Otdfbt

I've got a dovecot/postfix server, each on different servers and I'm using the dovecot submission service to receive emails and relay them through postfix for sending.

Receiving emails in through postfix -> Dovecot/LMTP works just fine, so authentication is working since dovecot is handling the SASL auth just fine (I'm wondering at what point dovecot will just integrate SMTP directly and we can just run dovecot alone).

The problem is that when sending emails, they get accepted by dovecot, then through submission service get passed along, things seem to be ok until it refuses to authenticate and I get "relay access denied" error.

I thought if I included my dovecot server in the relay_nets and configured permit_mynetworks, etc, it would work, but I'm really having a hard time understanding the postfix docs. Which aren't really explaining very well how everything fits together. It's like a lot of lego pieces and no manual on how to do things right, you just have to "know".

Anyway, opinions aside. This is my postfix main.cf. Can anybody see anything wrong with it?

###############
# General
###############

# disable all the backwards compatibility stuff
compatibility_level = 2
#debug_peer_level = 100

# Main domain and hostname
mydomain = xxxx.com
myhostname = s2.yyyy.com
myorigin = $mydomain

# Message size limit
message_size_limit = 50000000

# Relayed networks
mynetworks = 127.0.0.1/32 [::1]/128 10.0.0.0/8

# Empty alias list to override the configuration variable and disable NIS
alias_maps =

# Only accept virtual emails
mydestination =

# Relayhost if any is configured
#relayhost =

# Recipient delimiter for extended addresses
recipient_delimiter = +

# Default Mailbox size, is set to 0 which means unlimited!
mailbox_size_limit = 0
virtual_mailbox_limit = 0

# readme_directory: The location of the Postfix README files.
#
readme_directory = no

# The inet_interfaces parameter specifies the network interface
# addresses that this mail system receives mail on. By default,
# the software claims all active interfaces on the machine. The
# parameter also controls delivery of mail to user@[ip.address].
#
# See also the proxy_interfaces parameter, for network addresses that
# are forwarded to us via a proxy or network address translator.
#
# Note: you need to stop/start Postfix when this parameter changes.
#
inet_interfaces = all
#inet_interfaces = $myhostname
#inet_interfaces = $myhostname, localhost

inet_protocols = all

###############
# SMTP Server
###############
smtpd_sasl_path = inet:dovecot.mail-server:24
smtpd_sasl_type = dovecot
smtpd_tls_security_level = may
# Let's Encrypt certificate file
smtpd_tls_cert_file = /etc/postfix/certs/tls.crt
# Let's Encrypt key file
smtpd_tls_key_file = /etc/postfix/certs/tls.key

###############
# Virtual
###############

# MySQL configuration
mysql = mysql:$config_directory

# The alias map actually returns both aliases and local mailboxes, which is
# required for reject_unlisted_sender to work properly
virtual_mailbox_domains = $mysql/mysql_virtual_mailbox_domains.cf
virtual_mailbox_maps = $mysql/mysql_virtual_mailbox_maps.cf
virtual_alias_maps = $mysql/mysql_virtual_alias_maps.cf

# Mails are transported if required, then forwarded to Dovecot for delivery
virtual_transport = lmtp:inet:dovecot.mail-server:24

# In order to prevent Postfix from running DNS query, enforce the use of the
# native DNS stack, that will check /etc/hosts properly.
lmtp_host_lookup = native

###############
# OpenDKIM
###############

milter_default_action = accept
milter_protocol = 2
smtpd_milters = inet:opendkim.mail-server:8891
non_smtpd_milters = inet:opendkim.mail-server:8891

###############
# Restrictions
###############

# Don't talk to mail systems that don't know their own hostname.
# With Postfix < 2.3, specify reject_unknown_hostname.
smtpd_helo_required=yes
smtpd_helo_restrictions =
 reject_invalid_hostname
 reject_non_fqdn_hostname
 permit_mynetworks,

# Don't accept mail from domains that don't exist.
smtpd_sender_restrictions =
 reject_unknown_sender_domain
 reject_unauth_destination,
 reject_invalid_hostname,
 reject_unauth_pipelining,
 reject_non_fqdn_sender,
 reject_unknown_sender_domain,
 reject_non_fqdn_recipient,
 reject_unknown_recipient_domain,
 permit

smtpd_recipient_restrictions =
 permit_sasl_authenticated,
 permit_mynetworks,
 reject_unauth_destination

smtpd_relay_restrictions =
 permit_mynetworks,
 permit_sasl_authenticated,
 defer_unauth_destination,
 reject_unauth_destination

unverified_recipient_reject_reason = Address lookup failure

Here is an example of the postfix log which is made when I try to send an email. It's the only information that I have, I'm able to provide more detailed logs if somebody wants to suggest what to enable to run it again.

smtp-server: conn 10.32.0.1:43280 [0]: Sending replies
smtp-server: conn 10.32.0.1:43280 [0]: No more commands pending
smtp-server: conn 10.32.0.1:43280 [0]: Received new command: EHLO [192.168.81.156]
smtp-server: conn 10.32.0.1:43280 [0]: command EHLO; 250 reply: Submitted
smtp-server: conn 10.32.0.1:43280 [0]: command EHLO: Ready to reply
smtp-server: conn 10.32.0.1:43280 [0]: Trigger output
smtp-server: conn 10.32.0.1:43280 [0]: Sending replies
smtp-server: conn 10.32.0.1:43280 [0]: command EHLO: Completed
smtp-server: conn 10.32.0.1:43280 [0]: Connection state reset
smtp-server: conn 10.32.0.1:43280 [0]: command EHLO; 250 reply: Sent: 250-yyyy.com 8BITMIME AUTH PLAIN LOGIN BURL imap CHUNKING ENHANCEDSTATUSCODES SIZE PIPELINING
smtp-server: conn 10.32.0.1:43280 [0]: command EHLO: Destroy
smtp-server: conn 10.32.0.1:43280 [0]: command EHLO; 250 reply: Destroy
smtp-server: conn 10.32.0.1:43280 [0]: Trigger output
smtp-server: conn 10.32.0.1:43280 [0]: No more commands pending
smtp-server: conn 10.32.0.1:43280 [0]: Sending replies
smtp-server: conn 10.32.0.1:43280 [0]: No more commands pending
smtp-server: conn 10.32.0.1:43280 [0]: Received new command: MAIL FROM:<info@xxxx.com>
smtp-server: conn 10.32.0.1:43280 [0]: command MAIL; 530 reply: Submitted
smtp-server: conn 10.32.0.1:43280 [0]: command MAIL: Ready to reply
smtp-server: conn 10.32.0.1:43280 [0]: Trigger output
smtp-server: conn 10.32.0.1:43280 [0]: Sending replies
smtp-server: conn 10.32.0.1:43280 [0]: command MAIL; 530 reply: Sent: 530 5.7.0 Authentication required.
smtp-server: conn 10.32.0.1:43280 [0]: command MAIL: Destroy
smtp-server: conn 10.32.0.1:43280 [0]: command MAIL; 530 reply: Destroy
smtp-server: conn 10.32.0.1:43280 [0]: Trigger output
smtp-server: conn 10.32.0.1:43280 [0]: No more commands pending
smtp-server: conn 10.32.0.1:43280 [0]: Sending replies
smtp-server: conn 10.32.0.1:43280 [0]: No more commands pending
smtp-server: conn 10.32.0.1:43280 [0]: Received new command: QUIT
smtp-server: conn 10.32.0.1:43280 [0]: command QUIT; 221 reply: Submitted
smtp-server: conn 10.32.0.1:43280 [0]: command QUIT: Ready to reply
smtp-server: conn 10.32.0.1:43280 [0]: Trigger output
smtp-server: conn 10.32.0.1:43280 [0]: Sending replies
smtp-server: conn 10.32.0.1:43280 [0]: command QUIT; 221 reply: Sent: 221 2.0.0 Bye
smtp-server: conn 10.32.0.1:43280 [0]: Disconnected: Client has quit the connection