Resolved PostFix Receiving Email - NOQUEUE: reject Relay access denied;

[NateWon]

Hello, I'm having issues with receiving emails from External sources, Ive opened port 25 (Should this be left open, can I run the mail server with it closed?) and mail is coming in but not making it to the domain/mailbox.

Mar 3 15:35:56 mysite /usr/lib/plesk-9.0/psa-pc-remote[60822]: Message aborted.
Mar 3 15:36:43 mysite postfix/smtpd[64525]: connect from mail-sy3aus01on0058.outbound.protection.outlook.com[104.47.117.58]
Mar 3 15:36:43 mysite postfix/smtpd[64525]: NOQUEUE: reject: RCPT from mail-sy3aus01on0058xxxxxxxxxxxxxx.com[104.47.117.58]: 454 4.7.1 <[email protected]>: Relay access denied; from=<my@externaladdress> to=<[email protected]> proto=ESMTP helo=<AUS01-SY3-obe.outbound.protection.outlook.com>
Mar 3 15:36:43 mysite postfix/smtpd[64525]: disconnect from mail-sy3aus01on0058xxxxxxxxx.com[104.47.117.58] ehlo=2 starttls=1 mail=1 rcpt=0/1 quit=1 commands=5/6

Ive read a large number of posts on this, and can't work it out will continue reading but any help would be appreciated.

The server is sending: RoundCube + PostFix + DoveCot,
The account works, can login on roundcube and send to addresses with no problem. Replying, or New Emails won't make it back to the account as per the error above. Example from Exchange.

main.cf

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file = /etc/postfix/postfix_default.pem
smtpd_tls_key_file = $smtpd_tls_cert_file
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination

myhostname = mydomain
alias_maps = hash:/etc/aliases, hash:/var/spool/postfix/plesk/aliases
alias_database = hash:/etc/aliases
mydestination = $myhostname, $mydomain, localhost.$mydomain, localdomain, localhost, localhost.localdomain, localhost, domain.com
#relayhost =
mynetworks = 192.168.1.0/24, 127.0.0.0/8 $mydomain
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
virtual_mailbox_domains = $virtual_mailbox_maps, hash:/var/spool/postfix/plesk/virtual_domains
virtual_alias_maps = $virtual_maps, hash:/var/spool/postfix/plesk/virtual
virtual_mailbox_maps = , hash:/var/spool/postfix/plesk/vmailbox
transport_maps = , hash:/var/spool/postfix/plesk/transport
smtpd_tls_security_level = may
smtp_tls_security_level = may
smtp_use_tls = no
smtpd_timeout = 3600s
smtpd_proxy_timeout = 3600s
disable_vrfy_command = yes

smtpd_sender_restrictions = check_sender_access hash:/var/spool/postfix/plesk/blacklists, permit_sasl_authenticated
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_hostname, permit
#smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated
smtp_send_xforward_command = yes
smtpd_authorized_xforward_hosts = 127.0.0.0/8 [::1]/128
smtpd_sasl_auth_enable = no
smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination
#smtpd_recipient_restrictions = permit_mynetworks, defer_unauth_destination, permit_sasl_authenticated
virtual_mailbox_base = /mail/qmail/mailnames
virtual_uid_maps = static:30
virtual_gid_maps = static:31
smtpd_milters = , inet:127.0.0.1:12768
sender_dependent_default_transport_maps = hash:/var/spool/postfix/plesk/sdd_transport_maps
virtual_transport = plesk_virtual
plesk_virtual_destination_recipient_limit = 1
mailman_destination_recipient_limit = 1
virtual_mailbox_limit = 0
smtpd_tls_ciphers = medium
smtpd_tls_mandatory_ciphers = medium
tls_medium_cipherlist = HIGH:!aNULL:!MD5
smtpd_tls_mandatory_protocols = TLSv1 TLSv1.1 TLSv1.2
smtpd_tls_protocols = TLSv1 TLSv1.1 TLSv1.2
message_size_limit = 10240000


Thank you

 

[Bitpalast]

Ive opened port 25 (Should this be left open, can I run the mail server with it closed?)

Port 25 must remain open. You cannot run a mail server with it closed unless all connected servers and clients use a different port of your choice, too. That is not the case for servers on the Internet, so you need port 25.

Your issue is probably caused by "reject_unauth_destination" in this line of the configuration:

smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination

according to this article that describes it in more detail http://serverfault.com/questions/667493/noqueue-reject-rcpt-from-on-freebsd-and-postfix in the section where the green checkmark is shown left of the text.

 

[UFHH01]

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination

Missing "," between the unique modifications. Should be:
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination

mynetworks = 192.168.1.0/24, 127.0.0.0/8 $mydomain

... is as well incorrect. Should be

mynetworks = , 127.0.0.0/8 [::1]/128 XXX.XXX.XXX.XXX/32
( where "XXX.XXX.XXX.XXX/32" equals your server IP(s) )

 

[Bitpalast]

I missed that one.

 

[NateWon]

Thank you, have made those changes and is sending fine, incoming still has issues but looking into this now
Error: userdb lookup: connect(/var/run/dovecot/auth-userdb) failed: Permission denied (euid=30(popuser) egid=31(popuser) UNIX perms appear ok (ACL/MAC wrong?),


Which was caused by the .orig file being in the apparmor.d directory as per these instructions
https://support.plesk.com/hc/en-us/...-dovecot-auth-userdb-failed-Permission-denied