Postfix Issue

I have some executives that refuse to use exchange and insist on using postfix.
So I setup a postfix server for them. I have tested this postfix server and it works perfectly using thunder bird. Here is a successful message:

Mar 27 21:41:15 XXXXpostfix01 postfix/smtp[4761]: A5B1B21694: to=<>,[]:25, delay=1.3, delays=0.65/0/0.12/0.56, dsn=2.0.0, status=sent (250 2.0.0 OK 1332946033 np1si3148089igc.2)

Now when the executives use the postfix server it fails:

Mar 29 06:55:53 XXXXpostfix01 postfix/smtpd[10291]: NOQUEUE: reject: RCPT from unknown[]: 554 5.7.1 <>: Recipient address rejected: Relay access denied; from=<> to=<> proto=SMTP helo=<>

These users refuse to tell me what mail client they are using. But only differance I see is they are using IMAP 554 and they got a different IP for MX record on DNS.

I am stumped help!
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

What do you have in for the following options:

JFTechAuthor Commented:

smtpd_sasl_auth_enable = yessmtpd_sasl_security_options = noanonymoussmtpd_sasl_path = postfixsmtpd_sasl_local_domain = $myhostnamebroken_sasl_auth_clients = yessmtpd_sasl_authenicated_header = yessmtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,check_relay_domainssmtpd_client_restrictions = permit_mynetworks,permit_sasl_authenticated#smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,check_relay_domainssmtp_sasl_auth_enable = yessmtp_sasl_password_maps = hash:/etc/postfix/sasl_passwdsmtpd_sasl_security_options = noanonymoussmtpd_client_restrictions = permit_sasl_authenticatedsmtpd_helo_required = yessmtpd_delay_reject = nodisable_vrfy_command =yessmtpd_helo_restrictions = permit_mynetworks,reject_invalid_hostname

My network -

mynetwork =
Heh that is like a dozen different options jumbled together and hard to read, but I found the option I was looking for: smtpd_client_restrictions = permit_sasl_authenticated

Change the option to the following, reload postfix, and try again.
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

Open in new window

Acronis Data Cloud 7.8 Enhances Cyber Protection

A closer look at five essential enhancements that benefit end-users and help MSPs take their cloud data protection business further.

If your users are not on then make sure you add any networks your clients will be sending from to the mynetworks option.
You need to configure Skype auth and have them configure thunderbird to authenticate prior to sending email.
Check for which features are enabled.
You may want to use secure smtp/tls to have the message transfer between the execs and the server in secure mode rather than plain text.

The ip of the client was public 12.x.x.x network.
What does Skype auth have to do with this?  Do you mean SMTP auth?

In regards to the client IP I admit I overlooked that and didn't notice it wasn't RFC 1918, so permit_mynetworks isn't going to fix this particular issue.  Are your users authenticating to the server?
Auto correction that I did not notice, should be smtp auth.
JFTechAuthor Commented:
Thanks for the replies.
Yes they can authenticate to the email system.
They are able to send emails in to our corporate exchange system.
But get the shown failure when trying to send emails to external mail domains.
As for their 12. address, they travel all over the world. I wont be able to predict what IP they will use. So how can I configure the networks to allow that?
The issue and the log entry suggests that they do not actually authenticate.
Into the corporate exchange the authentication might be transparent (NTLM) or completely unnecessary based on the relay rules for the network segments.
While the systems provide similar functionality, they are two different systems and have to be configured individually.
check the log to see whether there is an entry noting user A authenticated?

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
JFTechAuthor Commented:
I assume you want me to check if they auth to the postfix server?

I should give some more backround:

The exchange sever is authoritative for the MX record for our domain [].
These executive users do not have mailboxes on the exchange server. What the have is a contact object on exchange that has two records - an SMTP address: and an external SMTP address: I have a connector setup in exchange to relay any to the postfix server.

Any email these users generate on the post fix server is delivered to the internet by the postfix server.

The log examples I gave show me testing external mail delivery from the postfix server and it working.[Thunderbird]

The next example shows the executive  user trying the same test from their client and location and it failing.[Client unknown, they wont tell me =( ]

I am upping the points to 500....
They could be using their smart phone, but as long as they configure the device to authenticate, the emails will go through.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.