='7'
2025-03-16 05:28:48+00:00 INFO  start-mailserver.sh: Starting daemons
2025-03-16 05:28:48+00:00 DEBUG start-mailserver.sh: Starting cron
2025-03-16 05:28:49+00:00 DEBUG start-mailserver.sh: Starting rsyslog
2025-03-16 05:28:49+00:00 DEBUG start-mailserver.sh: Starting dovecot
2025-03-16 05:28:49+00:00 DEBUG start-mailserver.sh: Starting update-check
2025-03-16 05:28:49+00:00 DEBUG start-mailserver.sh: Starting opendkim
2025-03-16 05:28:50+00:00 DEBUG start-mailserver.sh: Starting opendmarc
2025-03-16 05:28:50+00:00 DEBUG start-mailserver.sh: Starting postfix
2025-03-16 05:28:50+00:00 DEBUG start-mailserver.sh: Starting saslauthd_rimap
2025-03-16 05:28:51+00:00 DEBUG start-mailserver.sh: Starting fail2ban
2025-03-16 05:28:51+00:00 DEBUG start-mailserver.sh: Starting amavis
2025-03-16 05:28:51+00:00 DEBUG start-mailserver.sh: Starting changedetector
2025-03-16 05:28:51+00:00 INFO  start-mailserver.sh: mail.xxx.net is up and running
2025-03-16T05:28:49.590765+00:00 mail dovecot: master: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled)
2025-03-16T05:28:50.112342+00:00 mail opendkim[224]: OpenDKIM Filter v2.11.0 starting (args: -f)
2025-03-16T05:28:50.399101+00:00 mail opendmarc[235]: OpenDMARC Filter v1.4.2 starting (args: -f -p inet:8893@localhost -P /var/run/opendmarc/opendmarc.pid)
2025-03-16T05:28:50.399133+00:00 mail opendmarc[235]: additional trusted authentication services: mail.xxx.net
2025-03-16T05:28:51.181520+00:00 mail postfix/postfix-script[339]: starting the Postfix mail system
2025-03-16T05:28:51.197483+00:00 mail postfix/master[340]: daemon started -- version 3.7.11, configuration /etc/postfix
2025-03-16T05:28:52.384332+00:00 mail amavis[366]: starting. /usr/sbin/amavisd at mail.xxx.net amavis-2.13.0 (20230106), Unicode aware, LC_CTYPE="C.UTF-8"
2025-03-16T05:28:52.384382+00:00 mail amavis[366]: perl=5.036000, user=, EUID: 999 (999);  group=(), EGID: 999 999 (999 999)
2025-03-16T05:28:52.408107+00:00 mail amavis[366]: Net::Server: Group Not Defined.  Defaulting to EGID '999 999'
2025-03-16T05:28:52.408171+00:00 mail amavis[366]: Net::Server: User Not Defined.  Defaulting to EUID '999'
2025-03-16T05:28:52.417786+00:00 mail amavis[366]: No ext program for   .zoo, tried: zoo
2025-03-16T05:28:52.417852+00:00 mail amavis[366]: No ext program for   .doc, tried: ripole
2025-03-16T05:28:52.418201+00:00 mail amavis[366]: No ext program for   .zst, tried: unzstd
2025-03-16T05:28:52.418236+00:00 mail amavis[366]: No decoder for       .F
2025-03-16T05:28:52.418248+00:00 mail amavis[366]: No decoder for       .doc
2025-03-16T05:28:52.418257+00:00 mail amavis[366]: No decoder for       .zoo
2025-03-16T05:28:52.418266+00:00 mail amavis[366]: No decoder for       .zst
sasl_method=LOGIN, [email protected]
2025-03-16T05:02:58.145410+00:00 mail opendkim[224]: 182FAA6AA8: DKIM-Signature field added (s=mail, d=xxx.net)
2025-03-16T05:02:58.190023+00:00 mail postfix/qmgr[342]: 182FAA6AA8: from=<[email protected]>, size=239, nrcpt=1 (queue active)
2025-03-16T05:02:58.191762+00:00 mail postfix/submission/smtpd[442]: disconnect from unknown[213.14.195.24] ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=8
2025-03-16T05:02:58.351408+00:00 mail postfix/smtpd-amavis/smtpd[517]: connect from localhost[127.0.0.1]
2025-03-16T05:02:58.354267+00:00 mail postfix/smtpd-amavis/smtpd[517]: NOQUEUE: reject: RCPT from localhost[127.0.0.1]: 554 5.7.1 <[email protected]>: Recipient address rejected: Access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<localhost>
> 2025-03-16T05:02:58.354855+00:00 mail amavis[434]: (00434-01) Negative SMTP resp. to DATA: 554 5.5.1 Error: no valid recipients
2025-03-16T05:02:58.355434+00:00 mail amavis[434]: (00434-01) (!)0_oRnc0GkWJx FWD from <xxx@xxx> -> <[email protected]>, BODY=7BIT 554 5.7.1 from MTA(smtp:[127.0.0.1]:10025): 554 5.7.1 <[email protected]>: Recipient address rejected: Access denied
> 2025-03-16T05:02:58.370277+00:00 mail amavis[434]: (00434-01) Blocked MTA-BLOCKED {RejectedOpenRelay}, [213.14.195.24]:42634 [213.14.195.24] <[email protected]> -> <[email protected]>, Queue-ID: 182FAA6AA8, Message-ID: <20250316050257.038425@xxx>, mail_id: 0_oRnc0GkWJx, Hits: -, size: 552, 178 ms
2025-03-16T05:02:58.376691+00:00 mail postfix/smtp-amavis/smtp[451]: 182FAA6AA8: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=0.28, delays=0.09/0/0.01/0.18, dsn=5.7.1, status=bounced (host 127.0.0.1[127.0.0.1] said: 554 5.7.1 id=00434-01 - Rejected by next-hop MTA on relaying, from MTA(smtp:[127.0.0.1]:10025): 554 5.7.1 <[email protected]>: Recipient address rejected: Access denied (in reply to end of DATA command))

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions