Can't send email to the internet from Postfix mail server. (Relay access denied)

Question

I have a mail server running Postfix in my LAN with which I can send and receive emails in my LAN and send from the WAN to the LAN. I can't send from the LAN to the WAN though.

I am trying to use my ISP's relay host (mail2.bahnhof.se) to solve this problem as it seems the simplest way (the relay doesn't require authentication).

With telnet I can connect directly to the relay host and send an email without authentication:

> telnet mail2.bahnhof.se 25
Connected to mail2.bahnhof.se.
helo mail.mydomain.com
250 mxf2.bahnhof.se
mail from: [email protected]
250 Ok
rcpt to: [email protected]
250 Ok
data
354 End data with <CR><LF>.<CR><LF>
This is a test
.
250 Ok: queued as 9BFD413BAE5

Trying to use the same relay on my postfix server gives me the Relay access denied error though (not sure which relay it means):

>telnet mail.mydomain.com 25
HELO mail.mydomain.com
250 mail.mydomain.com
mail from: [email protected]
250 2.1.0 Ok
rcpt to: [email protected]
554 5.7.1 <[email protected]>: Relay access denied

My postfix configuration (main.cf):

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

myhostname = mail.mydomain.com
mydomain = mydomain.com
myorigin = $mydomain
smtpd_sender_restrictions = permit_mynetworks
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = mail.mydomain.com, ubuntu, localhost
relayhost = mail2.bahnhof.se
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

Any ideas what can be wrong?

Solution

Yes. Your server is denying relay to you. Because:

smtpd_sender_restrictions = permit_mynetworks
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

So you have to add you IP range (the IP of your telnet client, for instance) to my_networks

mynetworks = 192.168.0.15 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

In case you telnet client's IP is 192.168.0.15

If your server is hosted on an ISP and you are using unknown dynamic IP range you will have to use SMTP authentication in your server. Or just leave your server as an open relay (which of course I wouldn't recommend).

Comments

[s2s]

Thank you! That solved it. I thought that 127.0.0.0 was sufficient as I was telneting from localhost.

[drkblog]

But you wrote "telnet mail.mydomain.com 25" and probably your telnet client bound it's socket to your local IP instead of local loopback (127.0.0.1). You can check that by doing "telnet 127.0.0.1 25" without adding the IP to my networks.