1

Topic: Getting Relay access denied when sending emails from / through SOGo

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 0.9.8
- Linux/BSD distribution name and version: Debian 9.6
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): LDAP
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? No
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

So, I'm getting this message in SOGo's logs:
Nov 30 23:53:51 sogod [7703]: |SOGo| starting method 'POST' on uri '/SOGo/so/mxxxxxxxxxxa@vxxxxxxx.net/Mail/0/folderDrafts/newDraft1543618428-1/send'
Nov 30 23:53:51 sogod [7703]: <0x0x55852df40bd0[SOGoMailer]> error with recipient 'mxxxxxxxa@outlook.com'
Nov 30 23:53:51 sogod [7703]: |SOGo| request took 0.573482 seconds to execute
Nov 30 23:53:51 sogod [7703]: 192.168.3.165 "POST /SOGo/so/mxxxxxxxxxxa@vxxxxxxx.net/Mail/0/folderDrafts/newDraft1543618428-1/send HTTP/1.0" 405 84/196 0.594 - - 132K

and on the maillog:
Nov 30 23:53:51 chlispsrv01 postfix/postscreen[7976]: CONNECT from [127.0.0.1]:42084 to [127.0.0.1]:25
Nov 30 23:53:51 chlispsrv01 postfix/postscreen[7976]: WHITELISTED [127.0.0.1]:42084
Nov 30 23:53:51 chlispsrv01 postfix/smtpd[7977]: connect from mx.vxxxxxxx.net[127.0.0.1]
Nov 30 23:53:51 chlispsrv01 postfix/smtpd[7977]: NOQUEUE: reject: RCPT from mx.vxxxxxxx.net[127.0.0.1]: 454 4.7.1 <mxxxxxxxa@outlook.com>: Relay access denied; from=<mxxxxxxxxxxa@vxxxxxxx.net> to=<mxxxxxxxa@outlook.com> proto=ESMTP helo=<mx.vxxxxxxx.net>
Nov 30 23:53:51 chlispsrv01 postfix/smtpd[7977]: disconnect from mx.vxxxxxxx.net[127.0.0.1] ehlo=1 mail=1 rcpt=0/1 quit=1 commands=3/4

This happens if I try to send the email from Outlook or Android device using EAS, however, if it's targetting my domain it passes without any issue, and if I send from Roundcube it goes to any domain without a problem.

My configs as follows:

SOGo:
{
    WOPort = 127.0.0.1:20000;
    SOGoDebugRequests = YES;
    WOMaxUploadSize = 15360;
    SOGoMaximumMessageSizeLimit = 15360;
    WOWorkersCount = 10;
    SOGoMaximumPingInterval = 3540;
    SOGoMaximumSyncInterval = 3540;
    SOGoInternalSyncInterval = 30;
    WOWatchDogRequestTimeout = 61;
    SOGoMaximumSyncResponseSize = 2048;
    SxVMemLimit = 500;
    SOGoXSRFValidationEnabled = YES;
    SOGoProfileURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/sogo_user_profile";
    OCSFolderInfoURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/sogo_folder_info";
    OCSSessionsFolderURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/sogo_sessions_folder";
    OCSEMailAlarmsFolderURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/sogo_alarms_folder";
    OCSCacheFolderURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/sogo_cache_folder";
    OCSStoreURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/sogo_store";
    OCSAclURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/sogo_acl";
    SOGoLanguage = English;
    SOGoLoginModule = Mail;
    SOGoForceExternalLoginWithEmail = YES;
    SOGoMailCustomFromEnabled = NO;
    SOGoIMAPServer = "imap://127.0.0.1:143/";
    SOGoSMTPServer = 127.0.0.1:25;
    SOGoMailingMechanism = smtp;
    SOGoSieveFolderEncoding = UTF-8;
    SOGoMemcachedHost = 127.0.0.1;
    SOGoTimeZone = "Europe/Zurich";
    SOGoFirstDayOfWeek = 1;
    SOGoRefreshViewCheck = every_5_minutes;
    SOGoMailReplyPlacement = below;
    SOGoExternalAvatarsEnabled = NO;
    SOGoGravatarEnabled = NO;
    SOGoEnableEMailAlarms = YES;
    SOGoAppointmentSendEMailNotifications = YES;
    SOGoFoldersSendEMailNotifications = YES;
    SOGoACLsSendEMailNotifications = YES;
    SOGoNotifyOnExternalModifications = YES;
    SOGoPasswordChangeEnabled = YES;
    /* SQL backend
    SOGoUserSources = (
        {
            type = sql;
            id = users;
            viewURL = "mysql://sogo:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@127.0.0.1:3306/sogo/users";
            canAuthenticate = YES;
            userPasswordAlgorithm = ssha512;
            prependPasswordScheme = YES;
            isAddressBook = YES;
            displayName = "Domain Address Book";
            SOGoEnableDomainBasedUID = YES;
            DomainFieldName = "domain";
        },
    );
    SQL backend */
    SOGoUserSources = (
        {
            type = ldap;
            id = users;
            canAuthenticate = YES;
            isAddressBook = NO;
            displayName = "LDAP Authentication";
            hostname = "ldap://127.0.0.1:389";
            baseDN = "o=domains,dc=vxxxxxxxxxxx,dc=net";
            bindDN = "cn=vmail,dc=vxxxxxxxxxx,dc=net";
            bindPassword = "xxxxxxxxxxxxxxxxxxxx";
            filter = "objectClass=mailUser AND accountStatus=active AND enabledService=mail AND enabledService=sogo";
            scope = SUB;
            userPasswordAlgorithm = ssha512;
            CNFieldName = cn;
            IDFieldName = mail;
            UIDFieldName = mail;
            IMAPLoginFieldName = mail;
            MailFieldNames = (mail);
            bindFields = (mail);
        },
        {
            type = ldap;
            id = global_addressbook;
            canAuthenticate = NO;
            isAddressBook = YES;
            displayName = "Global Address Book";
            bindAsCurrentUser = YES;
            listRequiresDot = NO;
            hostname = "ldap://127.0.0.1:389";
            baseDN = "o=domains,dc=vxxxxxxxxxx,dc=net";
            bindDN = "cn=vmail,dc=vxxxxxxxxxx,dc=net";
            bindPassword = "xxxxxxxxxxxxxx";
            filter = "((enabledService=mail AND accountStatus=active AND enabledService=displayedInGlobalAddressBook) AND ((objectClass=mailUser AND enabledService=sogo) OR (objectClass=mailList) OR (objectClass=mailAlias)))";
            scope = SUB;
            IDFieldName = mail;
            bindFields = (mail);
            UIDFieldName = mail;
            IMAPLoginFieldName = mail;
            CNFieldName = cn;
            SearchFieldNames = (cn, sn, displayName, telephoneNumber, mail, shadowAddress, departmentNumber);
        }
    );
}

and postfix:
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix/sbin
data_directory = /var/lib/postfix
mail_owner = postfix
sendmail_path = /usr/sbin/sendmail
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop
debugger_command =
    PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
    ddd $daemon_directory/$process_name $process_id & sleep 5
debug_peer_level = 2
unknown_local_recipient_reject_code = 550
biff = no
swap_bangpath = no
allow_percent_hack = no
allow_min_user = no
disable_vrfy_command = yes
inet_protocols = all
inet_interfaces = all
smtpd_tls_key_file = /etc/ssl/private/iRedMail.key
smtpd_tls_cert_file = /etc/ssl/certs/iRedMail.crt
smtpd_tls_CAfile = /etc/ssl/certs/iRedMail.crt
smtpd_tls_CApath = /etc/ssl/certs
smtpd_tls_protocols = !SSLv2 !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3
smtp_tls_protocols = !SSLv2 !SSLv3
smtp_tls_mandatory_protocols = !SSLv2 !SSLv3
lmtp_tls_protocols = !SSLv2 !SSLv3
lmtp_tls_mandatory_protocols = !SSLv2 !SSLv3
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDC3-SHA, KRB5-DE5, CBC3-SHA
smtpd_tls_dh512_param_file = /etc/ssl/dh512_param.pem
smtpd_tls_dh1024_param_file = /etc/ssl/dh2048_param.pem
tls_random_source = dev:/dev/urandom
smtp_tls_loglevel = 1
smtpd_tls_loglevel = 1
smtpd_tls_security_level = may
smtp_tls_security_level = may
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_CAfile = $smtpd_tls_CAfile
smtp_tls_note_starttls_offer = yes
smtpd_reject_unlisted_recipient = yes
smtpd_reject_unlisted_sender = yes
header_checks = pcre:/etc/postfix/header_checks
body_checks = pcre:/etc/postfix/body_checks.pcre
smtpd_helo_required = yes
smtpd_helo_restrictions =
    permit_mynetworks
    permit_sasl_authenticated
    check_helo_access pcre:/etc/postfix/helo_access.pcre
    reject_non_fqdn_helo_hostname
    reject_unknown_helo_hostname
smtpd_sender_restrictions =
    reject_unknown_sender_domain
    reject_non_fqdn_sender
    reject_unlisted_sender
    permit_mynetworks
    permit_sasl_authenticated
    check_sender_access pcre:/etc/postfix/sender_access.pcre
smtpd_recipient_restrictions =
    reject_non_fqdn_recipient
    reject_unlisted_recipient
    check_policy_service inet:127.0.0.1:7777
    permit_mynetworks
    permit_sasl_authenticated
    reject_unauth_destination
smtpd_end_of_data_restrictions =
    check_policy_service inet:127.0.0.1:7777
smtpd_data_restrictions = reject_unauth_pipelining
smtp_generic_maps = hash:/etc/postfix/generic_maps
proxy_read_maps = $canonical_maps $lmtp_generic_maps $local_recipient_maps $mydestination $mynetworks $recipient_bcc_maps $recipient_canonical_maps $relay_domains $relay_recipient_maps $relocated_maps $sender_bcc_maps $sender_canonical_maps $smtp_generic_maps $smtpd_sender_login_maps $transport_maps $virtual_alias_domains $virtual_alias_maps $virtual_mailbox_domains $virtual_mailbox_maps $smtpd_sender_restrictions $sender_dependent_relayhost_maps
enable_original_recipient = no
virtual_minimum_uid = 2000
virtual_uid_maps = static:2000
virtual_gid_maps = static:2000
virtual_mailbox_base = /var/vmail
virtual_alias_domains =
myhostname = mx.vxxxxxxxxxx.net
myorigin = mx.vxxxxxxxxxxx.net
mydomain = mx.vxxxxxxxxxxx.net
mynetworks = ['127.0.0.1', '172.20.0.8', '172.17.0.6', '192.168.3.4', '172.30.0.3', '192.168.2.11', '172.17.0.10', '172.17.0.20']
mydestination = $myhostname, localhost, localhost.localdomain
alias_maps = hash:/etc/postfix/aliases
alias_database = hash:/etc/postfix/aliases
message_size_limit = 31457280
recipient_delimiter = +
compatibility_level = 2
transport_maps =
    proxy:ldap:/etc/postfix/ldap/transport_maps_user.cf
    proxy:ldap:/etc/postfix/ldap/transport_maps_domain.cf
sender_dependent_relayhost_maps =
    proxy:ldap:/etc/postfix/ldap/sender_dependent_relayhost_maps_user.cf
    proxy:ldap:/etc/postfix/ldap/sender_dependent_relayhost_maps_domain.cf
smtpd_sender_login_maps =
    proxy:ldap:/etc/postfix/ldap/sender_login_maps.cf
virtual_mailbox_domains =
    proxy:ldap:/etc/postfix/ldap/virtual_mailbox_domains.cf
relay_domains =
    $mydestination
    proxy:ldap:/etc/postfix/ldap/relay_domains.cf
virtual_mailbox_maps =
    proxy:ldap:/etc/postfix/ldap/virtual_mailbox_maps.cf
virtual_alias_maps =
    proxy:ldap:/etc/postfix/ldap/virtual_alias_maps.cf
    proxy:ldap:/etc/postfix/ldap/virtual_group_maps.cf
    proxy:ldap:/etc/postfix/ldap/virtual_group_members_maps.cf
    proxy:ldap:/etc/postfix/ldap/catchall_maps.cf
sender_bcc_maps =
    proxy:ldap:/etc/postfix/ldap/sender_bcc_maps_user.cf
    proxy:ldap:/etc/postfix/ldap/sender_bcc_maps_domain.cf
recipient_bcc_maps =
    proxy:ldap:/etc/postfix/ldap/recipient_bcc_maps_user.cf
    proxy:ldap:/etc/postfix/ldap/recipient_bcc_maps_domain.cf
postscreen_greet_action = drop
postscreen_blacklist_action = drop
postscreen_dnsbl_action = drop
postscreen_dnsbl_threshold = 2
postscreen_dnsbl_sites =
    zen.spamhaus.org=127.0.0.[2..11]*3
    b.barracudacentral.org=127.0.0.2*2
postscreen_dnsbl_reply_map = texthash:/etc/postfix/postscreen_dnsbl_reply
postscreen_access_list = permit_mynetworks cidr:/etc/postfix/postscreen_access.cidr
postscreen_dnsbl_whitelist_threshold = -2
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/dovecot-auth
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
mlmmj_destination_recipient_limit = 1
content_filter = smtp-amavis:[127.0.0.1]:10024
smtp-amavis_destination_recipient_limit = 1
relayhost = [OUTBOUND.RELAY]:3325
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/relay_pwd
smtp_sasl_security_options =


I appreciate any help anyone can give me on this one... I've been going around in circles :(

2

Re: Getting Relay access denied when sending emails from / through SOGo

ghosterius wrote:

    SOGoSMTPServer = 127.0.0.1:25;

in SOGo config file, try to remove ':25' in smtp server address.

ghosterius wrote:

mynetworks = ['127.0.0.1', '172.20.0.8', '172.17.0.6', '192.168.3.4', '172.30.0.3', '192.168.2.11', '172.17.0.10', '172.17.0.20']

This syntax is wrong, it should be:

mynetworks = 127.0.0.1 172.20.0.8 172.17.0.6 192.168.3.4 172.30.0.3 192.168.2.11 172.17.0.10 172.17.0.20

After above 2 fixes, sogo should be fine.

----

Does my reply help a little? How about buying me a cup of coffee ($5) as an encouragement?

buy me a cup of coffee

3 (edited by ghosterius 2018-12-03 16:48:04)

Re: Getting Relay access denied when sending emails from / through SOGo

ZhangHuangbin wrote:
ghosterius wrote:

    SOGoSMTPServer = 127.0.0.1:25;

in SOGo config file, try to remove ':25' in smtp server address.

ghosterius wrote:

mynetworks = ['127.0.0.1', '172.20.0.8', '172.17.0.6', '192.168.3.4', '172.30.0.3', '192.168.2.11', '172.17.0.10', '172.17.0.20']

This syntax is wrong, it should be:

mynetworks = 127.0.0.1 172.20.0.8 172.17.0.6 192.168.3.4 172.30.0.3 192.168.2.11 172.17.0.10 172.17.0.20

After above 2 fixes, sogo should be fine.

a HUGE THANK YOU! smile

Damn I was going blind with this one....

Such small things and making such a hard time.

Here... have a coffee on me wink - 8H241195US9xxx74P

4

Re: Getting Relay access denied when sending emails from / through SOGo

Thanks for the coffee.

----

Does my reply help a little? How about buying me a cup of coffee ($5) as an encouragement?

buy me a cup of coffee