I have a postfix server that generally works fine, but sometimes it gives out these:
451 4.3.5 <recipient@ddress.tld>: Recipient address rejected: Server configuration problem;
Historically, I have determined that these were caused by DNS problems, but today I've seen a couple that may not be. I say "may not be" because I haven't completely ruled DNS out (the server uses round-robin DNS, so the only way I know to do that would be manually lookup and test the relevant TXT records with each DNS server one at a time). The reason I haven't taken that action is because I've noticed a relevant PASS result from policyd-spf in the mail log exactly 30 seconds after both timeout results that lead to 451 errors like above in a NOQUEUE. The timeout results looked like this:
postfix/smtpd[6471]: warning: problem talking to server private/policy-spf: Connection timed out
Since I'm operating under the assumption that this isn't a DNS issue this time, I did a quick search for SPF timeouts and found this article discussing configuration where including "policy-spf_time_limit = 3600s" in main.cf is part of the process. I checked main.cf and determined that I have that line in there. I also ran "cat main.cf | grep spf" to confirm there is no other line that might compete with it. Considering that 3600s is a full hour, it seems unlikely that I got a result 30 seconds after one full hour twice (it also seems unlikely that any sane mail server would wait an hour for an SMTP response to begin with, but that is a discussion for another thread). Off-hand, I can think of two things this may imply. The first is that policy-spf sessions are being reused but activity isn't resetting the timeout counter, which seems incredibly unlikely. The second and more likely explanation is that something else timed out. To that end, I'm looking to adjust or at least check other relevant timeout(s).
Can anyone tell me where I should be looking at what timeout(s) here?
smtpd_policy_service_timeout = 200sto main.cf based on review of comments in this unrelated bug after confirming the default is 100s according to postfix documentation. This leaves me curious as to what, exactly,policy-spf_time_limit = 3600swould be doing. I'm not posting this as an answer yet since I'm not sure it solves the problem.BrokenPipeError: [Errno 32] Broken pipesince this seemed to happen every time the issue occurred. It appears that I got that error a lot more often than the issue occurred, but changing thesmtpd_policy_service_timeoutreduced its frequency quite a bit. Strangely, I'm still seeing the policy-spf connection timeout, which causes the brokenpipe error, but I'm not seeing the 451 / NOQUEUE logs that went along with it before. I'm also wondering if maybe I've got this question in the wrong place. Maybe it should be at serverfault?