Postfix can send mail while receiving is completely broken because outbound delivery and inbound delivery use different paths. Outbound messages leave through your configured relay or remote MX. Incoming messages require the recipient domain’s MX record to point to this server, Internet traffic to reach TCP port 25, Postfix’s smtpd service to listen on a public or forwarded address, and a valid local or virtual destination with a working mailbox.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Find the first failed layer—DNS, network, listener, recipient policy, or mailbox delivery—before changing configuration. The workflow below uses the SMTP response and Postfix logs to identify the failure without turning the server into an open relay.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →First, identify what this Postfix server is supposed to receive
A server configured only as an outbound relay or authenticated submission client is not expected to accept mail directly from the Internet. In that design, another host is the final MX and this machine sends through a relayhost. A receiving failure is therefore a design mismatch, not necessarily a Postfix fault.
| Architecture | Inbound behavior | Settings and network requirements |
|---|---|---|
| Final MX | Remote senders connect directly to this host and it delivers to local or virtual mailboxes. | Public MX target, reachable TCP 25, listener on the reachable address, destination maps, and delivery service. |
| Backup MX | This host accepts mail when the primary MX is unavailable, then forwards or delivers it according to policy. | Its MX priority, permitted relay destinations, queue lifetime, and forwarding route must be intentional. |
| Outbound relay or smarthost | It submits or relays mail elsewhere; it does not accept arbitrary Internet mail for your domain. | A relayhost or authenticated submission service is expected. Public inbound TCP 25 may be unnecessary. |
| Submission-only client | Users submit mail on authenticated ports, normally 465 or 587; server-to-server receiving is not provided. | Authentication, TLS, and submission service configuration matter, not MX delivery to this host. |
Confirm the intended role with whoever manages DNS and the mail topology. Do not make an outbound relay a public MX merely because it can send.
#1 Best Overall
Read the SMTP symptom before editing Postfix
Send a test message from an unrelated provider while watching the server. The remote sender’s result tells you which layer to investigate.
| Observed result | Most likely layer | What to check next |
|---|---|---|
| No connection attempt appears in the Postfix log | DNS, routing, firewall, provider block, or wrong MX | MX, A/AAAA records, public address, NAT, security group, and TCP 25 from outside your network. |
| Connection times out | Packets are being dropped | Cloud or ISP port-25 policy, perimeter firewall, security group, NAT rule, routing, or an unavailable proxy. |
| Connection is refused immediately | No service is listening on that address and port, or an active device is rejecting it | ss output, inet_interfaces, master.cf, and any front-end firewall or proxy. |
| SMTP 4xx response or queue defer | Temporary policy, resource, or downstream problem | The exact enhanced status, queue ID, destination response, disk space, rate limits, and retry schedule. |
SMTP 5xx or NOQUEUE: reject |
Permanent policy, invalid recipient, or destination mismatch | Recipient restrictions, relay policy, destination maps, aliases, and the rejected address. |
| Message is accepted and locally handed off but is absent from the mailbox | Delivery agent, alias, quota, filtering, or mailbox storage | Local-delivery logs, virtual transport, mailbox permissions, quota, and filtering rules. |
Keep the queue ID and complete SMTP response. A generic “sent successfully” message in the sender’s interface only proves that the sender handed the message to some SMTP server; it does not prove delivery to your mailbox.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems1. Verify the domain’s MX and address records
Remote senders first query the recipient domain’s MX record. The selected MX hostname must resolve to the public address that ultimately forwards TCP 25 to this Postfix host. An MX record pointing to an old server, private address, submission endpoint, or a hostname without an address record sends mail somewhere else.
- Query the MX record from a resolver outside the server’s network:
dig MX example.com - Query every MX target’s address records:
dig A mx.example.comdig AAAA mx.example.com - Compare the returned public address with the address on your firewall, NAT gateway, load balancer, or mail proxy.
- If both A and AAAA records exist, test IPv4 and IPv6 separately. A broken IPv6 route can make some senders fail even when IPv4 works.
Use the domain’s actual MX target, not necessarily the web-server hostname. An MX target should resolve directly or through the documented proxy path to a mail service. Do not point an MX record at a CNAME where your DNS provider or receiving software does not support that arrangement.
DNS changes are cached according to their TTL. After correcting a record, continue testing from more than one external resolver; different senders may use cached answers for a while.
2. Test inbound TCP 25 from outside the LAN
Server-to-server SMTP delivery uses TCP 25. Authenticated submission on 465 or 587 is a different service and does not make an Internet MX reachable.
- From a host on a separate network—such as a different VPS, office, or mobile connection—test the MX hostname:
nc -vz mx.example.com 25 - If the test reports a timeout, inspect the provider’s port policy, cloud security group, host firewall, NAT forwarding, and routing. A silent drop usually means a firewall or upstream block.
- If it reports an immediate refusal, continue to the listener checks below. A host can be reachable while no SMTP process is bound to port 25.
- If the TCP connection succeeds, issue an SMTP greeting test with a tool appropriate for your environment and record the banner and response codes. Do not send test messages to arbitrary recipients.
Check both the public firewall and the operating-system firewall. A rule allowing port 25 from the local subnet does not permit Internet delivery. If a proxy or load balancer terminates the connection, its listener and backend health check must also forward SMTP traffic to Postfix.
Rank #2
3. Confirm Postfix listens on the externally reachable address
The inet_interfaces parameter defines every local network address on which Postfix listens. If it is set to loopback-only, or only to a private interface that is not the NAT destination, outside senders cannot connect. The proxy_interfaces setting is relevant when Postfix receives mail through a proxy or NAT arrangement and must recognize the forwarded address.
Inspect the effective configuration rather than relying on comments in main.cf:
postconf inet_interfaces proxy_interfacesss -ltnp | grep ':25'
The socket listing should show Postfix’s SMTP service bound to the address that receives forwarded traffic, or to all appropriate addresses. A listener on 127.0.0.1:25 cannot accept direct Internet connections.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check the SMTP service definition in master.cf. The standard smtp inet n - y - - smtpd service must not be disabled or replaced with a listener on a different port unless your proxy is deliberately translating it.
After changing inet_interfaces, Postfix documentation requires a stop/start rather than assuming a reload is sufficient. Use your distribution’s service manager, then verify the socket again:
systemctl restart postfix
ss -ltnp | grep ':25'For settings that support a reload, prefer a reload when appropriate, but always confirm the effective value and the actual listening socket after the operation.
4. Make sure Postfix considers the recipient domain local
A reachable SMTP listener can still reject a recipient if the domain is not configured as a destination. Postfix accepts mail for local destinations that match its interface or proxy addresses, mydestination, virtual_alias_domains, or virtual_mailbox_domains. The exact map depends on whether you use system accounts, aliases, or virtual mailboxes.
Recommended Free Tools
System-user or local delivery
For local UNIX-account delivery, the domain normally appears in mydestination, and the recipient must map to a local account or alias. Inspect the value with:
postconf mydestinationEnsure the hostname users actually receive mail for is present, including any canonical mail domain you intend to accept. Adding every domain to mydestination without understanding local delivery can place mail in the wrong account or create an unintended relay path.
Virtual aliases
With virtual aliases, the domain belongs in virtual_alias_domains and each accepted address must resolve in the configured alias map. Verify the map source and rebuild any database file required by your distribution before testing.
Virtual mailboxes
With virtual mailbox delivery, the domain belongs in virtual_mailbox_domains, and the recipient must exist in the virtual mailbox map used by the transport. Check the mailbox path, ownership, permissions, quota, and the virtual delivery service.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Inspect all three destination parameters together:
postconf mydestination virtual_alias_domains virtual_mailbox_domainsA domain should normally be represented by the one delivery model you designed, not accidentally by several models with conflicting maps.
5. Check recipient restrictions without creating an open relay
Postfix must distinguish mail addressed to your destinations from mail that should be relayed elsewhere. The relevant restriction list must contain a rejecting control such as reject or reject_unauth_destination. Postfix states:
“Either the smtpd_relay_restrictions or the smtpd_recipient_restrictions parameter must specify at least one of the following restrictions. Otherwise Postfix will refuse to receive mail: reject, reject_unauth_destination.”
Rank #4
Inspect modern and older configurations:
postconf smtpd_relay_restrictions smtpd_recipient_restrictionsKeep permit_mynetworks and permit_sasl_authenticated where your design needs trusted hosts or authenticated users, followed by a safe unauthenticated-destination rejection. Do not replace the list with permit or remove the rejection simply to make one test message pass. An unrestricted server can become an open relay, allowing strangers to send through your host and quickly damaging its reputation.
A rejection for a recipient in your own domain usually indicates a destination-map problem, typo, or policy rule. A rejection for an unrelated domain may be the correct anti-relay behavior.
6. Use logs to locate the exact handoff that failed
Watch the log while sending one test message from an unrelated account. Distribution-specific log paths vary; systemd-based systems commonly expose the service log through:
journalctl -u postfix --since '15 minutes ago'You can also inspect the mail log used by your operating system. Search for the sender, recipient, timestamp, and queue ID. Interpret the sequence, not just the final line:
- No Postfix connection entry means the SMTP session never reached this service. Return to DNS, TCP 25, NAT, firewall, or provider checks.
NOQUEUE: rejectmeans the message was rejected before queueing. Read the response text to distinguish relay restriction, invalid recipient, policy, or malformed command.- A queue ID followed by
status=deferredmeans Postfix accepted the message but could not complete a later delivery attempt. The destination response and retry reason determine the fix. - A queue ID followed by local-delivery success, followed by no visible message, moves the investigation to aliases, the delivery agent, mailbox permissions, quota, or filtering.
Do not delete the queue or repeatedly resend while diagnosing. Repeated tests can obscure the original queue ID and trigger rate limits. Save one complete transaction, including SMTP status codes, before making a change.
7. Check provider, cloud, and perimeter policies
Mail hosting providers, VPS platforms, residential connections, and corporate networks may block TCP 25 or require an approval process. Some environments provide a public address but block unsolicited inbound traffic by default. Others place a mail proxy in front of the instance.
- Confirm that inbound TCP 25 is permitted by the provider and cloud security group.
- Allow TCP 25 through the host firewall and any external firewall appliance.
- For NAT, forward public TCP 25 to the private address where Postfix listens.
- For a proxy, configure the backend target, health check, timeout, and source-address handling; set
proxy_interfacesonly when it matches that architecture. - Check reverse DNS and provider mail policies. Reverse DNS does not make a closed port reachable, but some providers require it before enabling mail service.
Do not confuse an outbound port-25 block with an inbound block. A server may be unable to deliver directly yet still receive mail, or it may send through a relay while its inbound port is closed.
Configuration commands to collect before changing anything
Capture the effective configuration and listener state so you can compare before and after values:
postconf -n
postconf inet_interfaces proxy_interfaces mydestination virtual_alias_domains virtual_mailbox_domains smtpd_relay_restrictions
ss -ltnp | grep ':25'
journalctl -u postfix --since '15 minutes ago'postconf -n omits defaults, so a missing parameter there does not necessarily mean it is unset. Use postconf parameter_name for the effective value. Keep a backup of configuration files and change one layer at a time: DNS, firewall, listener, destination map, then mailbox delivery.
Common failure patterns and their fixes
MX points to a private or obsolete address
Symptoms include no connection in the current server’s log and remote senders reporting timeouts or delivery to an old host. Correct the MX target and its A/AAAA records, then verify the public address and NAT path.
Postfix listens only on loopback
A local test may work while every external connection is refused. Set inet_interfaces to the intended local addresses, restart Postfix as required, and confirm with ss.
Port 25 is filtered upstream
Repeated external tests time out even though Postfix is listening locally. Open the provider security rule and perimeter firewall, or arrange an approved mail service. A submission port cannot substitute for an MX listener.
Domain is missing from destination maps
The SMTP banner appears, but the recipient receives a 550-style rejection or a NOQUEUE entry. Add the domain to the correct local or virtual destination configuration and ensure the recipient map contains the address.
Free tools Windows power users keep installed
One-click scans. No signup required.
Restrictions were changed to solve a rejection
Mail may begin arriving, but unrelated domains can also relay through the host. Restore a restriction list containing reject_unauth_destination (or an equivalent safe reject), retain only intended trusted-user exceptions, and test both an owned recipient and an unrelated recipient.
Local delivery succeeds but the mailbox is empty
The SMTP and queue logs show success, so inspect the delivery transport, alias expansion, mailbox path, permissions, quota, and filtering layer. The problem is no longer Internet reachability.
Final verification sequence
- Confirm the architecture: final MX, backup MX, relay, or submission-only.
- Query MX, A, and AAAA records from an external resolver and verify the selected public address.
- Test TCP 25 from outside the LAN, including both address families when applicable.
- Verify the Postfix socket,
inet_interfaces,proxy_interfaces, and themaster.cfSMTP service. - Confirm the recipient domain and address exist in the intended local, alias, or virtual mailbox maps.
- Review relay restrictions and preserve an unauthenticated-destination rejection.
- Send one controlled test message while recording the SMTP response, queue ID, and log sequence.
- Verify mailbox appearance and then test an unrelated recipient to ensure the server is not an open relay.
Receiving is fixed only when the complete path works: the sender discovers the right MX, reaches TCP 25, receives a Postfix greeting, is allowed to address a valid destination, and the delivery service writes the message to the intended mailbox.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
