Postfix forwarding failures usually come from one of four causes: the address is in the wrong kind of alias map, the indexed map was not rebuilt, the domain has the wrong destination role, or the message is accepted locally but rejected during remote SMTP delivery. Fix the problem in that order: identify whether the recipient is local or virtual, verify the effective configuration, rebuild and query the map, reload Postfix, then trace one test message by its queue ID.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Choose the forwarding mechanism before changing anything
Postfix has two different forwarding models. Use local aliases or a user’s .forward file when the recipient is a local account on this server. Use a virtual alias domain and virtual_alias_maps when Postfix should accept addresses in a hosted domain and redirect them elsewhere. Mixing these models is a common reason for relay errors, unknown-recipient bounces, and self-delivery loops.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Local aliases and forward files
Local forwarding is tied to a local recipient. The lookup key is normally the localpart, such as sales, rather than the complete address [email protected]. The destination is another local account or an address to which the local delivery system hands the message. This is appropriate when the domain is already a local destination and you are forwarding accounts on that machine.
Virtual aliases
Virtual aliasing is address-based. Its lookup key is the full address, including the domain. A typical table entry is:
#1 Best Overall
[email protected] [email protected]The domain must be declared in virtual_alias_domains, and the table must be selected in virtual_alias_maps. Virtual lookups can expand recursively. The Postfix virtual(5) documentation states: “Virtual aliasing is recursive; to terminate recursion for a specific address, alias that address to itself.” Avoid accidental chains unless each hop is intentional.
| Decision point | Local alias or .forward |
Virtual alias |
|---|---|---|
| Recipient scope | Local account on the Postfix host | Address in a declared virtual alias domain |
| Lookup key | Usually the localpart | Full address, such as [email protected] |
| Domain setting | Domain is normally a local destination | Domain belongs in virtual_alias_domains |
| Map setting | Local alias or forward-file configuration | virtual_alias_maps pointing to the selected table type |
| Verification | Check the local alias/forward path | Run postmap, then query the indexed map with postmap -q |
| Expansion | Local delivery rules apply | Aliases may expand recursively |
Inspect the effective configuration
Do not rely on a remembered configuration file or an uncommented example. Ask Postfix what it is actually using:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →postconf -n
postconf virtual_alias_domains
postconf virtual_alias_maps
postconf mydestinationpostconf -n prints non-default settings. The individual queries make it easy to compare the intended forwarding domain and map path with the running configuration. Confirm all of the following before editing a table:
- The forwarding domain appears in
virtual_alias_domainsif it is a virtual alias domain. virtual_alias_mapsnames the map type and exact file path you are editing, for examplehash:/etc/postfix/virtual.- The same domain is not also being treated as a local destination through
mydestination. - The address and destination use the spelling and domain you expect, including subdomains and capitalization conventions used by your organization.
A virtual alias domain must not be listed as a local destination. The Postfix Virtual Domain Hosting Howto gives the emphatic rule: “NEVER list a virtual alias domain name as a mydestination domain!” If both roles are configured, Postfix can attempt local delivery instead of alias expansion, or decide that a message addressed to its own host should be routed back to itself.
Format, rebuild, and query the map
Use the exact table format
For a hash-style virtual table, put one mapping per line, with the full source address followed by whitespace and the destination:
Rank #2
[email protected] [email protected]Do not use only user when the virtual lookup requires [email protected]. Check for hidden characters, misspelled domains, duplicate keys, and a destination that points back to the original address or to an alias chain that eventually does so.
Rebuild the indexed database
Editing the text file does not automatically change the database Postfix reads. After changing the virtual table, run postmap against the configured source file:
postmap /etc/postfix/virtualIf your configuration uses another path or map type, use that exact path and the matching postmap form. A successful command normally creates or refreshes the indexed companion file. Rebuild the map every time you add, remove, or correct an entry.
Verify the key directly
Query the map before sending mail:
postmap -q '[email protected]' hash:/etc/postfix/virtualThe command should print the expected destination. If it prints nothing, Postfix will not find that key in the map you queried. An empty result usually means the full address is wrong, the wrong file or map type was queried, or the database was not rebuilt after the edit.
Reload Postfix and test in layers
- Inspect: Run the
postconfcommands and confirm the domain, map path, and destination roles. - Query: Use
postmap -qwith the exact full address and verify the expected remote recipient. - Reload: Apply configuration changes with
postfix reload. Rebuilding a map and reloading are separate operations: the first updates the lookup database; the second makes configuration changes active. - Send one controlled message: Use a test sender and one forwarding address. Record the message’s queue ID from the sending command or the mail log.
- Trace the queue ID: Search the mail log for that ID through the
cleanup,qmgr,virtual,smtp,bounce, anderrorservices. Linux distributions commonly write to/var/log/maillogor/var/log/mail.log; use the file configured by your logging system. - Classify the result: Separate acceptance by Postfix, alias expansion, queueing, and remote SMTP delivery. A message can pass the first three stages and still fail when the remote server rejects or defers it.
postqueue -p shows queued mail. A queue entry with a remote destination and repeated deferrals points to delivery rather than alias lookup. A bounce or an error-service line usually contains the reason Postfix stopped processing. The virtual delivery-agent documentation describes the status information exposed by these delivery paths; use the queue ID to keep one test message distinct from unrelated traffic.
Fix “relay access denied”
“Relay access denied” is a policy or destination-classification problem, not a reason to open the server to everyone. Check these causes in order:
The destination domain is not declared correctly
If Postfix is supposed to accept and forward mail for example.com, make sure that domain is present in virtual_alias_domains and that the corresponding map is active. If it is absent, Postfix may treat the message as an attempt to relay to an arbitrary outside domain.
The client is not authorized to relay
Inspect the active relay restrictions in postconf -n. A sender connecting from an untrusted network should not be allowed to relay merely because forwarding is enabled for one hosted domain. Correct the destination classification or authenticate the legitimate client according to your existing policy; do not solve the error by broadly permitting unauthenticated relaying.
The domain is classified as local in one place and virtual in another
Remove the virtual alias domain from mydestination, rebuild the map if necessary, reload Postfix, and repeat the controlled test. Keep the domain in one intended role so Postfix can make a deterministic routing decision.
Postfix’s relay-control guidance warns that spammers abuse servers that forward mail from arbitrary systems and that abused systems end up on anti-spammer denylists. Relay restrictions are therefore part of the fix, not an optional hardening step.
Rank #4
Fix “mail loops back to myself”
Check destination roles first
The most common configuration error is listing a virtual alias domain in mydestination. Postfix recognizes the domain as local, attempts delivery to itself, and reports that the mail loops back. Compare virtual_alias_domains and mydestination; a forwarding domain should be in the former and not the latter.
Check DNS and the host’s identity
Confirm that the domain’s DNS records intentionally point to this server and that the server’s configured host and destination names are correct. If DNS sends the message to this host while Postfix’s destination settings say the address is local, the same symptom can appear even when the alias line is correct.
Check recursive aliases
Follow every hop in the alias chain. A mapping that ultimately points back to the original address creates recursion. Break the cycle by correcting the destination; if recursion is deliberately used for a particular address, the virtual(5) rule allows termination by aliasing that address to itself. Do not use self-aliasing as a guess for an otherwise unexplained loop.
Free tools Windows power users keep installed
One-click scans. No signup required.
Fix unknown-recipient bounces
An unknown-recipient response normally means the lookup did not return a destination for the exact address presented to Postfix. Verify the complete key, including the domain:
- Read the recipient address from the bounce or log, rather than retyping it from memory.
- Check that the line in the text table uses that exact full address.
- Run
postmap /etc/postfix/virtual(or your configured path). - Run
postmap -q 'exact-address' hash:/etc/postfix/virtualand confirm a non-empty result. - Reload Postfix and send a new test message; do not assume an old queued message reflects the corrected map.
Also check for a domain mismatch such as [email protected] versus [email protected]. Virtual alias lookups are address-specific; a visually similar address is a different key.
When alias expansion works but remote delivery fails
A successful map query proves only that Postfix can translate the source address. It does not prove that the destination server will accept the message. Use the queue ID and logs to distinguish these stages:
| Log evidence | What it establishes | Next action |
|---|---|---|
cleanup and qmgr entries |
Postfix accepted and queued the message | Continue tracing the same queue ID |
virtual expansion or delivery entry |
The alias path was selected and a destination was produced | Inspect the next delivery service |
smtp connection, defer, or reject |
The remote SMTP transaction determined the outcome | Read the remote response and correct DNS, policy, authentication, or recipient issues as indicated |
bounce or error |
Postfix generated a failure or could not complete delivery | Use the diagnostic text; do not change alias syntax without evidence of a lookup failure |
Forwarding can also change how sender authentication is evaluated. The available configuration guidance does not establish one universal SPF, DKIM, DMARC, or SRS recipe for every receiving provider. Treat those controls as a separate remote-delivery question and follow the current documentation for the provider receiving the forwarded mail. Do not claim that a successful local alias lookup guarantees authentication alignment.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsDirect forwarding versus a relay host
Most virtual aliases deliver directly to the destination domain through the normal SMTP transport. Some organizations instead route outbound mail through a relay host. These are different operational choices:
| Axis | Direct forwarding | Relay-host delivery |
|---|---|---|
| Destination control | Postfix looks up the recipient domain’s SMTP destination | A configured relay handles the next hop for the forwarded message |
| Sender authentication behavior | The receiving domain evaluates the message from this server’s connection and headers | The relay’s policy and identity affect the outbound transaction |
| Observability | Follow the queue ID through Postfix’s smtp service to the destination |
Follow Postfix to the relay, then use the relay’s delivery status for the final hop |
| Typical failure boundary | DNS, remote recipient policy, or direct SMTP rejection | Relay authentication, relay policy, or a later rejection by the final provider |
Choose one path deliberately. Changing to a relay host can move the failure elsewhere without fixing a missing alias, incorrect domain role, or stale map.
Security checks after forwarding works
- Keep relay restrictions enabled and permit relaying only for authenticated or explicitly trusted clients.
- Publish only the forwarding domains and recipients you intend to host.
- Review aliases for open-ended destinations that could be edited by untrusted users.
- Monitor queue growth and repeated remote deferrals; sudden volume can indicate abuse or a forwarding loop.
- Retest after every change to
virtual_alias_domains,virtual_alias_maps,mydestination, relay restrictions, or the map file.
Forwarding servers are attractive to spammers when they accept mail from arbitrary systems and send it onward. Restricting relay access protects both delivery reputation and the availability of the forwarding service.
Quick Recap
A compact recovery runbook
- Write down the exact envelope recipient that failed and obtain its queue ID if a message was accepted.
- Run
postconf -n,postconf virtual_alias_domains,postconf virtual_alias_maps, andpostconf mydestination. - Decide whether the address belongs to local aliasing or virtual aliasing; do not troubleshoot it as both.
- For a virtual alias, confirm a line such as
[email protected] [email protected]in the configured table. - Rebuild the database with
postmapand verify the exact key withpostmap -q. - Ensure the virtual alias domain is not in
mydestination, then runpostfix reload. - Send one controlled test and trace its queue ID through cleanup, qmgr, virtual, smtp, bounce, and error log entries.
- If the message is rejected before queueing, fix classification or relay authorization. If it is queued and later rejected, fix the remote SMTP or relay-host issue shown in the log.
- After recovery, leave relay restrictions in place and watch for loops, queue growth, and unexpected forwarding volume.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
