For certain domains on my server, I need to relay the outgoing email via Amazon SES.  While I can set up the outgoing server for the domain, I can't see where I would put the needed authentication to send via SES.  Does anyone have a potential solution to this?

Thanks!

F5 K000161019

Separately I added acl for iredadmin...is it sufficient?

We have been receiving a lot of spam lately and it appears the Bayesian filters are not operating at all.

In the maillog the Hits: variable is always showing a '-' instead of an actual score. I have been unable to find some documentation that gives me any insight for that issue.
i.e.
May 14 11:34:06 mail amavis[86138]: (86138-04) Passed CLEAN, <no-reply@forum.iredmail.org> -> <me@mydomain.com>, Hits: -, tag=0, tag2=0, kill=0, queued_as: 4gGZB60VSvzXlts, L/0/0/0

SpamAssassin is configured to run embedded under amavis.
I have trained the filter with over 1200 spam and 240 ham messages and made sure that bayesian db is in /var/spool/amavisd/.spamassassin/ and owned by amavis.

Any suggestions would be appreciated.

i try upgrade iRedMail from 1.7.4 to 1.8.0, but have an error at first step - upgrade iRedAPD.

Below is the error, Please help. Thanks!!

[root@mail tools]# bash upgrade_iredapd.sh
* Detected Linux/BSD distribution: RHEL
* Checking dependent Python modules:
  + [required] wheel
  + [required] sqlalchemy
  + [required] dnspython
  + [required] requests
Install packages: python3-python-multipart python3-wheel
Last metadata expiration check: 2:36:59 ago on Wed May 13 13:10:05 2026.
No match for argument: python3-wheel
Error: Unable to find a match: python3-wheel
* Found iRedAPD directory: /opt/iredapd, symbol link of iRedAPD-6.1
* Found iRedAPD config file: /opt/iredapd/settings.py
* Add new SQL tables - if there's any
* Copying new version to /opt/iRedAPD-6.1
* Copy old config file: settings.py (/opt/iredapd/settings.py -> /opt/iRedAPD-6.1/settings.py)
cp: '/opt/iredapd/settings.py' and '/opt/iRedAPD-6.1/settings.py' are the same file
* Copy custom plugins: iRedAPD-6.1/plugins/custom_*.py.
* Set correct owner and permission for /opt/iRedAPD-6.1: root:root, 0500.
* Set permission for iRedAPD config file: /opt/iRedAPD-6.1/settings.py -> 0400.
* Re-create symbol link: /opt/iredapd -> /opt/iRedAPD-6.1
* Remove existing systemd service files.
* Copy systemd service file: /opt/iredapd/rc_scripts/iredapd.service -> /lib/systemd/system/iredapd.service.
Created symlink '/etc/systemd/system/multi-user.target.wants/iredapd.service' -> '/usr/lib/systemd/system/iredapd.service'.
Redirecting to /bin/systemctl restart rsyslog.service
* Replace py2 by py3 in cron jobs.
* Restarting iRedAPD service.
Redirecting to /bin/systemctl restart iredapd.service
Job for iredapd.service failed because the control process exited with error code.
See "systemctl status iredapd.service" and "journalctl -xeu iredapd.service" for details.
Failed, please restart iRedAPD service manually.
Traceback (most recent call last):
  File "/opt/iredapd/tools/fix_throttle_priority.py", line 22, in <module>
    import web
  File "/opt/iredapd/tools/../web/__init__.py", line 4, in <module>
    from . import (  # noqa: F401
  File "/opt/iredapd/tools/../web/debugerror.py", line 19, in <module>
    from . import webapi as web
  File "/opt/iredapd/tools/../web/webapi.py", line 12, in <module>
    import multipart
ModuleNotFoundError: No module named 'multipart'
* Upgrade completed.

< NOTE > If iRedAPD doesn't work as expected, please post your issue in our
< NOTE > online support forum: http://www.iredmail.org/forum/
< NOTE >
< NOTE > * Turn on debug mode: http://www.iredmail.org/docs/debug.iredapd.html
< NOTE > * iRedAPD log file is /var/log/iredapd/iredapd.log.

[root@mail tools]#

After upgrading to Roundcube 1.7.0, before restarting nginx and php-fpm services, it is necessary to alter "/etc/nginx/templates/roundcube.tmpl" to the following:

#
# Roundcube 1.7+ fixed Nginx template
#

#
# Redirect root to /mail/
#
location = / {
    return 301 /mail/;
}

#
# Redirect /mail -> /mail/
#
location = /mail {
    return 301 /mail/;
}

#
# Roundcube front controller
#
location /mail/ {
    alias /opt/www/roundcubemail/public_html/;
    index index.php;

    try_files $uri $uri/ @roundcube;
}

#
# Internal rewrite to index.php
#
location @roundcube {
    rewrite ^ /mail/index.php last;
}

#
# PHP handling
#
location ~ ^/mail/(.+\.php)(/.+)?$ {

    fastcgi_split_path_info ^/mail/(.+\.php)(/.+)$;

    include /etc/nginx/templates/hsts.tmpl;
    include /etc/nginx/templates/fastcgi_php.tmpl;

    fastcgi_param SCRIPT_FILENAME /opt/www/roundcubemail/public_html/$1;
    fastcgi_param PATH_INFO $fastcgi_path_info;
}

This works for me, but if there is a better or more elegant solution, please post it.

I am facing a strange behavior with Dovecot 2.4 on Debian Trixie.
When I try to connect to the IMAP server, on port 143 it is answering correctly, but the IMAPS on port 993 does not listen correctly.

Connection to IMAP port 143:

Connection to IMAPS port 993

After the telnet connection to port 993 I never receive the "*OK CAPABILITY... Dovecot ready." answer.

If anyone as a clue.

I migrated some domains from one server with iRedMail to another and kept the same configurations for dovecot, postfix, amavisd, and iredapd. However, some accounts on the new server are accumulating messages in the email queue:

---
Received: by mail001.xpto.com.br (Postfix)
    id 4g90vf4sR6z4y0P; Tue,  5 May 2026 11:17:18 -0300 (-03)
Date: Tue,  5 May 2026 11:17:18 -0300 (-03)
From: Mail Delivery System <MAILER-DAEMON@mail001.xpto.com.br>
To: Postmaster <postmaster@mail001.xpto.com.br>
Subject: Postfix SMTP server: errors from 195-154-118-127.rev.poneytelecom.eu[195.154.118.127]:43730
Message-Id: <4g90vf4sR6z4y0P@mail001.xpto.com.br>

Transcript of session follows.

Out: 220 mail001.xpto.com.br ESMTP Postfix
In:  EHLO sd-141991.dedibox.fr
Out: 250-mail001.xpto.com.br
Out: 250-PIPELINING
Out: 250-SIZE 31457280
Out: 250-ETRN
Out: 250-STARTTLS
Out: 250-ENHANCEDSTATUSCODES
Out: 250-8BITMIME
Out: 250 DSN
In:  STARTTLS
Out: 220 2.0.0 Ready to start TLS
In:  EHLO sd-141991.dedibox.fr
Out: 250-mail001.xpto.com.br
Out: 250-PIPELINING
Out: 250-SIZE 31457280
Out: 250-ETRN
Out: 250-ENHANCEDSTATUSCODES
Out: 250-8BITMIME
Out: 250 DSN
In:  MAIL From:<www-data@sd-141991.dedibox.fr> SIZE=677580 BODY=8BITMIME
Out: 250 2.1.0 Ok
In:  RCPT To:<financeiro@dominio.com.br>
Out: 451 4.3.5 Server configuration error
In:  DATA
Out: 554 5.5.1 Error: no valid recipients
In:  RSET
Out: 250 2.0.0 Ok
Out: 421 4.4.2 mail001.xpto.com.br Error: timeout exceeded

Session aborted, reason: timeout

For other details, see the local mail logfile
---

All services are working correctly (mariadb, dovecot, postfix, iredapd, etc.). The postfix logs show this message:

---
postfix/smtp.log:May  5 14:06:12 mail001 postfix/smtpd[1361542]: NOQUEUE: reject: RCPT from 195-154-118-127.rev.poneytelecom.eu[195.154.118.127]:40826: 451 4.3.5 Server configuration error; from=<www-data@sd-141991.dedibox.fr> to=<financeiro@dominio.com.br> proto=ESMTP helo=<sd-141991.dedibox.fr>
---

The iredapd logs show this message:

---
iredapd/iredapd.log: May  5 12:57:59 mail001 python3[1271302]: iredapd [216.245.218.125] RCPT, uwnpw7lo@interestingthing.online -> financeiro@dominio.com.br, 451 4.7.1 Intentional policy rejection, please try again later [sasl_username=, sender=uwnpw7lo@interestingthing.online, client_name=special.interestingthing.online, reverse_client_name=special.interestingthing.online, helo=special.interestingthing.online, encryption_protocol=, encryption_cipher=, server_port=25, process_time=0.4227s]
---

Any guidance about this issue?

Last Friday, I upgraded from 20.04 to 22.04 successfully following the directions on iredmail forum topic20565-direct-upgrade-ubuntu-2004-to-2204-guide.html

Then, today I upgraded from 22.04 to 24.04 using the instructions: iredmail docs upgrade.ubuntu.22.04-24.04.html

After finishing the release upgrade and rebooting the server on 24.04, and going through the install process again for iredapd, iredadmin and mlmmjm I was unable to send or receive mail but I was also unable to resolve domain names.

I was able to find another instance of this happening on an OpenVZ system where the user does not have the ability to update the kernel (currently running the 5.4.0) and it looked like the only option at this time was to stop using systemd-resolved, due to an issue in systemd-resolved on 24.04 systems running in OpenVZ: the github site /systemd/systemd/issues/34580

#fix dns resolution after update to 24.04 by disabling systemd-resolved
sudo systemctl stop systemd-resolved
sudo systemctl disable systemd-resolved
sudo rm /etc/resolv.conf
sudo nano /etc/resolv.conf

#paste in /etc/resolv.conf
nameserver 8.8.8.8
nameserver 1.1.1.1

Making that change allowed me to resolve DNS and ping google.com.

So back to the mail issue.
There was nothing happening in /var/log/mail.log (because as I found out later, postfix wasn't running).

Running "lsof -i -P -n | grep LISTEN" didn't reveal anything listening on ports 25 or 587, but I could see dovecot on 993/995/143/110.

systemctl status postfix:

postfix.service - Postfix Mail Transport Agent
     Loaded: loaded (/usr/lib/systemd/system/postfix.service; enabled; preset: enabled)
     Active: active (exited) since Tue 2026-05-05 01:37:36 UTC; 45min ago
       Docs: man:postfix(1)
    Process: 33358 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
   Main PID: 33358 (code=exited, status=0/SUCCESS)

but there was an error message in systemctl status postfix*

 postfix@-.service - Postfix Mail Transport Agent (instance -)
     Loaded: loaded (/usr/lib/systemd/system/postfix@.service; enabled-runtime; preset: enabled)
     Active: failed (Result: exit-code) since Tue 2026-05-05 01:37:36 UTC; 9s ago
       Docs: man:postfix(1)
    Process: 33330 ExecStartPre=/usr/lib/postfix/configure-instance.sh - (code=exited, status=1/FAILURE)

I was able to run:

postfix start

Then I started seeing successful messages in /var/log/mail.log and I could see master
running and listening on 25 and 587. 

postfix check

postfix: Postfix is using backwards-compatible default settings
postfix: See postfixorgwebsite /COMPATIBILITY_README.html for details
postfix: To disable backwards compatibility use "postconf compatibility_level=3.6" and "postfix reload"
postfix/postfix-script: warning: /var/spool/postfix/etc/resolv.conf and /etc/resolv.conf differ
postfix/postfix-script: warning: /var/spool/postfix/lib/x86_64-linux-gnu/libgcc_s.so.1 and /lib/x86_64-linux-gnu/libgcc_s.so.1 differ

I copied my resolv.conf and x86_64-linux-gnu/libgcc_s.so.1 into the postfix CHROOT in the appropriate locations, and then running postfix check stopped giving the two warnings, and only the messages about backwards compatibility.

But after running systemctl stop postfix and systemctl start postfix, I was still seeing the same error message in systemctl status postfix*.

I tried running /usr/lib/postfix/configure-instance.sh manually to see if I could see any error message output and there was no output, but now when I run the command again, it's giving different output:
systemctl status postfix*

Unit postfix-mysql.so.service could not be found.
Unit postfix-pcre.so.service could not be found.
Unit postfix_groups.pl.service could not be found.

tail -200 /etc/postfix/dynamicmaps.cf

# dict-type     so-name (pathname)      dict-function   mkmap-function
pcre    postfix-pcre.so dict_pcre_open
mysql   postfix-mysql.so        dict_mysql_open

postconf -m also still shows mysql and pcre in the list.

So now I have mail sending and receiving working again, but I think something with postfix is still borked and I'm afraid to restart my server.

checking the processes that are listening on 25 and 587 again now, it looks like it has changed and postscree (postscreen?) is listening on 25 and smtpd is listening on 587, which I'm pretty sure is different from what I saw after I first ran "postfix start".

I have a full backup from before the upgrade on 20.04->22.04 that I could restore, or I could backup the databases and vmail and DKIM and do a VM reinstall from scratch and then migration and reinstall and restore when I have more time in a few days, but I was hoping that this was something that I could figure out and kick a full reinstall down the road further.

Thanks for any other ideas or hints you might have,
natec

Are there any caveats to following the instructions from the imapsieve tutorial on OpenBSD with 1.7.0?

I follow all instruction on https://docs.iredmail.org/dovecot.imapsieve.html, use set as spam plugin buit checking spam : it's seems only the mail reader learn span (kmail currently).

All update are done, but when tetsing f somthing happe,n : seems nothing are done.

root@nedra:~# cd /etc/dovecot/
root@nedra:/etc/dovecot# grep -r "mail_debug" *
conf.d/10-logging.conf:# mail_debug and auth_debug settings.
conf.d/10-logging.conf:#mail_debug = no
dovecot.conf:mail_debug = yes
root@nedra:~# grep sieve /var/log/dovecot/imap.log
root@nedra:~# bash /etc/dovecot/sieve/scan_reported_mails.sh
root@nedra:~# grep sieve /var/log/dovecot/imap.log
root@nedra:~# tail /var/log/syslog
2026-04-23T10:46:33.646578+02:00 nedra postfix/postscreen[19574]: PASS OLD [104.155.105.12]:12868
2026-04-23T10:46:33.654906+02:00 nedra postfix/postscreen[19574]: PASS OLD [104.155.105.12]:12898
2026-04-23T10:46:34.182158+02:00 nedra postfix/smtpd[19653]: connect from 12.105.155.104.bc.googleusercontent.com[104.155.105.12]
2026-04-23T10:46:34.362819+02:00 nedra postfix/smtpd[19655]: connect from 12.105.155.104.bc.googleusercontent.com[104.155.105.12]
2026-04-23T10:46:34.706589+02:00 nedra postfix/smtpd[19657]: connect from 12.105.155.104.bc.googleusercontent.com[104.155.105.12]
2026-04-23T10:46:34.995340+02:00 nedra postfix/smtpd[19658]: connect from 12.105.155.104.bc.googleusercontent.com[104.155.105.12]
2026-04-23T10:46:35.341956+02:00 nedra postfix/smtpd[19659]: connect from 12.105.155.104.bc.googleusercontent.com[104.155.105.12]
2026-04-23T10:46:35.713417+02:00 nedra postfix/smtpd[19660]: connect from 12.105.155.104.bc.googleusercontent.com[104.155.105.12]
2026-04-23T10:47:01.064735+02:00 nedra CRON[19678]: (*****) CMD (sh /home/*****/vault_pull.sh >> /home/*****/logs/vault_pull.log 2>&1)
2026-04-23T10:47:01.074723+02:00 nedra CRON[19679]: (root) CMD (/bin/bash /usr/local/bin/fail2ban_banned_db unban_db)

and

root@nedra:~# su -s /bin/bash amavis -c "sa-learn --dump magic"
0.000          0          3          0  non-token data: bayes db version
0.000          0       2124          0  non-token data: nspam
0.000          0      11905          0  non-token data: nham
0.000          0     200731          0  non-token data: ntokens
0.000          0 1776204760          0  non-token data: oldest atime
0.000          0 1776931921          0  non-token data: newest atime
0.000          0 1776932414          0  non-token data: last journal sync atime
0.000          0 1776900277          0  non-token data: last expiry atime
0.000          0     691200          0  non-token data: last expire atime delta
0.000          0      11211          0  non-token data: last expire reduction count

What can i do to control if something is really done ?

After upgrading in iredadmin-pro 5.8 I am not able to renew letscript certificates.

Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 20
Cannot extract OCSP URI from /etc/letsencrypt/archive/mail.ntsipl.com/cert9.pem
Certificate is due for renewal, auto-renewing...
Renewing an existing certificate for mail.ntsipl.com
Performing the following challenges:
http-01 challenge for mail.ntsipl.com
Waiting for verification...
Challenge failed for domain mail.ntsipl.com
http-01 challenge for mail.ntsipl.com

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
  Domain: mail.ntsipl.com
  Type:   connection
  Detail: 103.239.124.251: Fetching http://mail.ntsipl.com/.well-known/acme … 59Ceg2OFM: Error getting validation data

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

Please provide the solution

So just did a fresh install of iRedMail in a FreeBSD jail using the master repo as the source. Before running the install script, here's a few things I did to make the install go smoothly:

## Pre Install
1. upgrade `pkg` to the latest 2.6.2
2. In the master repo, edit the script 'functions/packages_freebsd.sh' and change
export MYSQL_VER='80' to export MYSQL_VER='84'.

The reason is `pkg` will install 'mysql80-client' and then half way through the install, it will try to install 'mysql84-client' and fail due to conflict. If you select 'Y' to continue, pkg will start uninstalling other packages.

## Post Install
1. Install the following 2 packages:
- py311-passlib
- py311-cheroot

Without this, doing 'python3 iredadmin.py' will throw errors.

2. Edit /usr/local/www/iredadmin/rc_scripts/uwsgi/freebsd.ini and change:
'wsgi-file = iredadmin.py' to 'uwsgi-file = iredadmin.py'

Without this change, going to '/iredadmin/' throws an Internal server error.

So other than those changes, everything works :>

This is just super fun.  I do b'leev I've found a bug in the Amavis configuration.  We've been using iRedMail for a few years now, have SPF and DKIM and all that good stuff working, but are walking away from the previous distribution because reasons.  A brand new box was built with Trixie as the base, DKIM keys were just copied over into Amavis, and everything seemed good.  All the legacy devices  we've got sending mail were sending mail, and then while testing sending authenticated mail from a new internal host that I was spinning up, I started seeing signature failures.  WTF.

Mind you this program worked just fine from the old host and nine or ten others (going through the server running a much older version of iRedMail), and it's literally just a shell script so it's not like I could really have screwed up scp-ing it over, and it just hands the mail to sendmail (which I've been doing for like 20+ years) so... not fancy.  As I started digging into the issue I noticed something in the headers that caught my eye.  The "Date:" header showed -0000 as the timezone which won the stink-eye because the test program just calls $(date) which produces something not quite RFC-compliant ("Wed Apr  8 02:51:27 PM CDT 2026") but it's close enough for testing...or so I thought.  I thought there really should have been a CDT there or something to indicate the time zone wasn't UTC (because I hate converting those in my head).

It turns out that if Amavis doesn't like your date string, it will apparently replace it with a form that is RFC-compliant.  It didn't seem to care at all about my message ID that I forgot to wrap in angle-brackets and just passed that on through but whatevs...

Relevant information: h=message-id:subject:date:from:to;

The kicker is that this configuration apparently "corrects" the date string after it has generated the DKIM signature (which kinda breaks it).  Changing my date generator to using $(date +'%a, %d %b %Y %H:%M:%S %z') made the mails start passing DKIM checks.  That one change.  <<sigh>>

The other "clues" (blatantly fishing for Google with this on behalf of future admins) would be seeing Tests: [ALL_TRUSTED=-1,INVALID_DATE=0.432,INVALID_MSGID=1.167] showing up in the logs.  Again, it won't bother changing the message ID (most MTAs will just generate their own if you didn't specify one) to include <>'s, but it does replace your Date: string.  Heck, until today I didn't even know postfix or Amavis would bother altering the date string.

I'm running iRedMail (Ubuntu 22.04, iRedMail 1.6.x) with Fail2ban enabled by default. I noticed that after multiple failed IMAP login attempts (tested via Thunderbird), my IP is not getting banned as expected.

I checked jail.local and confirmed that the dovecot jail is enabled, and the logs do show repeated login failures. It seems like Fail2ban is detecting the events but not actually banning the IP.

Is there any additional configuration needed for Dovecot with iRedMail (e.g., custom filter, log backend, or different log path)?

Thanks!

Hi Zhang, what happened to 'https://github.com/iredmail/iRedMail/ar … ds/pkg.zip' ?

This zip file contains the iRedMail.sh installer that installs binary packages instead of compiling via ports tree.