Mail "access denied" error after update to 1.7

Bug
1

Is there an ETA for this fix?

Wait, maybe I’m having a different issue after upgrading to 1.7.0 this morning.

All external email is currently being rejected at our server.

554 5.7.1 : Recipient address rejected: access denied
Relay error after update mail node to 1.7.0
2

No, sorry.
In the meanwhile you could revert to the working 1.6.4:

EDIT:

Are you using user forwards? Are you using relay rules?

3

No relay rules. No forward rules defined in the Mailboxes setttings.

4

I had already updated to Version 1.7.1-dev.2 (didn’t fix the issue). Reverting via the provided command does not resolve the issue. All email from external servers is being rejected.

554 5.7.1 : Recipient address rejected: access denied

From mail1 log:
2025-07-10T14:24:03-05:00 [1:mail1:postfix/smtpd] NOQUEUE: reject: RCPT from mail-oo1-f41.google.com[209.85.161.41]: 554 5.7.1 <charlies@poliac.com>: Recipient address rejected: access denied; from=<csteaderman@gmail.com> to=<charlies@poliac.com> proto=ESMTP helo=<mail-oo1-f41.google.com>

5

Is there a formal method to completely revert to the previous version of the Mail App?

6

It could be another issue, I checked your domain and there was no DNS or MX records found, see Network Tools: DNS,IP,Email

7

Wrong domain. You checked pollac.com, should be poliac.com.

1 Like
8

Checking my logs, this problem started right after I upgraded to 1.7.0 this morning.

9

I’m going to test reverting…

Are you using the same name for your LDAP or AD domain?

10

Yes. I have two entries in Domains and Users. One is the internal AD domain name (burnsville.local) and the other is the public name (poliac.com). Both point to the same AD.

11

I checked reverting as explained above and it worked on my side.

Could you please check the running mail containers:

runagent -m mail1 podman ps
12 
CONTAINER ID  IMAGE                                        COMMAND     CREATED         STATUS         PORTS       NAMES
7f9f02cd64b4  ghcr.io/nethserver/mail-clamav:1.7.1-dev.2               42 minutes ago  Up 42 minutes              clamav
fe6594083c67  ghcr.io/nethserver/mail-rspamd:1.7.1-dev.2               42 minutes ago  Up 42 minutes              rspamd
eaf1466babb7  ghcr.io/nethserver/mail-postfix:1.7.1-dev.2              42 minutes ago  Up 42 minutes              postfix
7dbf05460f79  ghcr.io/nethserver/mail-dovecot:1.7.1-dev.2              42 minutes ago  Up 41 minutes              dovecot
13

It seems reverting didn’t work on your side as the postfix container still uses 1.7.1-dev.2

Enter the app environment:

runagent -m mail1

Change the postfix version:

sed -i 's|^MAIL_POSTFIX_IMAGE=.*$|MAIL_POSTFIX_IMAGE=ghcr.io/nethserver/mail-postfix:1.6.4|' environment

Your could also edit the environment file manually:

vi environment

There should be a line like this in the environment file:

MAIL_POSTFIX_IMAGE=ghcr.io/nethserver/mail-postfix:1.6.4

Restart postfix:

systemctl --user restart postfix

Check containers: (there should be postfix 1.6.4)

podman ps

Exit app environment

exit
1 Like
14

That worked. Not sure what I missed when I thought I reverted previously, but we are back in business. Thanks for your support.

2 Likes
15

Please, share (or send me in PM) the output of this command:

api-cli run module/mail1/list-domains | jq

It can help us to reproduce your issue.

1 Like
16 
[
  {
    "domain": "burnsville.local",
    "addusers": true,
    "addgroups": false,
    "catchall": null,
    "bccaddr": null,
    "description": ""
  },
  {
    "domain": "poliac.com",
    "addusers": false,
    "addgroups": false,
    "catchall": null,
    "bccaddr": null,
    "description": ""
  }
]
2 Likes
17

Is “charlies” defined in the Addresses page? What are its destinations?

Did you change addusers flags recently?

18

I think I could reproduce the issue.

When

  • User domain is the same as the mail domain
  • Addusers is NOT set for the mail domain
  • An alias address is created for the mail domain (I tried internal samba user destination and external destination)

then the mail is rejected:

2025-07-11T09:47:34+02:00 [1:mail1:postfix/smtpd] NOQUEUE: reject: RCPT from mail-ed1-f43.google.com[209.85.208.43]: 554 5.7.1 <markus@ad.domain.tld>: Recipient address rejected: access denied;

If addusers is enabled it’s working but without addusers and an alias address it doesn’t work when the user domain is the same as the mail domain.

1 Like
19

Ok good news :grimacing:

Could you split this thread and file the bug, please?

No, sorry, it’s not for now, we’ll address it in 2/4 weeks. Meanwhile version 1.7+ remains quarantined.

1 Like
20

Is “charlies” defined in the Addresses page? What are its destinations?

image
image1546×120 13.4 KB

Did you change addusers flags recently?

Since I didn’t know that there was an addusers flag, I didn’t make a change on purpose.

2 Likes