Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Relay denied for iPhone

Hi folks.


I am using an iPhone into my 10.5.8 Server mail server. I'm getting messages saying "...rejected by the server because it does not allow relaying". How can I fix that? Can I just use authentication on my mail account to qualify any relayed messages?


In the Relay tab, I have the following:


Accept SMTP relays only from these hosts and networks: checked, with various ranges of the two main DSL and Cable networks in Canada.


Refuse all messages from these hosts and networks: checked, with one IP number in there that I know is bad


Use these junk mail rejection servers (real-time blacklist): checked, with zen.spamhaus.org used.


I don't want to accept any mail except from the mail clients that I use, based on accounts with a password. I think I am using the wrong setup. I should have all hosts/networks open, and qualify on the account only.


How do I do that?


Cheers

iMac, Mac OS X (10.5.8)

Posted on May 31, 2011 3:16 PM

Reply
12 replies

Jun 7, 2011 7:45 PM in response to BioRich

You definitely don't want to allow relay from large blocks of IPs....


You asked this:

Can I just use authentication on my mail account to qualify any relayed messages?


The answer is yes, use smtp authentication.


You may also need to enable an alternate smtp port, the default of 25 is often blocked.

You can do this by uncommenting the submission line in /etc/postfix/master.cf

Stop/start mail service

Then open port 587 in your router.

Jun 7, 2011 7:48 PM in response to UptimeJeff

Hi there. As it stands now I'm working on SMTP Auth. I've changed my SMTP port, and it seems to work some of the time.


Get this. Turns out some of the Bell Canada IPs are being blocked because they're blacklisted. So it wasn't the server saying "we don't allow relays", but "your current IP is blacklisted, so you are shut out".


Lovely, eh?


Thanks for the reply.

Jun 7, 2011 7:55 PM in response to UptimeJeff

Here is the result:


ommand_directory = /usr/sbin

config_directory = /etc/postfix

content_filter = smtp-amavis:[127.0.0.1]:10024

daemon_directory = /usr/libexec/postfix

debug_peer_level = 2

enable_server_options = yes

html_directory = no

inet_interfaces = all

local_recipient_maps = proxy:unix:passwd.byname $alias_maps

luser_relay =

mail_owner = _postfix

mailbox_size_limit = 0

mailbox_transport = cyrus

mailq_path = /usr/bin/mailq

manpage_directory = /usr/share/man

maps_rbl_domains =

message_size_limit = 10485760

mydestination = $myhostname,localhost.$mydomain,localhost

mydomain = pints.com

mydomain_fallback = localhost

myhostname = beacon.pints.com

mynetworks = 127.0.0.0/8

newaliases_path = /usr/bin/newaliases

queue_directory = /private/var/spool/postfix

readme_directory = /usr/share/doc/postfix

relayhost =

sample_directory = /usr/share/doc/postfix/examples

sendmail_path = /usr/sbin/sendmail

setgid_group = _postdrop

smtpd_client_restrictions = hash:/etc/postfix/smtpdreject cidr:/etc/postfix/smtpdreject.cidr permit_mynetworks reject_rbl_client zen.spamhaus.org permit

smtpd_enforce_tls = no

smtpd_pw_server_security_options = cram-md5

smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination,permit

smtpd_sasl_auth_enable = yes

smtpd_tls_cert_file = /etc/certificates/Default.crt

smtpd_tls_key_file = /etc/certificates/Default.key

smtpd_tls_loglevel = 0

smtpd_use_pw_server = yes

smtpd_use_tls = no

unknown_local_recipient_reject_code = 550

virtual_mailbox_domains = hash:/etc/postfix/virtual_domains

virtual_transport = lmtp:unix:/var/imap/socket/lmtp


Hey that would be fantastic.


Cheers

Jun 8, 2011 4:45 AM in response to BioRich

In this line:

smtpd_client_restrictions = hash:/etc/postfix/smtpdreject cidr:/etc/postfix/smtpdreject.cidr permit_mynetworks reject_rbl_client zen.spamhaus.org permit


you could add permit_sasl_authenticated just after the = sign.

This would allow smtp authenticated users.


Another way to do the same, and have even more control, is you can specify main.cf options inside of your master.cf. An example of how this can come in handy.

You probably have port 587 setup as your alternate SMTP.

Only staff use 587, public mail comes in on 25.

This allows you to specify a different set of restrictions for staff vs public.

Here's an example:


submission inet n - n - - smtpd

-o smtpd_client_restrictions=

-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject

-o content_filter=


The above would ONLY allow smtp-auth users to submit mail (no smtp-auth, mail is rejected).

The client_restrictions and content filter are disabled.

This greases the path for smtp-auth users.


Hope that helps...


Jeff

Jun 8, 2011 1:00 PM in response to UptimeJeff

Hi Jeff. Thanks for the notes.


Assuming that this SMTP Auth will work fine, I can restructure everything so that I run on normal ports. So yes, your port allocation would be what I would be choosing to use, instead of the restructuring I currently have (which is giving me problems due to limitations on the iPhone Mail setup).


So let me ask you this: Why wouldn't they do that as default, given that the target market for this instance by Apple is towards SME's? I would assume accounts with passwords would be the majority of deployments.


I'll give this a try soon. It sounds great. I never thought of modifying Postfix, as I know nothing about it.


Cheers

Jun 8, 2011 5:34 PM in response to UptimeJeff

Sorry Jeff, which file do I put this into, and where?


It seems it is on line 10, but commented out. This is what ai have now in master.cf:


submission inet n - n - - smtpd

# -o smtpd_enforce_tls=yes

# -o smtpd_sasl_auth_enable=yes

-o smtpd_client_restrictions=

-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject

-o content_filter=


I've flushed all the mappings in my router (Airport Extreme). I have IMAP set without SSL on port 143 public/private. I've set SMTP on port 25 public/private. Now my office email isn't working either. It says it's disallowing port 143.


How do I start from the beginning? I want to make sure you know what the problem is. Usually, when out in the public, I use WiFi to get into my mail server. That means I'm on Bell or Rogers, both which block a lot of ports. So getting to my own router on a port < 1000 (I usually aim for higher than 3000), is impossible.


How can I have my iPhone reach in normally from these networks, and also from the home office?


Cheers

Jun 8, 2011 6:50 PM in response to BioRich

They way you setup master.cf is fine, just be sure you have a couple spaces in front of the "-o"

Follow the same format as other lines.



I'm not sure what you mean about getting your router on a specific port...

You can put imap or smtp service on any port you want (although you must have port 25 open for incoming public mail). 143 is the 'standard' port but it could be any.


I can't advise you on how to make sure you iphone can connect because I'm not familiar with Rogers or Bell.

I can tell you that I've never had trouble with clients connecting on standard ports to mail servers I support.. never had a case where 143, 993 or 587 are blocked.

Jun 9, 2011 11:52 AM in response to UptimeJeff

Any problems if I put a tab in front of the -o? I am just used to that with most everything I've found.


I have asked a couple of times in the Airport Extreme section about port mapping. It is confusing how it works, so I make assumptions as to how it all works. If I set public 500 and private 400 for a service, does that mean it listens on the public side on port 500 and resend on port 400 on the private side? Again, the first problem in all of this is that the carriers block up to (let's say) port 3000. So I want to have my iPhone's email speaking both IMAP and SMTP on ports that I force above 3000. I want my mail server to remain on the same normal ports (25, 143 for SMTP, IMAP), as I'm running a client at the office.


When I get home, my iPhone needs to connect over the WLAN, still to mail.mydomain.com, but being internal, would it not have tto use port 143 for that?


Not really clear how to make things work, while bypassing the spamhaus issue. You are saying that SMTP Auth will bypass relay issues with the entry above.


Any ideas?


Cheers

Jun 9, 2011 12:45 PM in response to BioRich

If you look in master.cf, you will probably find that -o is preceded by spaces...

Tabs aren't as common in unix config files.. use the same format as other similar lines. (copy/paste is good)

Here's what the master.cf man page says:

A logical line starts with non-whitespace text. A line that starts with whitespace continues a logical line.


You are correct that you can map a public port to a private port. So that 4000/public maps to 143/private.

But why would u want to do that?

Pick a port and use the same inside and outside, otherwise you have to change ports if you use a laptop on LAN or on public internet.


If your config has permit_sasl_authenticated before reject_rbl_client then smtp-auth users will bypass the blacklists. Those lines are read in order, as soon as a permit test is passed, the remaining restrictions from that line don't matter.

Jun 9, 2011 12:49 PM in response to UptimeJeff

OK that's what I have it set to now. I am assuming that stopping service, and starting it back up again will do the trick to get the cf files read and assigned.


The reason I'm going so high is that the two main carriers here (Bell and Rogers) are the DSL and cable high speed internet providers behind most if not all WiFi's in Toronto. The problem is that they block SMTP outgoing mail ports, as they sell it as a business and want you to use their servers. I am not a client, just a guy walking around with his iPhone. I use WiFi a lot, as it is much faster, and doesn't hit my bill.


So I have to go very high and point to my static IP in order to even get to my router, it being the gateway to the outside world.


It seems to be working now, but I will be testing. Thanks for the clarification on the router port mapping. Nobody has answered my calls on that question.


Cheers

Relay denied for iPhone

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.