Free tools Windows power users keep installed
One-click scans. No signup required.
Postfix rarely fails for one single reason. A message may be accepted by the local server, assigned a queue ID, and then remain deferred because DNS, the network path, TLS validation, a remote server, or your VPS provider prevented the next delivery step. Start with that queue ID and the exact SMTP response in the mail logs; do not troubleshoot from the symptom alone. The runbook below shows how to isolate the failing stage, correct relay and port settings safely, and verify delivery without mistaking local acceptance for inbox placement.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What “not sending” means in Postfix
Postfix has separate stages for accepting a message, queuing it, connecting to a destination, and completing an SMTP transaction. A successful local submission proves only that the local Postfix process accepted the message. It does not prove that the recipient’s server accepted it or that the message reached the inbox.
As an Amazon Associate I earn from qualifying purchases.
When a destination, network path, TLS check, or remote policy returns a temporary failure, Postfix normally keeps the message in its queue and retries. A permanent rejection produces a bounce instead. The queue state and the SMTP status line tell you which stage failed.
- Active: Postfix is currently processing the message.
- Deferred: delivery failed temporarily; the message remains queued for another attempt.
- Bounced: delivery was rejected permanently and a non-delivery notice is generated.
- Delivered: the remote SMTP transaction completed successfully for that recipient.
Do not delete a deferred message before recording its queue ID and reason. That evidence is usually more useful than any change to main.cf.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Start with a queue ID and the exact error
Use a single test message with a distinctive subject, then trace the resulting queue ID. A command-line submission can look like this (replace the recipient with a mailbox you control):
printf 'Subject: VPS Postfix trace testnnTesting queue and SMTP logging.n' | sendmail -v [email protected]The command returning without an error means the local submission was accepted; it is not a delivery receipt. Copy the queue ID from the log and use it for every subsequent check.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A queue ID lets you connect the submission event, each delivery attempt, and the final status. Without it, lines from several recipients can look like one incident, especially on a busy VPS. Record the recipient domain, timestamp, sender, and exact response text alongside the ID.
Diagnostic runbook
1. Confirm that the Postfix service is running
Check the service before changing delivery policy:
systemctl status postfixIf the service is stopped or repeatedly restarting, inspect the service output and configuration errors first. A port, DNS, or relay problem cannot be fixed while Postfix itself is down. After a configuration change, reload rather than restarting unnecessarily:
systemctl reload postfixA running service is only the first checkpoint. Continue with a new test message after every material change so that the resulting log entry clearly belongs to the current configuration.
2. Follow the mail logs while reproducing the failure
Ubuntu documents /var/log/mail.log as the main Postfix log, with errors and warnings also appearing in /var/log/mail.err and /var/log/mail.warn. Watch the log in one terminal while submitting the test in another:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →tail -f /var/log/mail.logDistributions that route mail events to systemd’s journal or another syslog file use the equivalent journal or syslog command. The important output is the SMTP client line containing the queue ID, destination, delivery status, and remote response. Postfix records protocol transactions and failures through syslogd or postlogd, so the log is the authoritative starting point.
Read the complete line, including the text after a numeric SMTP code. “Deferred” alone is not a diagnosis: the following reason may identify a missing MX record, a timeout, a certificate mismatch, authentication failure, or a policy response. Preserve the original capitalization and punctuation when comparing a later attempt.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
3. Inspect the queue and match the ID
List queued messages with either command:
postqueue -pmailqMatch the queue ID from the test submission to the listing and the log. Determine whether the message is active, deferred, bounced, or already delivered. A queue entry without a recent delivery attempt often points to a scheduler or service problem; a recent entry with an SMTP response points to DNS, connectivity, TLS, authentication, or remote policy.
Queue inspection also prevents a common mistake: sending repeated tests while an earlier copy is still retrying. Distinguish the new ID from older deferred entries, and note whether only one recipient domain fails or every external destination fails. A domain-specific pattern suggests destination DNS or policy; a universal pattern points more strongly to the VPS network path, relay settings, or local authorization.
4. Classify the exact SMTP or connection error
| Observed result | What it means | What to check next |
|---|---|---|
status=deferred |
A temporary failure occurred and Postfix will normally retry. | Read the text after the status. Check DNS or MX resolution, network reachability, remote rate limiting, and TLS validation. Leave the message queued while you investigate. |
relay access denied |
The SMTP client is not authorized to relay for that destination. | Review mynetworks, SASL authentication, the configured relay destination, and smtpd_relay_restrictions. Do not solve this by permitting every client. |
| TLS certificate, hostname, or trust error | The certificate presented by the relay could not be verified at the required security level. | Confirm the relay hostname, certificate name, trust chain, system time, and the TLS security setting. A hostname mismatch can defer delivery even when the port is reachable. |
| Connection timeout or network unreachable | Postfix could not establish the SMTP connection. | Check DNS and the recipient’s MX host, the VPS firewall, routing, and the provider’s outbound SMTP policy. The client records these protocol and connection failures in the mail log. |
| Remote rejection after connection | The destination accepted the connection but rejected the message or sender. | Read the complete SMTP response. It may identify authentication, reputation, reverse-DNS, SPF, DKIM, DMARC, rate, or content requirements. |
Do not treat all 4xx and 5xx responses alike. A temporary response generally leaves the message queued, while a permanent response leads to a bounce. The remote wording tells you whether to wait for a retry, correct your setup, or contact the relay or destination administrator.
5. Check whether outbound port 25 is available
Direct server-to-server SMTP normally uses TCP port 25. Many VPS companies block or filter outbound port 25 on new, low-trust, or abuse-prone accounts. A local Postfix configuration can therefore be correct while every external connection times out.
Check the VPS provider’s egress policy and control-panel restrictions, then test connectivity to the destination MX identified in DNS. If the provider blocks port 25, request unblocking only if you have a legitimate operational reason and the provider offers that option. Otherwise use authenticated submission through a relay on port 587. Debian describes 587 as the submission port reserved for mail user agents sending to a mail transfer agent.
Test the path that Postfix actually needs. For direct delivery, that is the recipient’s MX on port 25; for a relay design, it is the relay hostname on port 587. A successful connection to one does not prove the other is reachable. Also check the host firewall and any VPS security-group rule that controls outbound traffic.
Recommended Free Tools
6. Configure an authenticated relay and TLS
When direct delivery is unavailable or undesirable, configure a relay service supplied by your organization or SMTP provider. The basic Postfix pattern is:
relayhost = [smtp.example.net]:587The square brackets prevent MX lookups for the relay hostname; use the exact syntax required by your relay provider. Add the provider’s required SASL username, password mechanism, credential map, and TLS settings. Providers differ in whether they require explicit encryption, a particular authentication mechanism, or a certificate policy, so copy those values from the service documentation rather than guessing.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Keep relay authorization explicit. Postfix’s normal model permits trusted networks listed in mynetworks, clients authenticated with SASL, and only the destinations you intend to relay. The relevant controls include permit_mynetworks, permit_sasl_authenticated, and destination restrictions in smtpd_relay_restrictions. After editing the configuration, reload Postfix and send one new test message while watching the queue ID. Never replace these restrictions with an unrestricted permit rule: an open relay can be abused to send spam and can quickly damage your server’s reputation.
Keep relay credentials out of application code and protect the credential file with appropriate permissions. If authentication succeeds but delivery still defers, separate the two hops in your diagnosis: first confirm the VPS-to-relay SMTP transaction, then use the relay’s own logs or policy response to understand its onward delivery decision.
7. Validate DNS and sender identity
DNS and authentication affect both acceptance and spam placement. For a VPS sending directly, verify that:
- The server’s sending hostname has a forward DNS record.
- The public sending IP has reverse DNS (PTR) that names the expected host.
- The forward record for that hostname resolves back to the sending IP.
- Your SPF record authorizes the actual sending IP or relay.
- DKIM signing is enabled where required and the public key is published.
- DMARC is published with alignment between the visible From domain and the authenticated SPF or DKIM identity.
These records do not repair a stopped Postfix service, a blocked port, or invalid relay credentials. They address the later decision made by the receiving server: accept, reject, defer, or deliver to spam. If you use a relay, publish the relay’s authorized sending infrastructure and follow its domain-alignment instructions instead of listing only your VPS address.
Check DNS from the perspective of the public Internet, not only from the VPS’s local resolver. A stale or split record can make local tests appear healthy while the receiving server sees a different address. When the VPS IP or hostname changes, review PTR, forward DNS, SPF, DKIM, and DMARC together.
8. Verify to a mailbox you control
Send a controlled test to an account you own, preferably at a different mail provider. Follow the queue ID until the log reports delivery or produces a definitive bounce. Save the complete SMTP response, timestamp, destination, and configuration used.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThis test demonstrates what happened for that destination and configuration at that time. It cannot guarantee universal inbox placement: other providers may apply different reputation, authentication, rate, or content policies.
Check both sides of the result. “Delivered” in the Postfix log means the receiving SMTP server completed the transaction; it does not promise a primary-inbox placement. If the message is in spam, review sender identity, authentication alignment, reputation, and the recipient provider’s policy separately from transport troubleshooting.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Choosing direct delivery or an authenticated relay
Neither architecture is universally better. The correct choice depends on control of the VPS network and DNS, your sending volume, and how much operational responsibility you want.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Decision factor | Direct-to-recipient delivery | Authenticated relay on port 587 |
|---|---|---|
| Network requirement | Outbound port 25 must be permitted and reachable. | Usually uses port 587, which is less commonly blocked. |
| Authentication | Your server presents its own SMTP identity; no upstream login is required. | Requires provider credentials and the provider’s SASL and TLS settings. |
| DNS and reputation | You control PTR, forward DNS, SPF, DKIM, and DMARC, and carry the sending IP’s reputation. | The relay supplies or shares sending reputation; your domains still need correct authentication and alignment. |
| Diagnostics | Postfix logs the complete connection to each recipient, but you must interpret remote responses and reputation issues. | You can diagnose the VPS-to-relay hop locally; the relay’s logs and policies govern the second hop. |
| Limits and cost | Provider policies, recipient throttling, and IP reputation determine practical limits; no universal figure is established. | Plans may impose per-message, daily, or monthly limits and charges; the applicable values come from your relay agreement. |
| Best fit | Operators who can manage port 25, reverse DNS, authentication, abuse handling, and reputation. | VPS users facing port-25 filtering or who prefer managed delivery and authenticated submission. |
Direct delivery offers full control but makes your VPS responsible for every connection, retry, DNS record, and reputation issue. An authenticated relay adds a credential and a second provider relationship, but it can bypass a port-25 restriction and centralize onward delivery. Compare the relay’s authentication, TLS, logging, sending limits, and recurring charges with the operational cost of maintaining direct delivery.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Fixes for common failure paths
Messages remain deferred after a relay is configured
Confirm that the queue entry is using the new relay host rather than a stale configuration. Check the relay hostname, port 587, credentials, TLS requirement, and certificate name in the latest log attempt. A successful TCP connection followed by an authentication error is different from a timeout before TLS; apply the fix indicated by the exact response, then wait for a new retry or submit a fresh test.
Relay access is denied for local applications
Identify the client address and authentication state in the log. If the application runs on the same VPS, its address must be covered by an intentionally configured trusted network, or the application must authenticate with SASL. If users submit from other networks, require authentication rather than expanding mynetworks broadly. Recheck smtpd_relay_restrictions after the change and test both an authorized submission and an unauthorized one from a controlled account.
Gmail or another large provider rejects the message
Use the provider’s full SMTP response, not just the mail client notification. Separate transport failure from policy rejection: a timeout indicates a network or port problem, while a response after the SMTP conversation points toward sender identity, reputation, rate, or content policy. Verify PTR and forward DNS, SPF, DKIM, and DMARC alignment, then retest. A message accepted by the remote server can still be classified as spam, so acceptance and inbox placement must be evaluated separately.
The VPS provider blocks port 25
Do not keep retrying direct delivery while the egress policy is unchanged. Move the outbound hop to an authenticated relay on port 587, configure the provider’s credentials and TLS policy, reload Postfix, and confirm that the log shows a connection to the relay rather than the recipient’s MX. If you need direct delivery, ask the VPS provider about its documented unblocking process and abuse controls.
Only one recipient domain fails
Compare the successful and failing queue entries. If the VPS reaches other domains, a universal port block is less likely; inspect the failing domain’s MX result, its SMTP response, and any temporary rate or policy message. Keep the exact response and retry behavior in your notes rather than changing global relay restrictions for a destination-specific problem.
Every external recipient fails
Check whether the failure begins before an SMTP greeting. A shared timeout or network-unreachable response across destinations points to outbound filtering, routing, or a firewall. If all connections reach a relay but authentication fails, focus on the relay credentials, SASL mechanism, TLS mode, and certificate hostname instead of DNS records for individual recipient domains.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Operational checklist after the fix
- Record the queue ID and complete SMTP response for a successful test.
- Keep mail-log monitoring available so future failures can be tied to a specific recipient and attempt.
- Review deferred and bounced queues regularly instead of assuming that local acceptance means delivery.
- Limit relay permissions to known networks, authenticated clients, and intended destinations.
- Protect relay credentials with appropriate file permissions and rotate them according to your provider’s policy.
- Monitor DNS records whenever the VPS IP, hostname, or relay changes.
- Document whether your design depends on direct port 25 or authenticated port 587, including the provider’s sending limits.
- Keep a known-good test recipient and a distinctive subject for future diagnostics.
- Record which component owns each setting: VPS provider, Postfix, DNS host, relay service, or recipient provider.
The reliable troubleshooting sequence is always the same: capture the queue ID, read the exact log response, classify the queue state, test the network path, correct authorization or TLS, validate DNS identity, and verify to a mailbox you control. That sequence distinguishes a local Postfix problem from a VPS egress restriction or a receiving server’s policy decision.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Frequently Asked Questions
Why does Postfix accept my message but not deliver it?
Local acceptance only means Postfix queued the message. Follow its queue ID in the mail log; a deferred entry indicates a temporary DNS, network, TLS, rate, or remote-server failure, while a bounce indicates permanent rejection.
What does “relay access denied” mean?
The client is not authorized to relay for that destination. Review intentional entries in mynetworks, SASL authentication, the relay destination, and smtpd_relay_restrictions. Do not permit every client, because that creates an open relay.
Is my VPS provider blocking port 25?
It may be filtering outbound port 25. Check the provider’s egress policy and test the recipient MX path. If port 25 is blocked, use authenticated submission to a relay on port 587 or follow the provider’s documented unblocking process.
How do I troubleshoot a deferred message?
Read the complete status=deferred line, keep the message queued, and check the stated cause. Verify MX/DNS resolution, connectivity, remote rate limits, TLS hostname and trust, and any relay credentials.
Why do TLS errors keep Postfix from sending?
The relay certificate may not match the hostname, chain to a trusted authority, or satisfy the configured security level. Confirm the relay hostname, certificate name, trust chain, system time, and provider-required TLS settings.
Will SPF, DKIM, and DMARC fix a stopped Postfix service?
No. They influence receiving-server acceptance and spam placement after transport works. First repair the service, queue, network path, relay authorization, or TLS; then verify forward DNS, PTR, SPF, DKIM, and DMARC alignment.
Is port 587 better than direct delivery?
It is the practical alternative when outbound port 25 is blocked and is commonly used for authenticated submission. It requires relay credentials, TLS settings, and compliance with the provider’s limits and charges; direct delivery gives more control but more operational responsibility.
Does a Postfix “delivered” log entry guarantee the inbox?
No. It confirms that the remote SMTP transaction completed for that recipient. The receiving provider can still place the message in spam, so transport success and inbox placement must be evaluated separately.
Free tools Windows power users keep installed
One-click scans. No signup required.
The Bottom Line
Trace one queue ID from submission to final SMTP response. The exact log error tells you whether to repair DNS, connectivity, TLS, authorization, or the VPS provider’s port policy. Keep relay restrictions tight, use authenticated port 587 when port 25 is unavailable, and treat successful SMTP delivery as distinct from inbox placement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
