Topic: Getting Relay access denied when sending emails from / through SOGo
==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 0.9.8
- Linux/BSD distribution name and version: Debian 9.6
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): LDAP
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? No
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====
So, I'm getting this message in SOGo's logs:
Nov 30 23:53:51 sogod [7703]: |SOGo| starting method 'POST' on uri '/SOGo/so/mxxxxxxxxxxa@vxxxxxxx.net/Mail/0/folderDrafts/newDraft1543618428-1/send'
Nov 30 23:53:51 sogod [7703]: <0x0x55852df40bd0[SOGoMailer]> error with recipient 'mxxxxxxxa@outlook.com'
Nov 30 23:53:51 sogod [7703]: |SOGo| request took 0.573482 seconds to execute
Nov 30 23:53:51 sogod [7703]: 192.168.3.165 "POST /SOGo/so/mxxxxxxxxxxa@vxxxxxxx.net/Mail/0/folderDrafts/newDraft1543618428-1/send HTTP/1.0" 405 84/196 0.594 - - 132K
and on the maillog:
Nov 30 23:53:51 chlispsrv01 postfix/postscreen[7976]: CONNECT from [127.0.0.1]:42084 to [127.0.0.1]:25
Nov 30 23:53:51 chlispsrv01 postfix/postscreen[7976]: WHITELISTED [127.0.0.1]:42084
Nov 30 23:53:51 chlispsrv01 postfix/smtpd[7977]: connect from mx.vxxxxxxx.net[127.0.0.1]
Nov 30 23:53:51 chlispsrv01 postfix/smtpd[7977]: NOQUEUE: reject: RCPT from mx.vxxxxxxx.net[127.0.0.1]: 454 4.7.1 <mxxxxxxxa@outlook.com>: Relay access denied; from=<mxxxxxxxxxxa@vxxxxxxx.net> to=<mxxxxxxxa@outlook.com> proto=ESMTP helo=<mx.vxxxxxxx.net>
Nov 30 23:53:51 chlispsrv01 postfix/smtpd[7977]: disconnect from mx.vxxxxxxx.net[127.0.0.1] ehlo=1 mail=1 rcpt=0/1 quit=1 commands=3/4
This happens if I try to send the email from Outlook or Android device using EAS, however, if it's targetting my domain it passes without any issue, and if I send from Roundcube it goes to any domain without a problem.
My configs as follows:
SOGo:
{
WOPort = 127.0.0.1:20000;
SOGoDebugRequests = YES;
WOMaxUploadSize = 15360;
SOGoMaximumMessageSizeLimit = 15360;
WOWorkersCount = 10;
SOGoMaximumPingInterval = 3540;
SOGoMaximumSyncInterval = 3540;
SOGoInternalSyncInterval = 30;
WOWatchDogRequestTimeout = 61;
SOGoMaximumSyncResponseSize = 2048;
SxVMemLimit = 500;
SOGoXSRFValidationEnabled = YES;
SOGoProfileURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/sogo_user_profile";
OCSFolderInfoURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/sogo_folder_info";
OCSSessionsFolderURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/sogo_sessions_folder";
OCSEMailAlarmsFolderURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/sogo_alarms_folder";
OCSCacheFolderURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/sogo_cache_folder";
OCSStoreURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/sogo_store";
OCSAclURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/sogo_acl";
SOGoLanguage = English;
SOGoLoginModule = Mail;
SOGoForceExternalLoginWithEmail = YES;
SOGoMailCustomFromEnabled = NO;
SOGoIMAPServer = "imap://127.0.0.1:143/";
SOGoSMTPServer = 127.0.0.1:25;
SOGoMailingMechanism = smtp;
SOGoSieveFolderEncoding = UTF-8;
SOGoMemcachedHost = 127.0.0.1;
SOGoTimeZone = "Europe/Zurich";
SOGoFirstDayOfWeek = 1;
SOGoRefreshViewCheck = every_5_minutes;
SOGoMailReplyPlacement = below;
SOGoExternalAvatarsEnabled = NO;
SOGoGravatarEnabled = NO;
SOGoEnableEMailAlarms = YES;
SOGoAppointmentSendEMailNotifications = YES;
SOGoFoldersSendEMailNotifications = YES;
SOGoACLsSendEMailNotifications = YES;
SOGoNotifyOnExternalModifications = YES;
SOGoPasswordChangeEnabled = YES;
/* SQL backend
SOGoUserSources = (
{
type = sql;
id = users;
viewURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/users";
canAuthenticate = YES;
userPasswordAlgorithm = ssha512;
prependPasswordScheme = YES;
isAddressBook = YES;
displayName = "Domain Address Book";
SOGoEnableDomainBasedUID = YES;
DomainFieldName = "domain";
},
);
SQL backend */
SOGoUserSources = (
{
type = ldap;
id = users;
canAuthenticate = YES;
isAddressBook = NO;
displayName = "LDAP Authentication";
hostname = "ldap://127.0.0.1:389";
baseDN = "o=domains,dc=vxxxxxxxxxxx,dc=net";
bindDN = "cn=vmail,dc=vxxxxxxxxxx,dc=net";
bindPassword = "xxxxxxxxxxxxxxxxxxxx";
filter = "objectClass=mailUser AND accountStatus=active AND enabledService=mail AND enabledService=sogo";
scope = SUB;
userPasswordAlgorithm = ssha512;
CNFieldName = cn;
IDFieldName = mail;
UIDFieldName = mail;
IMAPLoginFieldName = mail;
MailFieldNames = (mail);
bindFields = (mail);
},
{
type = ldap;
id = global_addressbook;
canAuthenticate = NO;
isAddressBook = YES;
displayName = "Global Address Book";
bindAsCurrentUser = YES;
listRequiresDot = NO;
hostname = "ldap://127.0.0.1:389";
baseDN = "o=domains,dc=vxxxxxxxxxx,dc=net";
bindDN = "cn=vmail,dc=vxxxxxxxxxx,dc=net";
bindPassword = "xxxxxxxxxxxxxx";
filter = "((enabledService=mail AND accountStatus=active AND enabledService=displayedInGlobalAddressBook) AND ((objectClass=mailUser AND enabledService=sogo) OR (objectClass=mailList) OR (objectClass=mailAlias)))";
scope = SUB;
IDFieldName = mail;
bindFields = (mail);
UIDFieldName = mail;
IMAPLoginFieldName = mail;
CNFieldName = cn;
SearchFieldNames = (cn, sn, displayName, telephoneNumber, mail, shadowAddress, departmentNumber);
}
);
}
and postfix:
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix/sbin
data_directory = /var/lib/postfix
mail_owner = postfix
sendmail_path = /usr/sbin/sendmail
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop
debugger_command =
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
ddd $daemon_directory/$process_name $process_id & sleep 5
debug_peer_level = 2
unknown_local_recipient_reject_code = 550
biff = no
swap_bangpath = no
allow_percent_hack = no
allow_min_user = no
disable_vrfy_command = yes
inet_protocols = all
inet_interfaces = all
smtpd_tls_key_file = /etc/ssl/private/iRedMail.key
smtpd_tls_cert_file = /etc/ssl/certs/iRedMail.crt
smtpd_tls_CAfile = /etc/ssl/certs/iRedMail.crt
smtpd_tls_CApath = /etc/ssl/certs
smtpd_tls_protocols = !SSLv2 !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3
smtp_tls_protocols = !SSLv2 !SSLv3
smtp_tls_mandatory_protocols = !SSLv2 !SSLv3
lmtp_tls_protocols = !SSLv2 !SSLv3
lmtp_tls_mandatory_protocols = !SSLv2 !SSLv3
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDC3-SHA, KRB5-DE5, CBC3-SHA
smtpd_tls_dh512_param_file = /etc/ssl/dh512_param.pem
smtpd_tls_dh1024_param_file = /etc/ssl/dh2048_param.pem
tls_random_source = dev:/dev/urandom
smtp_tls_loglevel = 1
smtpd_tls_loglevel = 1
smtpd_tls_security_level = may
smtp_tls_security_level = may
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_CAfile = $smtpd_tls_CAfile
smtp_tls_note_starttls_offer = yes
smtpd_reject_unlisted_recipient = yes
smtpd_reject_unlisted_sender = yes
header_checks = pcre:/etc/postfix/header_checks
body_checks = pcre:/etc/postfix/body_checks.pcre
smtpd_helo_required = yes
smtpd_helo_restrictions =
permit_mynetworks
permit_sasl_authenticated
check_helo_access pcre:/etc/postfix/helo_access.pcre
reject_non_fqdn_helo_hostname
reject_unknown_helo_hostname
smtpd_sender_restrictions =
reject_unknown_sender_domain
reject_non_fqdn_sender
reject_unlisted_sender
permit_mynetworks
permit_sasl_authenticated
check_sender_access pcre:/etc/postfix/sender_access.pcre
smtpd_recipient_restrictions =
reject_non_fqdn_recipient
reject_unlisted_recipient
check_policy_service inet:127.0.0.1:7777
permit_mynetworks
permit_sasl_authenticated
reject_unauth_destination
smtpd_end_of_data_restrictions =
check_policy_service inet:127.0.0.1:7777
smtpd_data_restrictions = reject_unauth_pipelining
smtp_generic_maps = hash:/etc/postfix/generic_maps
proxy_read_maps = $canonical_maps $lmtp_generic_maps $local_recipient_maps $mydestination $mynetworks $recipient_bcc_maps $recipient_canonical_maps $relay_domains $relay_recipient_maps $relocated_maps $sender_bcc_maps $sender_canonical_maps $smtp_generic_maps $smtpd_sender_login_maps $transport_maps $virtual_alias_domains $virtual_alias_maps $virtual_mailbox_domains $virtual_mailbox_maps $smtpd_sender_restrictions $sender_dependent_relayhost_maps
enable_original_recipient = no
virtual_minimum_uid = 2000
virtual_uid_maps = static:2000
virtual_gid_maps = static:2000
virtual_mailbox_base = /var/vmail
virtual_alias_domains =
myhostname = mx.vxxxxxxxxxx.net
myorigin = mx.vxxxxxxxxxxx.net
mydomain = mx.vxxxxxxxxxxx.net
mynetworks = ['127.0.0.1', '172.20.0.8', '172.17.0.6', '192.168.3.4', '172.30.0.3', '192.168.2.11', '172.17.0.10', '172.17.0.20']
mydestination = $myhostname, localhost, localhost.localdomain
alias_maps = hash:/etc/postfix/aliases
alias_database = hash:/etc/postfix/aliases
message_size_limit = 31457280
recipient_delimiter = +
compatibility_level = 2
transport_maps =
proxy:ldap:/etc/postfix/ldap/transport_maps_user.cf
proxy:ldap:/etc/postfix/ldap/transport_maps_domain.cf
sender_dependent_relayhost_maps =
proxy:ldap:/etc/postfix/ldap/sender_dependent_relayhost_maps_user.cf
proxy:ldap:/etc/postfix/ldap/sender_dependent_relayhost_maps_domain.cf
smtpd_sender_login_maps =
proxy:ldap:/etc/postfix/ldap/sender_login_maps.cf
virtual_mailbox_domains =
proxy:ldap:/etc/postfix/ldap/virtual_mailbox_domains.cf
relay_domains =
$mydestination
proxy:ldap:/etc/postfix/ldap/relay_domains.cf
virtual_mailbox_maps =
proxy:ldap:/etc/postfix/ldap/virtual_mailbox_maps.cf
virtual_alias_maps =
proxy:ldap:/etc/postfix/ldap/virtual_alias_maps.cf
proxy:ldap:/etc/postfix/ldap/virtual_group_maps.cf
proxy:ldap:/etc/postfix/ldap/virtual_group_members_maps.cf
proxy:ldap:/etc/postfix/ldap/catchall_maps.cf
sender_bcc_maps =
proxy:ldap:/etc/postfix/ldap/sender_bcc_maps_user.cf
proxy:ldap:/etc/postfix/ldap/sender_bcc_maps_domain.cf
recipient_bcc_maps =
proxy:ldap:/etc/postfix/ldap/recipient_bcc_maps_user.cf
proxy:ldap:/etc/postfix/ldap/recipient_bcc_maps_domain.cf
postscreen_greet_action = drop
postscreen_blacklist_action = drop
postscreen_dnsbl_action = drop
postscreen_dnsbl_threshold = 2
postscreen_dnsbl_sites =
zen.spamhaus.org=127.0.0.[2..11]*3
b.barracudacentral.org=127.0.0.2*2
postscreen_dnsbl_reply_map = texthash:/etc/postfix/postscreen_dnsbl_reply
postscreen_access_list = permit_mynetworks cidr:/etc/postfix/postscreen_access.cidr
postscreen_dnsbl_whitelist_threshold = -2
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/dovecot-auth
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
mlmmj_destination_recipient_limit = 1
content_filter = smtp-amavis:[127.0.0.1]:10024
smtp-amavis_destination_recipient_limit = 1
relayhost = [OUTBOUND.RELAY]:3325
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/relay_pwd
smtp_sasl_security_options =
I appreciate any help anyone can give me on this one... I've been going around in circles :(
----
Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.
- 8H241195US9xxx74P