Relay access denied

Question

Level 1

125 points

Relay access denied

Hi,

Ive been doing some research on this issue and I seem to be finding only the OPPOSITE of what I'm experinecing. I can send emails find but any email I send from another account returns the error "Relay access denied." I don't know how to fix this because it's my understanding that the server admin settings exist to prevent your server from being used to send unauthorized emails. Receiving should have nothing to do with these settings correct?

Thanks for any help.

Home: Dual 2Ghz PowerMac, 2 MacBooks, 2.66 GHz MacBook Pro, Mac OS X (10.6.3), Work: 10 PowerMac G5s, 18 Intel iMacs, 2 Intel XServes

Posted on Nov 27, 2010 9:09 AM

Reply

Answer 1

Scott Howe Author

Level 1

125 points

Nov 28, 2010 8:22 AM in response to UptimeJeff

Scotthowe@sapowe.com

Let me know when you've sent.

Reply

Answer 2

UptimeJeff

Level 4

3,479 points

Nov 28, 2010 8:26 AM in response to Scott Howe

OK. that helped....

please post the results of this command run from terminal:
postconf -n

Reply

Answer 3

Scott Howe Author

Level 1

125 points

Nov 28, 2010 8:37 AM in response to UptimeJeff

biff = no
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/libexec/postfix
debug peerlevel = 2
enable serveroptions = yes
header_checks = pcre:/etc/postfix/custom headerchecks
html_directory = /usr/share/doc/postfix/html
inet_interfaces = all
mail_owner = _postfix
mailbox sizelimit = 0
mailbox_transport = dovecot
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
maps rbldomains =
message sizelimit = 0
mydestination = $myhostname, localhost.$mydomain, localhost, sapowe.com, $mydomain
mydomain = sapowe.com
mydomain_fallback = localhost
myhostname = mail.sapowe.com
mynetworks = 10.0.0.0/8,127.0.0.0/8
newaliases_path = /usr/bin/newaliases
queue_directory = /private/var/spool/postfix
readme_directory = /usr/share/doc/postfix
recipient_delimiter = +
relayhost =
sample_directory = /usr/share/doc/postfix/examples
sendmail_path = /usr/sbin/sendmail
setgid_group = _postdrop
smtpd clientrestrictions = permit_mynetworks permit saslauthenticated reject rblclient zen.spamhaus.org reject
smtpd enforcetls = no
smtpd helorequired = yes
smtpd helorestrictions = reject invalid_helohostname reject non_fqdn_helohostname
smtpd pw_server_securityoptions = gssapi,cram-md5
smtpd recipientrestrictions = permit saslauthenticated permit_mynetworks reject unauthdestination check policyservice unix:private/policy permit
smtpd sasl_authenable = yes
smtpd tlsCAfile = /etc/certificates/macserver.sapowe.com.F6CB094EA1F7F45E3C7EEE9E5CAAB3CF80D1739A .chain.pem
smtpd tls_certfile = /etc/certificates/macserver.sapowe.com.F6CB094EA1F7F45E3C7EEE9E5CAAB3CF80D1739A .cert.pem
smtpd tls_excludeciphers = SSLv2, aNULL, ADH, eNULL
smtpd tls_keyfile = /etc/certificates/macserver.sapowe.com.F6CB094EA1F7F45E3C7EEE9E5CAAB3CF80D1739A .key.pem
smtpd use_pwserver = yes
smtpd usetls = yes
tls randomsource = dev:/dev/urandom
unknown local_recipient_rejectcode = 550
virtual aliasmaps = $virtual_map

Reply

Answer 4

UptimeJeff

Level 4

3,479 points

Nov 28, 2010 8:48 AM in response to Scott Howe

edit the following lines in /etc/postfix/main.cf

Change from:


smtpdclientrestrictions = permit_mynetworks permitsaslauthenticated rejectrblclient zen.spamhaus.org reject

To this:

smtpdclientrestrictions = permit_mynetworks permitsaslauthenticated rejectrblclient zen.spamhaus.org permit

then stop/start mail service and test again.

Reply

Answer 5

Scott Howe Author

Level 1

125 points

Nov 28, 2010 8:53 AM in response to UptimeJeff

done

Reply

Answer 6

UptimeJeff

Level 4

3,479 points

Nov 28, 2010 8:56 AM in response to Scott Howe

you should be all set now...

because you have greylisting enabled, you may experience a short delay for some mail from new locations...

Jeff

Reply

Answer 7

MrHoffman

Level 10

148,641 points

Nov 28, 2010 9:14 AM in response to UptimeJeff

Wouldn't that open up non-authenticated access?

Reply

Answer 8

UptimeJeff

Level 4

3,479 points

Nov 28, 2010 9:24 AM in response to MrHoffman

break it down....


smtpdclientrestrictions =

permit_mynetworks

allows clients on your LAN to bypass restrictions

permitsaslauthenticated

allows authenticated smtp sessions to bypass restrictions

rejectrblclient zen.spamhaus.org

this is the meat of the line, it blocks any servers listed in this rbl

permit

You need to permit smtp clients (other servers) to connect if they aren't listed in the rbl
If you change this to reject, then you allow mynetworks and sasl_auth but reject EVERYTHING else (like valid smtp servers)

Reply

Answer 9

Scott Howe Author

Level 1

125 points

Nov 28, 2010 10:40 AM in response to UptimeJeff

Thanks. Worked. Thanks for sticking with me on this guys.

Reply