I have a postfix server that generally works fine, but sometimes it gives out these:

451 4.3.5 <recipient@ddress.tld>: Recipient address rejected: Server configuration problem;

Historically, I have determined that these were caused by DNS problems, but today I've seen a couple that may not be. I say "may not be" because I haven't completely ruled DNS out (the server uses round-robin DNS, so the only way I know to do that would be manually lookup and test the relevant TXT records with each DNS server one at a time). The reason I haven't taken that action is because I've noticed a relevant PASS result from policyd-spf in the mail log exactly 30 seconds after both timeout results that lead to 451 errors like above in a NOQUEUE. The timeout results looked like this:

postfix/smtpd[6471]: warning: problem talking to server private/policy-spf: Connection timed out

Since I'm operating under the assumption that this isn't a DNS issue this time, I did a quick search for SPF timeouts and found this article discussing configuration where including "policy-spf_time_limit = 3600s" in main.cf is part of the process. I checked main.cf and determined that I have that line in there. I also ran "cat main.cf | grep spf" to confirm there is no other line that might compete with it. Considering that 3600s is a full hour, it seems unlikely that I got a result 30 seconds after one full hour twice (it also seems unlikely that any sane mail server would wait an hour for an SMTP response to begin with, but that is a discussion for another thread). Off-hand, I can think of two things this may imply. The first is that policy-spf sessions are being reused but activity isn't resetting the timeout counter, which seems incredibly unlikely. The second and more likely explanation is that something else timed out. To that end, I'm looking to adjust or at least check other relevant timeout(s).

Can anyone tell me where I should be looking at what timeout(s) here?

  • I've continued to experience this and I've been unable to prove out any DNS issues, so I'm adding smtpd_policy_service_timeout = 200s to main.cf based on review of comments in this unrelated bug after confirming the default is 100s according to postfix documentation. This leaves me curious as to what, exactly, policy-spf_time_limit = 3600s would be doing. I'm not posting this as an answer yet since I'm not sure it solves the problem.
    – rpseu
    Jun 7, 2021 at 21:12
  • I started checking my logs for BrokenPipeError: [Errno 32] Broken pipe since this seemed to happen every time the issue occurred. It appears that I got that error a lot more often than the issue occurred, but changing the smtpd_policy_service_timeout reduced its frequency quite a bit. Strangely, I'm still seeing the policy-spf connection timeout, which causes the brokenpipe error, but I'm not seeing the 451 / NOQUEUE logs that went along with it before. I'm also wondering if maybe I've got this question in the wrong place. Maybe it should be at serverfault?
    – rpseu
    Jun 11, 2021 at 21:49


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.