I have a server running postfix and dovecot with a local mysql database to store virtual domains and users. I'm considering to move the database to another server and perhaps switch to using ldap instead of mysql to store the users and virtual domains.

What is the behaviour of postfix when it can't reach the database to lookup a recipient? If the server hosting the database would go down for some time, would postfix start dropping incoming mail because it can't lookup the recipents or would it queue the mail until the database is reachable again and at that time check if the destination is a valid recipient.

If it queues the mail, how long is it possible to queue it and any difference between mysql and ldap in this regard?


Postfix would neither drop nor queue incoming mail, but would reject it with a temporary failure error code. Even if the recipient is a system user, postfix doesn't know if the aliases would direct the mail to a completely different location. Since an unreachable database could thus lead to unexpected behavior, postfix refuses to deal with the mail at all.

All decent (RFC conform) mail servers will try again to deliver the message at a later time if the first attempt resulted in a temporary failure. So unless the database is down for a prolonged period of time (read: weeks), no mail will be lost but merely delayed.

  • Are there any big drawbacks of not having the database on the same server as postfix?
    – Jimmy
    Jan 18 '16 at 15:33
  • @Jimmy I'm not aware of any serious drawbacks. Well, one might argue that the setup is slightly more difficult to secure, as passwords could travel the internal network unencrypted. So if you are paranoid, or can't guarantee the security of your internal network, you'd have to require DB lookups to be done over an encrypted connection.
    – tarleb
    Jan 18 '16 at 16:18
  • 1
    okey, thanks. I am probably a bit paranoid so I'll secure the connection properly :)
    – Jimmy
    Jan 18 '16 at 16:33
  • @Jimmy Good choice, or as someone once put it: securing only your network vs. securing only your endpoints
    – tarleb
    Jan 18 '16 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.