Free tools Windows power users keep installed
One-click scans. No signup required.
Postfix forwarding usually fails for one of four reasons: the address is configured with the wrong alias mechanism, the forwarding domain has the wrong destination role, the lookup database was not rebuilt, or remote delivery is failing after Postfix accepted the message. Fix it in that order: identify whether the recipient is local or virtual, verify the effective configuration and map entry, run postmap, reload Postfix, then trace one test message by queue ID through the mail logs.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Choose the forwarding mechanism before changing anything
Postfix has two commonly confused forwarding models. Local aliases and .forward files operate on recipients that are local to the server. Virtual aliases forward addresses in a hosted domain and are looked up by the complete address, including its domain. Using a local mechanism for a virtual domain, or declaring a virtual domain as local, can produce rejections, loops, or apparently ignored aliases.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Question | Local aliases or .forward |
Virtual aliases |
|---|---|---|
| Recipient scope | A localpart such as root or a system user’s address |
A full address such as [email protected] |
| Domain declaration | The domain is a local destination, normally through mydestination |
The forwarding domain belongs in virtual_alias_domains, not mydestination |
| Typical map | /etc/aliases, processed with newaliases (or postalias) |
A table such as hash:/etc/postfix/virtual, processed with postmap |
| Lookup key | Usually the localpart | The full address; matching is exact unless a supported pattern or catch-all is configured |
| Expansion behavior | Can invoke local delivery and aliases | Virtual aliasing can expand recursively |
| Verification | Inspect aliases and run postalias/newaliases |
Use postconf, postmap -q, and the queue and SMTP logs |
If mail addressed to [email protected] should leave your server for [email protected], the virtual-domain model is normally the appropriate one. If [email protected] is being redirected to an administrator, a local alias is simpler.
Understand what Postfix does with a virtual alias
For a virtual alias, Postfix first accepts the recipient only if the domain is classified as a destination it serves. It then queries the configured alias map using the complete address, expands the result, and routes the resulting recipient through the normal delivery pipeline. The Postfix virtual(5) manual states: “Virtual aliasing is recursive; to terminate recursion for a specific address, alias that address to itself.” A chain such as [email protected] to [email protected] to [email protected] is therefore possible, but a cycle can repeatedly expand until Postfix stops it and generates a delivery error.
#1 Best Overall
An entry in a text table is normally written as one key followed by one or more destinations separated by whitespace:
[email protected] [email protected]
[email protected] [email protected]The left side must match the address Postfix looks up. A key of user does not substitute for [email protected] in a virtual alias table. Keep the forwarding domain out of mydestination; the Postfix Virtual Domain Hosting Howto gives the explicit warning: “NEVER list a virtual alias domain name as a mydestination domain!”
Inspect the effective configuration
Do not rely on a remembered value in /etc/postfix/main.cf. Postfix can combine files, defaults, and distribution-specific settings. Check the running configuration first:
postconf -n
postconf virtual_alias_domains
postconf virtual_alias_maps
postconf mydestination
postconf relay_domains
postconf smtpd_relay_restrictionsConfirm that:
virtual_alias_domainscontains the domain you intend to forward, either as a name or through the map syntax you deliberately configured.virtual_alias_mapspoints to the table type and path you actually edit, for examplehash:/etc/postfix/virtual.- The same domain is not accidentally present in
mydestination, which would make Postfix treat it as a local mailbox domain instead of a virtual alias domain. - Another setting is not overriding the map you expected, especially on systems that include additional configuration files.
smtpd_relay_restrictionsstill requires an appropriate destination, authentication, or trusted-network condition. A forwarding fix must not turn the server into an open relay.
Use the exact map name shown by postconf. If it says lmdb:/etc/postfix/virtual or a database-backed map rather than hash:, use that type and its corresponding maintenance procedure.
Configure virtual-domain forwarding correctly
1. Declare the forwarding domain
In main.cf, add the domain to virtual_alias_domains. A simple whitespace-separated declaration looks like this:
virtual_alias_domains = example.com
virtual_alias_maps = hash:/etc/postfix/virtualIf the server already has values for these parameters, preserve the existing domains and maps instead of replacing them unintentionally. A map can also be declared through a file that lists domains; the important point is that the effective value shown by postconf must include the intended domain and map.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
2. Add a full-address mapping
Edit the source table specified by virtual_alias_maps:
[email protected] [email protected]
[email protected] [email protected]Use one mapping per line. Keep comments on separate lines beginning with #. Avoid hidden characters from copy-and-paste, and check for duplicate keys; with a normal indexed map, the last valid entry that becomes indexed is the one you will effectively query, so duplicate entries are an avoidable source of confusion.
3. Build the indexed database
Editing the text file does not update a hash: or similar indexed database. Run:
postmap /etc/postfix/virtualUse the path after the map type from postconf; do not blindly run this command against a different file. The Postfix virtual-domain instructions require rebuilding the map after changing the virtual table. If the command reports a permission or syntax error, fix that before testing mail.
4. Verify the exact lookup
Query the map with the same full address a sender will use:
postmap -q "[email protected]" hash:/etc/postfix/virtualThe command should print [email protected]. An empty result means Postfix will not find that key in this map. Test case and spelling carefully, and make sure you queried the map type and path that are actually configured.
5. Reload Postfix
postfix check
postfix reloadpostfix check catches basic ownership, permission, and configuration problems. A reload makes configuration changes available without stopping the service. If the reload fails, inspect the service manager output and correct the reported parameter or file before sending a test message.
When a local alias is the better solution
For a local system recipient, edit /etc/aliases rather than creating a virtual-domain rule:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →postmaster: [email protected]
root: [email protected]Rebuild the aliases database:
newaliasesnewaliases normally invokes postalias for the alias database configured on the system. Verify the generated database and then reload Postfix if your distribution requires it for the alias change. A user’s ~/.forward file is another local-delivery mechanism, but it is subject to the user’s home-directory permissions, Postfix’s allow_mail_to_commands/allow_mail_to_files policy, and the delivery agent in use. Do not troubleshoot a virtual-domain address by editing a local user’s .forward file unless that address is genuinely local.
Test forwarding in layers, not by guessing
A single test message can tell you where the failure occurs if you record its queue ID and follow it through each service.
- Check the map first. Run
postmap -qfor the exact recipient. If it returns nothing, stop and fix the key or rebuild the database. - Confirm the domain role. Re-run
postconf virtual_alias_domains mydestination virtual_alias_mapsand ensure the domain is accepted as virtual, not local or an unintended relay destination. - Reload after configuration edits. Use
postfix checkfollowed bypostfix reload. - Send one controlled message. Use a sender and recipient you can identify, and avoid a broad test that could create a forwarding loop or spam remote systems.
- Capture the queue ID. The SMTP acceptance line normally includes an identifier such as
3F12A12345. Search for that identifier rather than scanning unrelated traffic. - Trace the services. Follow entries through
cleanup(message intake),qmgr(queue management),virtual(virtual delivery and alias handling),smtp(outbound SMTP), and, when applicable,bounceorerror. - Check the final status. A
status=sentline means the next SMTP server accepted the message;deferred,bounced, connection errors, and policy responses require a separate remote-delivery diagnosis.
On many Debian-family systems, mail logs are in /var/log/mail.log; on many Red Hat-family systems they are in /var/log/maillog. Systems using systemd may expose the same events with:
journalctl -u postfix --since "10 minutes ago"
postqueue -pThe exact file varies by distribution, but the queue ID and service name are the reliable clues. An empty queue does not prove delivery if the message was rejected before queueing; in that case, inspect the SMTP session log and the sending application’s response.
Recommended Free Tools
Rank #4
Fix “relay access denied” without weakening security
“Relay access denied” commonly means Postfix does not classify the recipient’s domain as a destination it serves, or the client is trying to relay to an external domain without authorization. First determine which case you have.
Inbound mail to your forwarding domain is rejected
If a recipient at example.com receives a relay denial, check that example.com is in virtual_alias_domains and that the map is loaded. A missing domain declaration makes Postfix treat the destination as outside its responsibility. Verify with:
postconf virtual_alias_domains
postmap -q "[email protected]" hash:/etc/postfix/virtualCorrect the declaration, rebuild the map if needed, reload, and repeat the controlled test.
An authenticated or trusted client is trying to send elsewhere
Review smtpd_relay_restrictions, client restrictions, SASL authentication, and trusted networks. Do not resolve the error by adding a broad permit for all clients or all destinations. The Postfix SMTP relay and access-control guidance warns that spammers abuse servers that forward mail from arbitrary systems, and abused systems end up on anti-spammer denylists. Keep relaying limited to your hosted domains, authenticated users, or explicitly trusted networks.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Fix “mail loops back to myself”
This message indicates that Postfix resolved a destination to itself instead of delivering it onward. The first checks are destination classification and DNS:
- Remove the forwarding domain from
mydestinationif it is meant to be virtual. - Ensure the virtual alias points to the intended remote address, not back to the same domain or an address that resolves to this server.
- Inspect MX and A/AAAA records for the destination. A remote address whose MX points back to this host will create a real routing loop.
- Check for aliases that expand recursively between two or more addresses. To intentionally terminate a recursive alias for a specific address, the virtual(5) manual documents aliasing that address to itself; use this only when you understand the resulting local delivery behavior.
After correcting DNS or configuration, rebuild any changed map, reload Postfix, and send a new test message. Old queued mail may retain a previous routing decision, so inspect its log entry and, if appropriate, requeue it with postqueue -f only after the loop is fixed.
Fix unknown-recipient and “alias not found” bounces
An unknown-recipient response before queueing usually means the address does not match a served domain or recipient policy. If the message is accepted and later bounces, the map or downstream destination may be the issue.
- Confirm the exact full-address key, including the domain and any plus-addressing behavior your configuration supports.
- Check whitespace, spelling, and case in the source table.
- Run
postmap -qagainst the configured map, not just the text file. - Run
postmapagain after every edit to an indexed table. - Check whether a restriction or recipient-lookup policy rejects the address before virtual alias expansion.
If the lookup succeeds but the remote address is invalid, the queue and SMTP logs will show the remote server’s response. That is a remote-recipient problem, not evidence that the local alias map failed.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhen Postfix accepts the message but remote delivery fails
Successful alias expansion only proves that Postfix found a destination. The outbound smtp service still has to resolve DNS, connect to the destination MX, complete TLS or policy checks required by that server, and obtain an SMTP acceptance. Distinguish these outcomes in the log:
| Log outcome | Meaning | Next check |
|---|---|---|
status=sent |
The next SMTP server accepted the message | Investigate the recipient’s mailbox, filtering, or downstream routing |
status=deferred |
Temporary failure; Postfix will retry | Read the SMTP response, DNS result, connection timeout, or TLS error |
bounced or a permanent 5xx response |
Delivery was refused permanently | Correct the remote address, sender policy, authentication, or destination policy named in the response |
| No queue ID | The message was rejected before queueing | Inspect the receiving SMTP session and restriction result |
Forwarding can also alter how the final recipient’s system evaluates the sender. SPF, DKIM, DMARC, and Sender Rewriting Scheme behavior depends on your complete mail path and provider policies; there is no single Postfix alias setting that guarantees acceptance by every remote provider. Use the remote server’s documented requirements rather than disabling local relay controls.
Direct forwarding versus a relay host
In direct forwarding, Postfix looks up the recipient’s MX records and connects to the destination itself. With a relay host, Postfix sends onward to a configured smarthost, which may require authentication and may apply its own rewriting and filtering. Choose based on operational control, not on the alias syntax; the virtual alias map still determines the destination address.
| Consideration | Direct delivery | Relay-host delivery |
|---|---|---|
| Destination control | Postfix contacts each recipient domain’s MX | The relay host controls the next hop and may accept only approved senders |
| Sender authentication | Your server must meet each destination’s SMTP, TLS, and reputation requirements | You configure the relay provider’s authentication and sender rules |
| Observability | Logs show DNS, connection, and response details for each destination | Logs show acceptance by the relay; final delivery diagnostics may be available only from that relay |
| Failure ownership | Your Postfix instance handles retries and permanent failures | Failures can occur either between your server and the relay or inside the relay’s network |
Do not treat a relay host as a workaround for an incorrectly declared virtual domain. First make local acceptance and alias expansion correct, then troubleshoot the outbound hop.
Quick Recap
Permissions, map type, and reload pitfalls
- Editing the wrong file:
virtual_alias_mapsmay point to a different path, database, or map type than the file you changed. - Skipping the rebuild: the text table looks correct while the indexed
.dbor LMDB data still contains old entries. - Unreadable database: the Postfix service account must be able to read the generated map and traverse its parent directories. Follow your distribution’s ownership and permission defaults rather than making the files world-writable.
- Syntax errors: run
postfix checkand inspect the service log after reload. - Stale queued messages: a message already in the queue may need requeueing after the configuration is corrected; always inspect its original queue log before forcing retries.
- Duplicate or recursive aliases: remove unintended duplicate keys and ensure every forwarding chain eventually reaches a real local or remote recipient.
Security checklist for a forwarding server
- Serve only domains you intentionally administer.
- Require authentication or use an explicit trusted-network policy for clients relaying to external domains.
- Do not add a catch-all or broad permit rule merely to make one address work.
- Limit forwarding destinations and monitor queue growth, repeated deferred mail, and bounce volume.
- Keep DNS, TLS, and authentication policies aligned with the remote provider’s current requirements.
- Review logs for unexpected senders or destinations; an abused forwarding host can be deny-listed and harm legitimate mail.
A repeatable repair checklist
- Classify the address as local or virtual.
- Inspect
virtual_alias_domains,virtual_alias_maps,mydestination, and relay restrictions withpostconf. - Confirm the table contains the full virtual address and the intended destination.
- Run
postmap(ornewaliasesfor/etc/aliases). - Verify the result with
postmap -qwhere applicable. - Run
postfix checkand reload Postfix. - Send one controlled message and record its queue ID.
- Follow that ID through cleanup, qmgr, virtual, smtp, bounce, and error log entries.
- Correct destination classification or remote SMTP problems without weakening relay restrictions.
- Retest only after the map, configuration, and routing path all show the intended result.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
