3

In postfix, I'm unable to receive mails from the specific domain but I'm able to send mails to it.

For some reason postfix thinks the domain is internal, correct me if I'm wrong?

Sample from postfix maillog:

Sep 17 18:45:52 smail1 postfix/smtp[23241]: 269D140A92: to=<prvs=7337e4471e=johnd@abc.co.il>, relay=mail1.abc.co.il[5.6.7.8]:25, delay=0.28, delays=0/0/0.27/0.01, dsn=5.0.0, status=undeliverable (host mail1.abc.co.il[5.6.7.8] said: 550 Recipient address rejected: User unknown (in reply to RCPT TO command))
Sep 17 18:45:55 smail1 postfix/smtpd[23196]: send attr address = prvs=7337e4471e=johnd@abc.co.il
Sep 17 18:45:55 smail1 postfix/smtpd[23196]: input attribute value: host mail1.abc.co.il[5.6.7.8] said: 550 Recipient address rejected: User unknown (in reply to RCPT TO command)
Sep 17 18:45:55 smail1 postfix/smtpd[23196]: check_mail_access: prvs=7337e4471e=johnd@abc.co.il
Sep 17 18:45:55 smail1 postfix/smtpd[23196]: ctable_locate: move existing entry key prvs=7337e4471e=johnd@abc.co.il
Sep 17 18:45:55 smail1 postfix/smtpd[23196]: check_access: prvs=7337e4471e=johnd@abc.co.il
Sep 17 18:45:55 smail1 postfix/smtpd[23196]: check_domain_access: abc.co.il
Sep 17 18:45:55 smail1 postfix/smtpd[23196]: check_namadr_access: name xyz.abc.co.il addr 1.2.3.4
Sep 17 18:45:55 smail1 postfix/smtpd[23196]: check_domain_access: xyz.abc.co.il
Sep 17 18:45:55 smail1 postfix/smtpd[23196]: check_namadr_access: name xyz.abc.co.il addr 1.2.3.4
Sep 17 18:45:55 smail1 postfix/smtpd[23196]: check_domain_access: xyz.abc.co.il
Sep 17 18:45:55 smail1 postfix/smtpd[23196]: dict_regexp_lookup: /etc/postfix/regexp_client: xyz.abc.co.il
Sep 17 18:45:55 smail1 postfix/smtpd[23196]: NOQUEUE: reject: RCPT from xyz.abc.co.il[1.2.3.4]: 450 4.1.7 <prvs=7337e4471e=johnd@abc.co.il>: Sender address rejected: unverified address: host mail1.abc.co.il[5.6.7.8] said: 550 Recipient address rejected: User unknown (in reply to RCPT TO command); from=<prvs=7337e4471e=johnd@abc.co.il> to=<janed@neptune.co.il> proto=ESMTP helo=<mail1.abc.co.il>
Sep 17 18:45:55 smail1 postfix/smtpd[23196]: > xyz.abc.co.il[1.2.3.4]: 450 4.1.7 <prvs=7337e4471e=johnd@abc.co.il>: Sender address rejected: unverified address: host mail1.abc.co.il[5.6.7.8] said: 550 Recipient address rejected: User unknown (in reply to RCPT TO command)
Sep 17 18:46:00 smail1 postfix/smtpd[23196]: < xyz.abc.co.il[1.2.3.4]: QUIT
Sep 17 18:46:00 smail1 postfix/smtpd[23196]: > xyz.abc.co.il[1.2.3.4]: 221 2.0.0 Bye
Sep 17 18:46:00 smail1 postfix/smtpd[23196]: match_hostname: xyz.abc.co.il ~? 192.168.57.0/24
Sep 17 18:46:00 smail1 postfix/smtpd[23196]: match_hostname: xyz.abc.co.il ~? 127.0.0.0/8
Sep 17 18:46:00 smail1 postfix/smtpd[23196]: match_hostname: xyz.abc.co.il ~? 192.168.8.1/32
Sep 17 18:46:00 smail1 postfix/smtpd[23196]: match_hostname: xyz.abc.co.il ~? 172.19.214.0/24
Sep 17 18:46:00 smail1 postfix/smtpd[23196]: match_hostname: xyz.abc.co.il ~? 10.1.2.0/24
Sep 17 18:46:00 smail1 postfix/smtpd[23196]: match_hostname: xyz.abc.co.il ~? 10.7.15.152/32
Sep 17 18:46:00 smail1 postfix/smtpd[23196]: match_hostname: xyz.abc.co.il ~? 10.7.15.150/32
Sep 17 18:46:00 smail1 postfix/smtpd[23196]: match_hostname: xyz.abc.co.il ~? 10.7.15.152/32
Sep 17 18:46:00 smail1 postfix/smtpd[23196]: match_hostname: xyz.abc.co.il ~? 192.168.58.8/32
Sep 17 18:46:00 smail1 postfix/smtpd[23196]: match_list_match: xyz.abc.co.il: no match
Sep 17 18:46:00 smail1 postfix/smtpd[23196]: disconnect from xyz.abc.co.il[1.2.3.4]

POSTCONF -N

2bounce_notice_recipient = postmaster@neptune.co.il
address_verify_sender = postmaster@neptune.co.il
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
bounce_notice_recipient = postmaster@neptune.co.il
bounce_template_file = /etc/postfix/bounce.cf
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debug_peer_list = neptune.co.il
default_destination_concurrency_limit = 8
delay_notice_recipient = postmaster@neptune.co.il
disable_mime_input_processing = no
disable_mime_output_conversion = no
disable_vrfy_command = yes
error_notice_recipient = postmaster@neptune.co.il
header_checks = regexp:/etc/postfix/header_checks
html_directory = no
inet_interfaces = all
inet_protocols = ipv4
local_destination_concurrency_limit = 10
local_destination_recipient_limit = 300
mail_owner = postfix
mailbox_command = /usr/bin/procmail
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
message_size_limit = 51200000
mydestination = $myhostname, localhost.$mydomain, localhost
mydomain = neptune.co.il
myhostname = mail.neptune.co.il
mynetworks = 192.168.57.0/24, 127.0.0.0/8, 192.168.8.1/32, 172.19.214.0/24, 10.1.2.0/24, 10.7.15.152/32 , 10.7.15.150/32 ,10.7.15.152/32, 192.168.58.8/32
mynetworks_style = host
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
recipient_delimiter = +
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_sender_dependent_authentication = yes
smtp_tls_policy_maps = hash:/mailroot/postfix/tls_policy
smtp_tls_security_level = may
smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
smtpd_data_restrictions = permit
smtpd_helo_required = yes
smtpd_recipient_restrictions = permit_mynetworks,       permit_sasl_authenticated,      reject_unlisted_sender, reject_unlisted_recipient,      reject_invalid_hostname,        reject_invalid_helo_hostname,   reject_non_fqdn_helo_hostname,       reject_non_fqdn_sender, reject_non_fqdn_recipient,      reject_unknown_sender_domain,   reject_unknown_recipient_domain,        reject_unverified_sender,       reject_unlisted_recipient       reject_unauth_destination,      check_sender_access hash:/etc/postfix/sender_access  check_client_access hash:/etc/postfix/vip_ip,   check_client_access regexp:/etc/postfix/regexp_client,  reject_rbl_client bl.spamcop.net,       reject_rbl_client sbl.spamhaus.org,     reject_rbl_client cbl.abuseat.org,   reject_rbl_client dul.dnsbl.sorbs.net,  reject_rbl_client bl.spamcop.net,       permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = smtpd
smtpd_sasl_security_options = noanonymous
smtpd_sender_login_maps = ldap:/etc/postfix/loginmaps.cf
smtpd_tls_CAfile = /etc/pki/tls/certs/rapidssl.pem
smtpd_tls_cert_file = /etc/pki/tls/certs/mail.neptune.co.il.crt
smtpd_tls_key_file = /etc/pki/tls/private/mail.neptune.co.il.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550
virtual_alias_maps = hash:/etc/postfix/virtual, ldap:/etc/postfix/groupmaps.cf
virtual_mailbox_base = /mailroot/var/lib/imap
virtual_mailbox_domains = ldap:domain
virtual_mailbox_maps = ldap:/etc/postfix/loginmaps.cf
virtual_transport = lmtp:unix:/mailroot/var/lib/imap/socket/lmtp
Andrew Schulman
  • 8,561
  • 21
  • 31
  • 47
Eran
  • 45
  • 1
  • 2
  • 8

1 Answers1

8

A bit of advice: please don't throw in some rules in smtpd_*_restriction if you don't understand how they work, it will bite you someday.

What's causing the 'User unknown (in reply to RCPT TO command)' errors for external senders

Those errors are caused by this restriction: reject_unverified_sender. This special restriction will check if the sender address prvs=7337e4471e=johnd@example.co.il exists as a remote sender. The details of the checking mechanism can be found in this documentation.

In short, postfix will try to telnet to the remote sender and check if the remote accepts the EMAIL TO prvs=7337e4471e=johnd@example.co.il. It will appear in your log that the remote sender doesn't accept email TO prvs=7337e4471e=johnd@example.co.il.

Sep 17 18:45:52 smail1 postfix/smtp[23241]: 269D140A92: to=, relay=mail1.abc.co.il[5.6.7.8]:25, delay=0.28, delays=0/0/0.27/0.01, dsn=5.0.0, status=undeliverable (host mail1.abc.co.il[5.6.7.8] said: 550 Recipient address rejected: User unknown (in reply to RCPT TO command))

In the above case, because the remote sender rejected it, sender was unverified. So, your server refuses to receive the email.

Doing sender_verification is fine for small email traffic, but it can be annoying for larger traffic. See some reasons why you should turn it off in this article

Configuration review

Here's the list of restrictions you should turn off, or at least understand their behaviors before turning them on.

Let's review your smtpd_recipient_restrictions parameters.

permit_mynetworks,
permit_sasl_authenticated,

Ok

reject_unlisted_sender,

See this page

reject_unlisted_recipient,

See this page

reject_invalid_hostname,

reject_invalid_hostname is an alias for reject_invalid_helo_hostname.

reject_invalid_helo_hostname,

Restriction reject_invalid_hostname is for postfix < 2.3. This restriction will reject the request when the HELO or EHLO hostname is malformed.

reject_non_fqdn_helo_hostname,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,

Ok

reject_unknown_sender_domain,
reject_unknown_recipient_domain,

Good. It will reject emails from non-existing domains or not-well-configured domains.

reject_unverified_sender,

As explained above

reject_unlisted_recipient,

Duplicate (?)

reject_unauth_destination,

This is a mandatory restriction.

check_sender_access hash:/etc/postfix/sender_access,
check_client_access hash:/etc/postfix/vip_ip,
check_client_access regexp:/etc/postfix/regexp_client,

Ok

reject_rbl_client bl.spamcop.net,
reject_rbl_client sbl.spamhaus.org,
reject_rbl_client cbl.abuseat.org,
reject_rbl_client dul.dnsbl.sorbs.net,

Ok

reject_rbl_client bl.spamcop.net,

Duplicate (again?)

permit

Ok

MrWhite
  • 11,643
  • 4
  • 25
  • 40
masegaloeh
  • 17,978
  • 9
  • 56
  • 104