If things are working locally but not though your gateway, you should probably have a look at your gateway to make sure that ports are forwarded correctly and that firewall rules are created.

As I get no Logs from dovecot I changed

#syslog_facility = mail

in /etc/dovecot/dovecot.conf to

log_path = /var/log/dovecot.log
info_log_path = /var/log/dovecot.info.log

Cause can’t get logging via Kmail on my OpenSuse. The Log shows me that I have to use the full EMail as username.
So all went good.

By the way your Howto is the first that works after five days and many trys from other Writers. Very thanks at all!

SSL is working local and through gateway. (shows TLS at the end of the log entry).

TLS setting isn’t (local or Gateway). Timeouts with (no auth attempts). and shows no TLS on the end of the lgo timeout (probably as it never attenpted anything).

IMAP isn’t working on either.

I can login locally using SSL. TLS fails even locally.
SSL nor TLS will work through my Gateway.
I’m guessing SSL works locally as it’s in the trusted IP’s.

I’ve no idea why I can’t run SSL through the gateway though.

I have all ports open for testing so getting to the PC is no problem.
I can access emails without SSL/TLS, but once I enable TLS I get (auth failed).

imap-login: Aborted login (auth failed, 2 attempts): user=, method=PLAIN, rip=77.99.14.225, lip=192.168.0.12, TLS

I followed your howto precisely for enabling SSL/TLS. Here are the relevant sections of my conf.

protocols = imap pop3 imaps pop3s
listen = *
ssl_listen = *
disable_plaintext_auth = no
ssl = yes
ssl_cert_file = /etc/ssl/mydomain/mail-cert.pem
ssl_key_file = /etc/ssl/mydomain/mail-key.pem
ssl_parameters_regenerate = 168
verbose_ssl = no

Any ideas?

I installed postfix and dovecot with mysql as described in this tutorial. I would like to have multiple domains on one server and it works somehow, when it comes to POP/SMTP auth etc.

Which means: I receive emails from external mailservers for my virtual domains and I can also send emails to external servers, but not to everyone…

..cause some external address or freemailer say: server xyz [1.2.3.4] refused to talk to me: 554….554 Your access to this mail system has been rejected due to sending MTA’s poor reputation.

What’s wrong? Here’s my configuration:

/etc/postfix/main.cf:

biff = no
append_dot_mydomain = no

myhostname = mail.mydomain.com
mydomain = domain.com
myorigin = /etc/mailname
mydestination = localhost
mynetworks = 127.0.0.0/8
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)

virtual_transport = dovecot
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_base = /var/vmail
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql_virtual_alias_maps.cf
virtual_minimum_uid = 150
virtual_uid_maps = static:150
virtual_gid_maps = static:8
dovecot_destination_recipient_limit = 1

smtpd_helo_required = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_exceptions_networks = $mynetworks
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, check_relay_domains, reject_unauth_destination

/etc/postfix/master.cf:

#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: “man 5 master”).
#
# Do not forget to execute “postfix reload” after editing this file.
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n – – – – smtpd
#submission inet n – – – – smtpd
# -o smtpd_tls_security_level=encrypt
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#smtps inet n – – – – smtpd
# -o smtpd_tls_wrappermode=yes
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#628 inet n – – – – qmqpd
pickup fifo n – – 60 1 pickup
cleanup unix n – – – 0 cleanup
qmgr fifo n – n 300 1 qmgr
#qmgr fifo n – – 300 1 oqmgr
tlsmgr unix – – – 1000? 1 tlsmgr
rewrite unix – – – – – trivial-rewrite
bounce unix – – – – 0 bounce
defer unix – – – – 0 bounce
trace unix – – – – 0 bounce
verify unix – – – – 1 verify
flush unix n – – 1000? 0 flush
proxymap unix – – n – – proxymap
proxywrite unix – – n – 1 proxymap
smtp unix – – – – – smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay unix – – – – – smtp
-o smtp_fallback_relay=
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n – – – – showq
error unix – – – – – error
retry unix – – – – – error
discard unix – – – – – discard
local unix – n n – – local
virtual unix – n n – – virtual
lmtp unix – – – – – lmtp
anvil unix – – – – 1 anvil
scache unix – – – – 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop unix – n n – – pipe
flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
#
# See the Postfix UUCP_README file for configuration details.
#
uucp unix – n n – – pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender – $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail unix – n n – – pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix – n n – – pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix – n n – – pipe
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
${nexthop} ${user}
dovecot unix – n n - - pipe
flags=DRhu user=vmail:mail argv=/usr/lib/dovecot/deliver -f ${sender} -d $(recipient)

mysql_virtual_alias_maps.cf, mysql_virtual_domains_maps.cf, mysql_virtual_mailbox_limit_maps.cf, mysql_virtual_mailbox_maps.cf are excactly as described in this tutorial.

I also added a reverse DNS for the domain mail.mydomain.com. Any advice?