I have successfully installed Postfix/Dovecot with virtual domains and TLS support like this article describes - https://geekpeek.net/postfix-with-dovecot/ ...

But faced with the problem. I can send emails only to people in my domain zone (blabla, as example). It means that I can send email from admin@blabla.com to info@blabla.com. But when I'm trying to send email from my google account to this addresses I get next errors:

postfix/smtpd[19211]: connect from mail-wi0-f172.google.com[]
Sep 10 18:23:17 amazon-ws.fs.local postfix/smtpd[19211]: NOQUEUE: reject: RCPT from mail-wi0-f172.google.com[]: 554 5.7.1 <info@blabla.com>: Recipient address rejected: Access denied; from=<{myaccount}@gmail.com> to=<info@blabla.com> proto=ESMTP helo=<mail-wi0-f172.google.com>
Sep 10 18:23:17 amazon-ws.fs.local postfix/smtpd[19211]: disconnect from mail-wi0-f172.google.com[]

Recipient address rejected: Access denied;

All i could understand is that my postfix server rejects this mail, but can't understand why. Postfix configuration (main.cf) attached below:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
default_process_limit = 100
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
message_size_limit = 10485760
mydestination = $myhostname, localhost.$mydomain, localhost
myhostname = amazon-ws.fs.local
mynetworks =,
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
queue_minfree = 20971520
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtpd_client_connection_count_limit = 10
smtpd_client_connection_rate_limit = 30
smtpd_recipient_limit = 1000
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/postfix/cert/postfix.pem
smtpd_tls_key_file = /etc/postfix/cert/private/postfix.pem
smtpd_tls_loglevel = 0
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550
virtual_alias_maps = hash:/etc/postfix/virtual
virtual_gid_maps = static:2000
virtual_mailbox_base = /var/mail/virtmailbox
virtual_mailbox_domains = /etc/postfix/virtdomains
virtual_mailbox_maps = hash:/etc/postfix/virtmail_maps
virtual_minimum_uid = 2000
virtual_uid_maps = static:2000

Operating system: RHEL7.1, Postfix Version 2.10.1

Where is the problem?

  • smtpd_relay_restrictions = permit_mynetworks probably permits your local mail to go through, though it's not clear from the posted configuration what $mydomain is or where blabla.com is set to be "local." The mydestination parameter may need attention?
    – thrig
    Sep 11, 2015 at 14:23
  • When i configured postfix and added my virtual domain to mydestination, postfix daemon (log files) said that virtual domains don't need to be added to this srting. Only local domains and hostnames need to be included. As i understood, virtual domains processed separate from mydestination.
    – obohovyk
    Sep 11, 2015 at 21:46

2 Answers 2


Finally, i found a problem! There was a short parameter in master.cf file.

I had:

   -o smtpd_recipient_restrictions=permit_sasl_authenticated, reject

Must be:

   -o smtpd_recipient_restrictions=permit_sasl_authenticated, reject_unauth_destination

Parameter reject needs to be changed to reject_unauth_destination because of smtpd rejects all incoming connections before sasl authentification begins.


As @alexkowalski mentioned, the problem that there was a short parameter (-o) in master.cf file not in the `main.cf file.

Because -o options in master.cf can override the options written in main.cf on a per-service basis, the smtpd_recipient_restrictions param value were being taken from the master.cf file.

Notice the smtpd_recipient_restrictions param :

smtps     inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_client_restrictions=$mua_client_restrictions
  -o smtpd_helo_restrictions=$mua_helo_restrictions
  -o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
------->  -o smtpd_recipient_restrictions=permit_sasl_authenticated, reject

By commenting that line and every other -o line that I don't want, the values written in the main.cf file are the taken values.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.