External emails are rejected while outgoing mail works because the server's configuration likely restricts incoming connections to localhost or misconfigures relay access. This usually stems from incorrect inet_interfaces settings in Postfix or missing entries in smtpd_recipient_restrictions. Correcting these parameters restores full two-way email functionality for your Debian server.
Diagnosing Incoming vs Outgoing Behavior
The symptom of sending successfully but failing to receive is a classic indicator of a binding or restriction issue. When you send an email, Postfix acts as a Mail Transfer Agent (MTA) connecting to remote servers on port 25. However, when receiving, it must act as a Mail Delivery Agent (MDA) listening on its own interface. If the listener is bound only to 127.0.0.1, external clients cannot reach it, yet local processes can still push mail out.
This behavior often occurs after a fresh installation or a major update where default security settings take precedence over usability. It is crucial to verify that the service is not running as an open relay, which would allow anyone to send mail through your server. The goal is to accept mail for your specific domains from any IP address while restricting relaying to authenticated users or trusted networks.
Checking Postfix Network Bindings
The most common culprit is the inet_interfaces parameter in /etc/postfix/main.cf. By default, some configurations set this to loopback-only to prevent accidental exposure. To fix this, you must change the setting to all or specify the public IP address of your server. This allows Postfix to listen on all network interfaces, making it accessible to the internet.
inet_interfaces = allAfter modifying this file, restart the Postfix service using systemctl restart postfix. You can verify the change by running netstat -tlnp | grep :25 or ss -tlnp | grep :25 to ensure the process is listening on 0.0.0.0:25 rather than just 127.0.0.1:25.
Configuring Relay Restrictions
Even if the network binding is correct, Postfix may reject incoming mail due to strict relay restrictions. The smtpd_recipient_restrictions directive controls who can send mail to your server. A typical secure configuration includes checks for valid recipient domains and authentication status.
Ensure that your main.cf contains the following lines to properly handle incoming connections:
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destinationThe reject_unauth_destination option is critical. It tells Postfix to reject mail for domains that are not listed in mydestination or virtual mailbox domains, unless the sender is authenticated or from a trusted network. Without this, Postfix might treat all incoming mail as unauthorized relay attempts.
For more details on how Postfix handles lookup tables and restrictions, see Understanding Postfix Lookup Table in Tech Support. This resource explains how mydestination interacts with other parameters to determine domain ownership.
Verifying Domain Configuration
Your server must explicitly know which domains it is responsible for. Check the mydestination parameter in /etc/postfix/main.cf. This should include your primary hostname and any domain names you wish to receive mail for.
mydestination = $myhostname, localhost.$mydomain, localhost, example.com, www.example.comIf you are hosting multiple domains, ensure they are all listed here or defined in virtual_mailbox_domains if you are using virtual hosting. Failure to list a domain here will cause Postfix to reject mail for that domain with a "User unknown" or "Relay access denied" error.
Dovecot Integration and Authentication
While Postfix handles delivery, Dovecot manages user authentication and mail storage. If authentication is misconfigured, Postfix cannot verify users via SASL, leading to rejection of incoming mail from authenticated users.
Check the /etc/dovecot/conf.d/10-auth.conf file to ensure that login mechanisms are enabled. Typically, auth_mechanisms = plain login is required for standard email clients. Additionally, verify that the /etc/postfix/master.cf file has the submission service configured correctly for authenticated users.
If you are experiencing broader email issues, consider reviewing Troubleshooting Email Issues with Local Postfix Email Server Setup for additional diagnostic steps related to local delivery failures.
Testing the Configuration
After making changes, test your setup using telnet localhost 25 or nc -vz yourserver.com 25 from an external machine. Attempt to send a test email to a local user. If the connection succeeds but the mail is rejected, check the Postfix logs in /var/log/mail.log for specific rejection reasons.
Common log messages include "Client host rejected: accessing server using 127.0.0.1" which indicates a loopback issue, or "Relay access denied" which points to smtpd_recipient_restrictions. Addressing these specific errors will resolve the discrepancy between outgoing and incoming mail capabilities.
Frequently Asked Questions
Why does my server accept outgoing mail but reject incoming?
This happens when Postfix is bound only to the loopback interface (127.0.0.1) instead of all interfaces. External servers cannot connect to a locally bound service, so incoming connections fail while outgoing ones succeed since they originate from the server itself.
How do I check if my server is an open relay?
You can test for open relaying by attempting to send mail to a non-existent address at a different domain using a tool like swaks or telnet. If the server accepts the mail without requiring authentication for a foreign domain, it is an open relay and needs stricter smtpd_recipient_restrictions.
What is the role of smtpd_recipient_restrictions?
This parameter defines the rules Postfix uses to decide whether to accept or reject a recipient during the SMTP transaction. It typically includes checks for trusted networks, authenticated users, and valid destination domains to prevent spam and unauthorized relaying.
Can SpamAssassin cause incoming mail rejection?
SpamAssassin itself does not reject mail at the SMTP level; it scores messages after acceptance. However, if Postfix is configured to use SpamAssassin via a content filter and the filter fails or times out, it can cause delivery delays or rejections. Ensure your content filter is running and responsive.
How do I verify my mydestination settings?
Run postconf mydestination to view the current list of domains. Ensure your primary domain and any aliases are included. If a domain is missing, Postfix will treat incoming mail for that domain as unauthorized relay traffic and reject it.