Client host rejected: Access denied (split mail delivery)

[jwaes]

Hi guys,

I am trying to setup split mail delivery.

Most of my mails are handled in Gmail, (virtualdomain.xyz mx is pointing to Gmail), but some emails i want to be handled by my docker-mailserver. (mail.mydomain.xyz host and mydomain.xyz )

(I can receive mail on mydomain.xyz through the DMS without issue.)

So in Gmail suite admin, i have setup my mailserver and route my mail to that.

The flow seems to go ok. When i mail from gmail it tries to deliver the mail to my mailserver but it gets rejected.

Nov 26 19:45:29 mail postfix/submission/smtpd[9722]: connect from mail-yw1-f198.google.com[209.85.128.198]
Nov 26 19:45:29 mail postfix/submission/smtpd[9722]: Anonymous TLS connection established from mail-yw1-f198.google.com[209.85.128.198]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
Nov 26 19:45:29 mail postfix/submission/smtpd[9722]: NOQUEUE: reject: RCPT from mail-yw1-f198.google.com[209.85.128.198]: 554 5.7.1 <mail-yw1-f198.google.com[209.85.128.198]>: Client host rejected: Access denied; from=<my@gmail.com> to=<test@virtualdomain.xyz> proto=ESMTP helo=<mail-yw1-f198.google.com>
Nov 26 19:45:30 mail postfix/submission/smtpd[9722]: disconnect from mail-yw1-f198.google.com[209.85.128.198] ehlo=2 starttls=1 mail=1 rcpt=0/1 bdat=0/1 quit=1 commands=5/7

Sending mail locally on my mailserver to the test@virtualdomain.xyz works as expected. But that is using qmgr and not submission/smtpd.

Some parts of the (i think relevant config: )

smtpd_authorized_verp_clients = $authorized_verp_clients
smtpd_authorized_xclient_hosts =
smtpd_authorized_xforward_hosts =
smtpd_banner = $myhostname ESMTP
smtpd_client_auth_rate_limit = 0
smtpd_client_connection_count_limit = 50
smtpd_client_connection_rate_limit = 0
smtpd_client_event_limit_exceptions = ${smtpd_client_connection_limit_exceptions:$mynetworks}
smtpd_client_message_rate_limit = 0
smtpd_client_new_tls_session_rate_limit = 0
smtpd_client_port_logging = no
smtpd_client_recipient_rate_limit = 0
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_unauth_pipelining
smtpd_command_filter =
smtpd_data_restrictions =
smtpd_delay_open_until_valid_rcpt = yes
smtpd_delay_reject = yes
smtpd_discard_ehlo_keyword_address_maps =
smtpd_discard_ehlo_keywords = silent-discard, dsn
smtpd_dns_reply_filter =
smtpd_end_of_data_restrictions =
smtpd_enforce_tls = no
smtpd_error_sleep_time = 1s
smtpd_etrn_restrictions =
smtpd_expansion_filter = \t\40!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~
smtpd_forbidden_commands = CONNECT GET POST
smtpd_hard_error_limit = ${stress?{1}:{20}}
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, permit
smtpd_history_flush_threshold = 100
smtpd_junk_command_limit = ${stress?{1}:{100}}
smtpd_log_access_permit_actions =
smtpd_milter_maps =
smtpd_milters = $dkim_milter $dmarc_milter
smtpd_noop_commands =
smtpd_null_access_lookup_key = <>
smtpd_peername_lookup = yes
smtpd_per_record_deadline = ${stress?{yes}:{no}}
smtpd_policy_service_default_action = 451 4.3.5 Server configuration problem
smtpd_policy_service_max_idle = 300s
smtpd_policy_service_max_ttl = 1000s
smtpd_policy_service_policy_context =
smtpd_policy_service_request_limit = 0
smtpd_policy_service_retry_delay = 1s
smtpd_policy_service_timeout = 100s
smtpd_policy_service_try_limit = 2
smtpd_proxy_ehlo = $myhostname
smtpd_proxy_filter =
smtpd_proxy_options =
smtpd_proxy_timeout = 100s
smtpd_recipient_limit = 1000
smtpd_recipient_overshoot_limit = 1000
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, check_policy_service unix:private/policyd-spf, reject_unauth_pipelining, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_recipient_domain, check_policy_service inet:localhost:65265
smtpd_reject_footer =
smtpd_reject_footer_maps =
smtpd_reject_unlisted_recipient = yes
smtpd_reject_unlisted_sender = no
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_restriction_classes =
smtpd_sasl_auth_enable = no
smtpd_sasl_authenticated_header = no
smtpd_sasl_exceptions_networks =
smtpd_sasl_local_domain = $mydomain
smtpd_sasl_path = /dev/shm/sasl-auth.sock
smtpd_sasl_response_limit = 12288
smtpd_sasl_security_options = noanonymous
smtpd_sasl_service = smtp
smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
smtpd_sasl_type = dovecot
smtpd_sender_login_maps = unionmap:{ texthash:/etc/postfix/virtual, hash:/etc/aliases, pcre:/etc/postfix/maps/sender_login_maps.pcre, pcre:/etc/postfix/regexp }
smtpd_sender_restrictions = $dms_smtpd_sender_restrictions
smtpd_service_name = smtpd
smtpd_soft_error_limit = 10
smtpd_starttls_timeout = ${stress?{10}:{300}}s
smtpd_timeout = ${stress?{10}:{300}}s
smtpd_tls_CAfile =
smtpd_tls_CApath = /etc/ssl/certs
smtpd_tls_always_issue_session_ids = yes
smtpd_tls_ask_ccert = no
smtpd_tls_auth_only = no
smtpd_tls_ccert_verifydepth = 9
smtpd_tls_cert_file =
smtpd_tls_chain_files = /etc/letsencrypt/live/mail.jacotech.net/key.pem /etc/letsencrypt/live/mail.jacotech.net/fullchain.pem
smtpd_tls_ciphers = medium
smtpd_tls_dcert_file =
smtpd_tls_dh1024_param_file = /etc/postfix/dhparams.pem
smtpd_tls_dh512_param_file =
smtpd_tls_dkey_file = $smtpd_tls_dcert_file
smtpd_tls_eccert_file =
smtpd_tls_eckey_file = $smtpd_tls_eccert_file
smtpd_tls_eecdh_grade = auto
smtpd_tls_exclude_ciphers = aNULL, SEED, CAMELLIA, RSA+AES, SHA1
smtpd_tls_fingerprint_digest = md5
smtpd_tls_key_file = $smtpd_tls_cert_file
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers =
smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtpd_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtpd_tls_received_header = no
smtpd_tls_req_ccert = no
smtpd_tls_security_level = may
smtpd_tls_session_cache_database =
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_wrappermode = no
smtpd_upstream_proxy_protocol =
smtpd_upstream_proxy_timeout = 5s
smtpd_use_tls = no
root@mail:/# 

root@mail:/# postconf |grep dms_smtpd_sender_restrictions
dms_smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unknown_sender_domain
mua_sender_restrictions = reject_authenticated_sender_login_mismatch, $dms_smtpd_sender_restrictions
smtpd_sender_restrictions = $dms_smtpd_sender_restrictions

root@mail:/# cat /etc/postfix/vhost 
virtualdomain.xyz
mydomain.xyz
root@mail:/#

In my reasoning as this test@virtualdomain.xyz is an address that can be handled by postfix, so i expect it to be accepted. As it is not to be relayed.

Any feedback is welcome. I think the google servers are somewhere rejected in those smtpd_sender_restrictions but even with loglevel on debug i do not get any more information.

[polarathene]

Some parts of the (i think relevant config: )

How much are you changing manually from what DMS handles?

Try to produce a minimal config that encounters the problem if possible, and raise a proper bug report if you think this a problem in DMS.

Client host rejected: Access denied;

You have Gmail configured to relay may to DMS on port 587 with correct DMS credentials right? Otherwise it won't be able to login to DMS to send mail via the DMS account (from/sender address will remain what your mail client provided, DMS account is only for login to have permission to send mail from DMS).

https://serverfault.com/questions/1119246/postfix-client-host-rejected-access-denied-how-to-diagnose-the-precise-reason/1119407#1119407

[jwaes]

@polarathene i didnt change much really

I got it working by changing the port of my server in the google config to port 25 instead of 587. (there is no option to add an authentication method / credentials there in the google UI)
I thought the behaviour for accepting 'final mail' would be the same ... But the first gets handled by 'postfix/smtpd' (see log below) and the latter by 'postfix/submission/smtpd' (which gives the access denied - log in intial message)

Nov 27 07:59:22 mail postfix/postscreen[87548]: CONNECT from [209.85.128.199]:46182 to [192.168.144.3]:25
Nov 27 07:59:22 mail postfix/dnsblog[87553]: addr 209.85.128.199 listed by domain dnsbl.sorbs.net as 127.0.0.6
Nov 27 07:59:22 mail postfix/dnsblog[87552]: warning: dnsblog_query: lookup error for DNS query 199.128.85.209.list.dnswl.org: Host or domain name not found. Name service error for name=199.128.85.209.list.dnswl.org type=A: Host not found, try again
Nov 27 07:59:28 mail postfix/postscreen[87548]: PASS NEW [209.85.128.199]:46182
Nov 27 07:59:28 mail postfix/smtpd[87572]: connect from mail-yw1-f199.google.com[209.85.128.199]
Nov 27 07:59:29 mail postfix/smtpd[87572]: Anonymous TLS connection established from mail-yw1-f199.google.com[209.85.128.199]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
Nov 27 07:59:29 mail policyd-spf[87580]: prepend Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=209.85.128.199; helo=mail-yw1-f199.google.com; envelope-from=me@gmail.com; receiver=<UNKNOWN> 
Nov 27 07:59:29 mail dovecot: auth: passwd-file(test@virtualdomain.xyz): unknown user 
Nov 27 07:59:29 mail postfix/smtpd[87572]: 82F93A401BE: client=mail-yw1-f199.google.com[209.85.128.199]
Nov 27 07:59:29 mail postfix/cleanup[87582]: 82F93A401BE: message-id=<CABS2UqJGnJvJBNekgvG=L1kdUJofuJgXd2KRwoS66ue=1FiPXg@mail.gmail.com>
Nov 27 07:59:29 mail opendkim[568]: 82F93A401BE: mail-yw1-f199.google.com [209.85.128.199] not internal
Nov 27 07:59:29 mail opendkim[568]: 82F93A401BE: not authenticated
Nov 27 07:59:29 mail opendkim[568]: 82F93A401BE: DKIM verification successful
Nov 27 07:59:29 mail opendkim[568]: 82F93A401BE: s=20230601 d=gmail.com a=rsa-sha256 SSL 
Nov 27 07:59:29 mail opendmarc[577]: 82F93A401BE ignoring Authentication-Results at 12 from mx.google.com
Nov 27 07:59:29 mail opendmarc[577]: 82F93A401BE: gmail.com pass
Nov 27 07:59:29 mail postfix/qmgr[87113]: 82F93A401BE: from=<me@gmail.com>, size=4917, nrcpt=1 (queue active)
Nov 27 07:59:29 mail dovecot: lmtp(87584): Connect from local
Nov 27 07:59:29 mail postfix/smtpd[87572]: disconnect from mail-yw1-f199.google.com[209.85.128.199] ehlo=2 starttls=1 mail=1 rcpt=1 bdat=1 quit=1 commands=7

[polarathene]

I got it working by changing the port of my server in the google config to port 25 instead of 587. (there is no option to add an authentication method / credentials there in the google UI)

Ah ok that would make sense then.

This will just deliver mail from your @gmail.com address to DMS like any other mail arriving to DMS on port 25. Your virtual alias then redirects the mail outbound.

If you want to relay from Gmail through DMS, then you'd need to configure for port 587 (or 465). This should be supported by Gmail, there are plenty of guides out there for this.

---

first gets handled by 'postfix/smtpd'

This is port 25.

docker-mailserver/target/postfix/master.cf

Line 14 in 68a43eb

smtpd pass - - n - - smtpd

smtpd is a service in master.cf above that Postfix will process mail through for port 25. Configured via smtpd_service_name

latter by 'postfix/submission/smtpd'

This is port 587.

docker-mailserver/target/postfix/master.cf

Line 17 in 68a43eb

submission inet n - n - - smtpd

This one is marked as an inet type and submission has a matching entry in /etc/services:

$ docker exec dms grep submission /etc/services
submissions     465/tcp         ssmtp smtps urd # Submission over TLS [RFC8314]
submission      587/tcp                         # Submission [RFC4409]

# Port 25 for SMTP inbound/outbound, used by Postfix smtpd service:
$ grep smtp /etc/services
smtp            25/tcp          mail

In a newer Postfix release (3.6+), this is also configurable for Postfix in main.cf via known_tcp_ports

---

I thought the behaviour for accepting 'final mail' would be the same

Mail from external mail servers will arrive on port 25.

Mail being submitted to DMS to deliver from an authenticated user will be on port 587 or 465. These may deliver locally, but also permit delivering outbound to another mail server (hence submission service names).