Postfix ошибка relay access denied

This morning, in order to correct a problem with a name mismatch in the security certificate, I followed the recommended steps from How to fix mail server SSL?, but now, when attempting to send an email from a client (in this case the client is Windows Mail), I receive the following error.

The rejected e-mail address was
’email@gmail.com’. Subject ‘This is a
test. ‘, Account: ‘mail.domain.com’,
Server: ‘mail.domain.com’, Protocol:
SMTP, Server Response: ‘554 5.7.1
: Relay access
denied’, Port: 25, Secure(SSL): No,
Server Error: 554, Error Number:
0x800CCC79

Edit: I can still retrieve emails from this account, and I send emails to other accounts at the same domain. I just can’t send emails to recipients outside of our domain.

I tried disabling TLS altogether but no dice, I still get the same error.

When I check file mail.log, I see the following.

Jul 18 08:24:41 company imapd: LOGIN, user=user_name@domain.com, ip=[::ffff:111.111.11.11], protocol=IMAP
Jul 18 08:24:42 company imapd: DISCONNECTED, user=user_name@domain.com, ip=[::ffff:111.111.11.11], headers=0, body=0, rcvd=83, sent=409, time=1
Jul 18 08:25:19 company postfix/smtpd[29282]: connect from company.university.edu[111.111.11.11]
Jul 18 08:25:19 company postfix/smtpd[29282]: NOQUEUE: reject: RCPT from company.university.edu[111.111.11.11]: 554 5.7.1 <email@gmail.com>: Relay access denied; from=<user_name@domain.com> to=<email@gmail.com> proto=ESMTP helo=<UserPC>
Jul 18 08:25:19 company postfix/smtpd[29282]: disconnect from company.university.edu[111.111.11.11]
Jul 18 08:25:22 company imapd: DISCONNECTED, user=user_name@domain.com, ip=[::ffff:111.111.11.11], headers=13, body=142579, rcvd=3289, sent=215892, time=79

File main.cf looks like this:

#
# Postfix MTA Manager Main Configuration File;
#
# Please do NOT edit this file manually;
#

#
# Postfix directory settings; These are critical for normal Postfix MTA functionallity;
#

command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
program_directory = /usr/lib/postfix

#
# Some common configuration parameters;
#

inet_interfaces = all
mynetworks = 127.0.0.0/8
mynetworks_style = host

myhostname = mail.domain.com
mydomain = domain.com
myorigin = $mydomain

smtpd_banner = $myhostname ESMTP 2.4.7.1 (Debian/GNU)
setgid_group = postdrop

#
# Receiving messages parameters;
#

mydestination = localhost, company 
append_dot_mydomain = no
append_at_myorigin = yes
transport_maps = mysql:/etc/postfix/transport.cf

#
# Delivering local messages parameters;
#

mail_spool_directory = /var/spool/mail
mailbox_size_limit = 0
mailbox_command = procmail -a "$EXTENSION"

biff = no

alias_database = hash:/etc/aliases

local_recipient_maps =

#
# Delivering virtual messages parameters;
#
virtual_mailbox_maps=mysql:/etc/postfix/mysql_virt.cf
virtual_uid_maps=mysql:/etc/postfix/uids.cf
virtual_gid_maps=mysql:/etc/postfix/gids.cf
virtual_mailbox_base=/usr/local/virtual
virtual_maps=mysql:/etc/postfix/virtual.cf
virtual_mailbox_domains=mysql:/etc/postfix/virtual_domains.cf


#
# SASL paramters;
#
smtp_use_tls = yes
smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s

smtp_tls_CAfile = /etc/postfix/ssl/smptd.pem
smtp_tls_cert_file = /etc/postfix/ssl/smptd.crt
smtp_tls_key_file = /etc/postfix/ssl/smptd.key

smtpd_tls_CAfile = /etc/postfix/ssl/smptd.pem
smtpd_tls_cert_file = /etc/postfix/ssl/smptd.crt
smtpd_tls_key_file = /etc/postfix/ssl/smptd.key

smtpd_sasl_auth_enable = yes

smtpd_sasl_security_options = noanonymous

smtpd_sasl_local_domain =

broken_sasl_auth_clients = yes

smtpd_sender_restrictions =
        permit_sasl_authenticated
        permit_mynetworks

smtpd_recipient_restrictions =
        permit_sasl_authenticated
        check_recipient_access hash:/etc/postfix/filtered_domains
        permit_mynetworks
        reject_unauth_destination

As a side note, my employer wants to be able to send emails from clients (Thunderbird and Outlook) both from within our local network and outside it.

Here, we’ll see how to fix the error “454 4.7.1 Relay access denied” that users get while using Postfix servers for email delivery.

1. How to fix “454 4.7.1” in mail clients – Outlook, Squirrelmail, Thunderbird and Roundcube

Unless specifically excluded from authenticating to SMTP mail server by adding the IPs to the trusted network, Postfix does not allow anyone to relay through the mail server.

Incorrect settings in the email client can cause mail delivery to fail, when the mail account tried to send a mail to an external domain from a Postfix server, without proper authentication.

So the first thing we do when users report 454 error is to check and confirm why the error happened in that server. Checking the mail logs, bounce message and confirming with other email clients help to pinpoint if the issue is with the mail client or server settings.

While Outlook and Thunderbird are user specific email clients and have to be configured by individual users, webmail such as Squirrelmail and Roundcube are installed and configured server wide.

If any configuration mistake happens in the installation process of 3rd party software such as Roundcube and Squirrelmail, no user from the server would be able to send mails using these webmail clients.

[ You don’t have to lose your sleep over server errors. Our expert server support specialists monitor & maintain your servers 24/7/365 and keep them rock solid. ]

How to fix “454 4.7.1 Relay access denied” in Roundcube and Squirrelmail

Roundcube has a configuration file ‘config.inc.php’, which is used for the SMTP configuration settings. If the settings provided in this section go wrong during the setup, it will give 454 error.

In Squirrelmail, the configuration file is ‘config.php’ and is configured using the Perl script ‘conf.pl’. We’ve seen that webhosts who have not configured it correctly, have users facing error 454 while sending mails.

At Bobcares, our Web Support Specialists have expertise configuring 3rd party software such as Roundcube and Squirrelmail for our customers who are web hosts.

The parameters we configure for smooth SMTP functioning are:

1. SMTP server for outgoing messages.
2. SMTP authentication settings for users.
3. TLS/SSL settings for secure email delivery.
4. SMTP port for incoming and outgoing mails.

Once the configuration of Roundcube or Squirrelmail or other webmail clients are properly done, users can send emails without any errors.

[ Use your time to build your business. We’ll take care of your servers. Hire Our server experts to resolve and prevent server issues. ]

How to fix “454 4.7.1 Relay access denied” in Thunderbird, Outlook Express and Microsoft Outlook

In cases where we notice that the issue is not a server wide one, but specific to the user account, it is obvious that the error has happened due to incorrect email client settings of that user.

Some of the commonly used email clients are Outlook Express, Microsoft Outlook, Thunderbird and so on. The settings for SMTP authentication, SMTP server and security varies in each mail client.

We provide the end users with the step by step details to configure their email clients, which prevents email delivery failures with the error “454 4.7.1 Relay access denied”.

2. How to fix “454 4.7.1” error in Postfix servers

Many webhosts, especially the ones who have Plesk control panels in their servers, use Postfix as the mail server. These servers mostly have Dovecot configured for POP and IMAP services.

If we notice from the email logs that all the users in the server are getting “454 4.7.1 Relay access denied” error while sending to and receiving mails from external domains using all mail clients, we confirm that the issue is related to Postfix server.

[ You don’t have to lose your sleep over server errors. Our expert server support specialists monitor & maintain your servers 24/7/365 and keep them rock solid. ]

Postfix configuration can have errors in two sections:

1. Errors in the configuration file

The configuration file for Postfix is ‘/etc/postfix/main.cf’ and it contains the list of networks (mynetworks), who can relay through the mail server without authenticating.

The config file also has sections for relaying and authenticating mails. If this config file ‘main.cf’ gets corrupted during modifications or updates or setup, it can affect email delivery.

We’ve seen cases where even a single white space in the file can mess up the configuration.

With years of experience handling such issues, our expert hosting support engineers are able to resolve the mail server errors without much downtime.

454 4.7.1 : Relay access denied

This is a commonly seen email failure error by web hosts, website owners and server owners who run Postfix mail server. 454 error usually happens while sending to and receiving from external domains.

In our role as Server Support Engineers for web hosting companies, we handle many such mail errors and fix them. Here, we’ll see what causes “454 4.7.1 Relay access denied” error and how we fix it.

See how we help web hosting companies

What causes “454 4.7.1 Relay access denied” in Postfix servers

In mail delivery process, a mail client such as Outlook, Squirrelmail, etc. is used by the sender to send an email. The mail client connects to the sender’s mail server and attempts to deliver the mail to the recipient.

The recipient can be within the same mail server or in any external mail server. But most mail server require the mail account has to authenticate itself correctly, inorder to connect to it to send mails.

Error 454 is shown in the email logs and bounce message to users, usually when they send, forward or receive mails in Postfix mail servers. There are 2 main causes for this error.

1. If the mail is attempted to send to an external mail server without proper authentication, the sending mail server will reject the mail with the error “454 4.7.1 Relay access denied”.
2. This error message is also seen due to improper configuration settings of Postfix, such as relaying and recipient settings.

Jan 22 10:25:14 user postfix/smtpd[2257]: NOQUEUE: reject: RCPT from unknown[***.***.***.***]: 454 4.7.1 : Relay access denied; from= to= proto=ESMTP helo=

The key to understanding your problem is the following two lines.

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_recipient_access mysql:/etc/postfix/mysql-virtual_recipient.cf, reject_unauth_destination
mynetworks = 127.0.0.0/8 [::1]/128

mynetworks lists only localhost, and there is nothing in your connection transcript to indicate that you are connecting to localhost (in fact, there’s plenty to indicate that you are not). And you are not authenticating through SASL.

So you are almost certainly hitting the reject_unauth_destination at the end, meaning that the mail transaction is denied.

Either connect to your mail server over the loopback interface, or augment mynetworks to include the IP address you are connecting from, or authenticate to the mail server using SASL. Then relaying will work much better.

Also, a good place to start for these matters is often the server’s logs. It is rare that they don’t include details about why the mail transaction was denied, and they will often point you toward a solution.