Resolved Need help with email relay not being used

[amba1980]

Server operating system version

Ubuntu 20.04

Plesk version and microupdate number

Obsidian

Hi!

we use multiple Linux servers with the same hoster and Plesk Obsidian. On one of the servers, email sending does not work.

I suspect this line in the logfiles points at the problem

Dec 9 23:12:38 xxx postfix-local[102419]: xxx from=<[email protected]>, to=<[email protected]>, dirname=/var/qmail/mailnames

The issue must the local resolution, because on another server (where it works) it looks like this

Dec 9 23:10:10 xxx postfix/smtp[1801318]: xxx: to=<[email protected]>, relay=mx01.1and1.com[74.208.5.21]:25, delay=1.9, delays=0.02/0.01/1.3/0.61, dsn=2.0.0, status=sent ...

In the second case, it uses the registrar's mail server (1and1 / IONOS) which makes sense to me.

I have compared the two server configurations side by side and I cannot find a difference. They are basically identically configured (we mostly use Wordpress for our domains).

How / where to configure the use of postfix/smtp rather than postfix-local?

Thanks so much! I'm sorry I'm so clueless about email configuration.

Amba

 

[Peter Debik]

Could you please check whether on the server where it does not seem to work the recipient domain is not listed in the domain list? If it is, mails are not sent to the Internet but handled locally by the same server. To fix the issue you can either remove the domain from the local server or you can disable the email service of it so that the server knows it is no longer responsible for delivering mail to that domain. It will then send mails to that domain out to the Internet.

 

[amba1980]

Thank you. This was indeed the problem. I had misunderstood the flag "Activate mail service on this domain" to enable/disable all mail sending, not just the emails that might get delivered locally.

Given my abilities, I'm always worried about the security of our servers. I keep things minimal uptodate and follow the Advisor recommendations (except where they try to upsell us usually).

This here from the log files

Dec 11 14:30:33 x postfix/smtpd[57966]: warning: unknown[87.246.7.227]: SASL LOGIN authentication failed: authentication failure
Dec 11 14:30:34 x postfix/smtpd[57966]: disconnect from unknown[87.246.7.227] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
Dec 11 14:30:48 x postfix/smtpd[57964]: warning: hostname net6-ip227.linkbg.com does not resolve to address 87.246.7.227: Name or service not known
Dec 11 14:30:48 x postfix/smtpd[57964]: connect from unknown[87.246.7.227]
Dec 11 14:30:56 x plesk_saslauthd[52111]: No such user '[email protected]' in mail authorization database
Dec 11 14:30:56 x plesk_saslauthd[52111]: failed mail authentication attempt for user '[email protected]' (password len=9)

are just regular cracking attempts that I can ignore? Our most popular server has these scrolling through at a fair speed in the log files.

Thanks!

 

[Maarten.]

Thank you. This was indeed the problem. I had misunderstood the flag "Activate mail service on this domain" to enable/disable all mail sending, not just the emails that might get delivered locally.

Given my abilities, I'm always worried about the security of our servers. I keep things minimal uptodate and follow the Advisor recommendations (except where they try to upsell us usually).

This here from the log files

Dec 11 14:30:33 x postfix/smtpd[57966]: warning: unknown[87.246.7.227]: SASL LOGIN authentication failed: authentication failure
Dec 11 14:30:34 x postfix/smtpd[57966]: disconnect from unknown[87.246.7.227] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
Dec 11 14:30:48 x postfix/smtpd[57964]: warning: hostname net6-ip227.linkbg.com does not resolve to address 87.246.7.227: Name or service not known
Dec 11 14:30:48 x postfix/smtpd[57964]: connect from unknown[87.246.7.227]
Dec 11 14:30:56 x plesk_saslauthd[52111]: No such user '[email protected]' in mail authorization database
Dec 11 14:30:56 x plesk_saslauthd[52111]: failed mail authentication attempt for user '[email protected]' (password len=9)

are just regular cracking attempts that I can ignore? Our most popular server has these scrolling through at a fair speed in the log files.

Thanks!

Those are just bots that try to abuse your mail server. As long as your users have strong passwords, there is nothing to worry about. It happens all the time.

Just in case:
- enable the Fail2ban plesk-postfix jail, which would block those bots
- force strong passwords on your server: Tools & Settings -> Security Policy -> Password strength -> (Very) Strong

If you want to know more about securing your server, have a look at this:

https://support.plesk.com/hc/en-us/articles/115000626925-How-to-secure-a-Plesk-server