I have a postfix server that generally works fine, but sometimes it gives out these:
451 4.3.5 <firstname.lastname@example.org>: Recipient address rejected: Server configuration problem;
Historically, I have determined that these were caused by DNS problems, but today I've seen a couple that may not be. I say "may not be" because I haven't completely ruled DNS out (the server uses round-robin DNS, so the only way I know to do that would be manually lookup and test the relevant TXT records with each DNS server one at a time). The reason I haven't taken that action is because I've noticed a relevant PASS result from policyd-spf in the mail log exactly 30 seconds after both timeout results that lead to 451 errors like above in a NOQUEUE. The timeout results looked like this:
postfix/smtpd: warning: problem talking to server private/policy-spf: Connection timed out
Since I'm operating under the assumption that this isn't a DNS issue this time, I did a quick search for SPF timeouts and found this article discussing configuration where including "policy-spf_time_limit = 3600s" in main.cf is part of the process. I checked main.cf and determined that I have that line in there. I also ran "cat main.cf | grep spf" to confirm there is no other line that might compete with it. Considering that 3600s is a full hour, it seems unlikely that I got a result 30 seconds after one full hour twice (it also seems unlikely that any sane mail server would wait an hour for an SMTP response to begin with, but that is a discussion for another thread). Off-hand, I can think of two things this may imply. The first is that policy-spf sessions are being reused but activity isn't resetting the timeout counter, which seems incredibly unlikely. The second and more likely explanation is that something else timed out. To that end, I'm looking to adjust or at least check other relevant timeout(s).
Can anyone tell me where I should be looking at what timeout(s) here?