4

Sending an email from my local network is going fine. Also through Thunderbird or remote with Roundcube, which is locally installed. But now, I am in Asia and try to send an email with Thunderbird. The following error is in the log:

postfix/submission/smtpd[4588]: NOQUEUE: reject: RCPT from unknown[110.170.163.146]: 450 4.7.1 Client host rejected: cannot find your reverse hostname, [110.170.163.146]; from=<<me>@<mydomain.com>> to=<<me>@<mydomain.co>> proto=ESMTP helo=<[10.10.3.55]>

dig +short -t A mail.<mydomain.com> gives: xxx.xxx.xxx.xxx, the IP of my server.

dig +short -x 110.170.163.146 gives: 110-170-163-146.static.asianet.co.th. Here you can see, I am now in Thailand.

In Thunderbird I have:

Server Name: mail.<mydomain.com>
Port: 587
Connection security: STARTTLS
Authentication method: Normal password
Username: <me>@<mydomain.com>

All smtpd lines in master.cf:

submission     inet     n    -    y    -    -    smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_tls_wrappermode=no
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=inet:10.89.0.10:12345

All smtpd rules in main.cf:

smtpd_tls_cert_file = /etc/letsencrypt/live/mail.<mydomain.com>/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.<mydomain.com>/privkey.pem
smtpd_tls_security_level = may
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_sasl_auth_enable = yes
smtpd_tls_auth_only = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = inet:dovecot:12345
reject_unauth_destination, check_policy_service unix:private/spfcheck check_sender_access /etc/postfix/sender_access check_recipient_access /etc/postfix/recipient_access
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, check_policy_service unix:private/spfcheck
smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = $smtpd_milters
smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated,
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname
smtpd_client_restrictions = permit_mynetworks, reject_unknown_reverse_client_hostname

As far as I can tell, the error message is "reverse hostname" related. I am outside my normal hostname. But Thunderbird should log in and still send the email.

Anyone any idea how to solve this issue?

anx
  • 6,875
  • 4
  • 22
  • 45
Zilvermeeuw
  • 61
  • 6
  • I edited a presumed copy-paste mistake in your question. If I was wrong, and that was an actual syntax error in your file, check that. For the future, I recommend you always review configuration using the commands `postconf -n` and `postconf -M` - not only will that always produce well-formatted output, it will also help identify differences between intended and effective configuration rooted in syntax problems. – anx Aug 28 '22 at 09:02
  • Nice options!. I do regularly postfix reload and check, but (see below). But sometimes i forget..... – Zilvermeeuw Aug 28 '22 at 09:18

1 Answers1

6

What is happening is that your submission service is inheriting the main.cf options. Those deviations from the postfix defaults may not be unreasonable for server to server mail exchange. But for clients connecting from just about anywhere (not through fixed uplinks or VPN), a resolvable reverse name not be expected.

It also is unnecessary to demand both reverse name and sasl. The name submitted during authentication serves as a much more useful identifier anyway (unique, locally administered, verified).

Suggested fix: Override the relevant option for the authentication-only port(s) in your master.cf, as is already done with the restriction set demanding authentication:

submission     inet     n    -    y    -    -    smtpd
  -o ...
  -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
  -o smtpd_client_restrictions=
  -o ...
  -o ...

After making changes, reload configuration (depending on distribution, something like systemctl reload postfix) and check logs produced during startup.

anx
  • 6,875
  • 4
  • 22
  • 45
  • Thanks!. I needed to add the "-o smtpd_client_restrictions=" to the master.cf AND change it in main.cf to also an "smtpd_client_restrictions=". But now I can send emails from Asia. Edit: I have not enough points to upvote your answer (yet). – Zilvermeeuw Aug 28 '22 at 07:35
  • I would not recommend changing the main.cf settings (presumably applied to the usual server to server exchanges) while working on an MUA-only problem. It is an unrelated piece of policy, and if it has worked well for you before, why relax those requirements now? – anx Aug 28 '22 at 07:54
  • 1
    I restored the main.cf. Probably I forgot to do "postfix reload" or something. – Zilvermeeuw Aug 28 '22 at 09:14