If Postfix sends mail successfully but never receives messages from the Internet, troubleshoot the inbound path separately. External delivery depends on the recipient domain’s MX record, public DNS addresses, TCP port 25 reachability, Postfix’s listening interfaces, destination maps, recipient restrictions, and the final delivery service. Outbound success proves none of those inbound components.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Understand the two independent mail paths
When Postfix sends a message, it acts as an SMTP client and connects outward to another server. When it receives mail, a remote server looks up your domain, opens a new TCP connection to your MX host on port 25, and expects Postfix’s smtpd service to accept the recipient. A working outbound connection therefore does not show that DNS, firewall rules, NAT, port forwarding, or inbound Postfix configuration is correct.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe complete receive path is:
- The sender’s server queries the recipient domain’s MX record.
- The MX hostname resolves to an A or AAAA address.
- The sender opens TCP 25 to that address.
- NAT, a firewall, security group, or proxy forwards the connection to the mail host.
- Postfix accepts the SMTP session on an externally reachable interface.
- Postfix recognizes the domain and recipient through local or virtual destination settings.
- Postfix hands the message to the configured local-delivery, virtual-delivery, alias, or filtering service.
Find the first stage that fails instead of changing unrelated settings.
First identify what this Postfix host is supposed to do
Final MX server
A final MX accepts mail addressed to the domain and delivers it to local mailboxes or aliases. The domain’s MX record must point to this host (or to a proxy that forwards to it), and the domain must appear in the appropriate Postfix destination configuration.
#1 Best Overall
Backup MX or inbound relay
A backup MX accepts mail temporarily and forwards it to another system. It still needs publicly reachable TCP 25 and correct relay permissions, but it may not contain users’ mailboxes. A relay can appear to “receive” SMTP while messages remain queued for the primary server.
Outbound relay or submission client
A machine configured with relayhost, or used only by applications and authenticated users, is not intended to accept Internet mail. In that design it is normal for no public MX record to point to the host. Authenticated submission on ports 465 or 587 is a different service from server-to-server SMTP on port 25.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Do not apply final-MX instructions to an outbound-only relay. Confirm the intended architecture before editing Postfix or DNS.
Step 1: Verify the MX record and public addresses
Remote senders do not connect to the hostname you happen to use in Postfix. They query the recipient domain’s MX record and then connect to the hostname returned there. Check the MX record from a resolver outside the server’s network and verify that the MX target has the expected A record and, if you publish IPv6, an appropriate AAAA record.
The address returned by DNS must reach this Postfix instance. If the server is behind NAT, the public address must forward TCP 25 to the internal host. If a mail proxy or gateway is in front, its address belongs in DNS and it must pass the SMTP connection to Postfix. An MX target that resolves to an old address, a private RFC1918 address, or an unrelated web server will prevent delivery even if Postfix itself is healthy.
- Confirm the recipient domain has an MX record for the intended host.
- Confirm every MX hostname resolves consistently from public resolvers.
- Check that the A/AAAA result is the address advertised by your provider or perimeter firewall.
- Remove stale records and make sure IPv6 is not published unless the IPv6 path is actually configured for SMTP.
DNS changes may be cached according to their TTL. Test the currently published records from more than one external network before treating a change as effective.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Step 2: Test inbound TCP 25 from outside
Run the test from a network that is not the server’s LAN, such as a separate VPS, office connection, or mobile hotspot. Test the MX hostname or its public address on TCP 25. A successful TCP connection should produce an SMTP banner from Postfix or the front-end gateway.
nc -vz mx.example.net 25
# or, where available:
telnet mx.example.net 25Interpret the result by failure type:
| Observed result | Likely meaning | Where to investigate |
|---|---|---|
| Connection timeout | Packets are being dropped or routed incorrectly. | Provider policy, cloud security group, host firewall, NAT, proxy, routing, or an incorrect public address. |
| Immediate connection refused | The address is reachable but nothing is accepting TCP 25, or a device is actively rejecting it. | Postfix listener state, master.cf, local firewall, or front-end gateway policy. |
| SMTP banner appears | The network path and a listener work. | Continue with destination, recipient, restriction, and delivery checks. |
| Connection works only inside the LAN | External forwarding or perimeter access is missing. | NAT rule, security group, firewall zone, split DNS, or provider filtering. |
Do not test port 465 or 587 as a substitute. Those ports normally provide authenticated submission and do not prove that your server can accept unauthenticated server-to-server delivery on port 25.
Step 3: Confirm that Postfix listens on the public interface
The inet_interfaces parameter controls the network addresses on which Postfix listens. A value of loopback-only, or an address bound only to a private interface, allows local testing but prevents Internet senders from connecting. When NAT or a proxy is involved, inspect proxy_interfaces as well.
postconf inet_interfaces proxy_interfaces
ss -ltnp | grep ':25'Check that the socket shown by ss is bound to the expected address (or to all required addresses), not just 127.0.0.1:25 or an unreachable private address. Then inspect the SMTP service in master.cf. The service may be disabled, commented out, bound to a specific address, or configured to use a nonstandard process or chroot path.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The Postfix documentation defines inet_interfaces as all network interface addresses on which the system should listen. Changes to this parameter require a stop/start rather than only a configuration reload on affected installations. Use the service manager appropriate to your operating system and verify the socket again after the restart.
postconf -n
# After a required restart, verify again:
ss -ltnp | grep ':25'If a proxy terminates SMTP, Postfix may listen only on the proxy’s internal address while the proxy listens publicly. In that case, verify both listeners and the forwarding rule instead of exposing an internal address directly.
Step 4: Make sure the recipient domain is a Postfix destination
Postfix accepts mail for destinations matched by its local and virtual-domain settings. Inspect the effective values rather than relying on the contents of an unused configuration file.
Rank #3
postconf mydestination virtual_alias_domains virtual_mailbox_domainsLocal domains
A domain listed in mydestination is delivered through the local transport, usually to system users or aliases. The host name and any local domain names must be listed intentionally; adding a domain accidentally can cause mail to be accepted on the wrong server.
Virtual alias domains
A domain in virtual_alias_domains uses an alias map to translate incoming addresses. Verify that the exact recipient address has an alias and that the alias target is valid. A domain entry without a recipient mapping can result in rejection or unexpected delivery, depending on the rest of the configuration.
Virtual mailbox domains
A domain in virtual_mailbox_domains uses the configured virtual mailbox maps and delivery service. Confirm that the mailbox entry exists, its path is correct, and the delivery account can write there. A successful SMTP transaction does not guarantee that the mailbox exists or that the delivery service can access it.
Check spelling, capitalization rules, and the complete address at every layer. For example, accepting [email protected] requires both the domain match and a mailbox or alias for user; an MX record alone is not a mailbox definition.
Step 5: Check recipient restrictions without creating an open relay
Postfix must distinguish mail for your destinations from mail that it is merely being asked to relay elsewhere. Inspect the active restriction lists:
postconf smtpd_relay_restrictions smtpd_recipient_restrictionsPostfix states that either smtpd_relay_restrictions or, on older configurations, smtpd_recipient_restrictions must include at least one of reject or reject_unauth_destination; otherwise Postfix will refuse to receive mail. Preserve appropriate exceptions such as permit_mynetworks and permit_sasl_authenticated, but do not replace the list with a blanket permit.
Rank #4
- Used Book in Good Condition
Removing destination checks can turn a troubleshooting change into an open relay. An open relay lets unauthenticated users send through your server, leading to abuse, queue growth, provider blocks, and possible loss of service. If an external sender receives a 5xx rejection, capture the exact response and determine whether the domain was classified as local, virtual, or unauthorized before changing restrictions.
Step 6: Read the SMTP response and logs together
Start a log watch, send a test message from an unrelated provider, and record the SMTP response and queue ID. Distribution-specific log locations vary; on systems using systemd, this is a useful starting point:
journalctl -u postfix --since '15 minutes ago'| Evidence | What it indicates | Next check |
|---|---|---|
| No connection log at all | The message never reached Postfix. | MX records, A/AAAA resolution, TCP 25, firewall, NAT, provider policy, and proxy routing. |
NOQUEUE: reject |
Postfix rejected the SMTP session or recipient before queueing. | Read the response code and reason; inspect destination maps and restriction lists. |
4xx response or status=deferred |
The message is temporarily delayed, either during receipt or downstream delivery. | Read the complete defer reason, retry schedule, DNS result, transport, and remote response. |
| 5xx response | A permanent rejection occurred. | Correct the named policy, recipient, destination, authentication, or address problem before retrying. |
| Queued, then local-delivery status | Postfix accepted and handed off the message. | Inspect the mailbox path, alias target, delivery agent, quota, permissions, and filtering layer. |
| Delivered locally but absent from the user’s view | The final mailbox or filtering layer is hiding or moving the message. | Check spam or quarantine handling, folder rules, quota, indexing, and the actual delivery path. |
A queue ID lets you follow one message across the log. Do not infer a network failure from a missing mailbox when the log already shows successful local handoff; switch to delivery-agent and mailbox troubleshooting.
Step 7: Check the provider and network perimeter
VPS, cloud, residential, and corporate networks may restrict TCP 25 independently of your operating-system firewall. Some providers block inbound mail, require a support request, or place an SMTP proxy in front of the instance. Confirm that the service tier permits receiving mail and that its security-group or perimeter rule allows inbound TCP 25 from the Internet.
On the host, check firewall rules for both IPv4 and IPv6. A rule that permits IPv4 but drops IPv6 can produce intermittent failures when the MX hostname has both A and AAAA records. If you do not operate IPv6 SMTP, remove the AAAA record or make the IPv6 listener and routing path functional.
Reverse DNS does not determine where an incoming message is delivered, but providers may require a sensible PTR record and matching forward DNS before permitting mail service. Treat such requirements as provider policy, not as a replacement for an MX record or port-25 listener.
Common architectures and the settings they require
| Architecture | Public DNS | Port 25 path | Postfix destination and delivery |
|---|---|---|---|
| Direct final MX | MX points to this host’s public A/AAAA address. | Internet connects directly to the host; firewall permits TCP 25. | Domain in mydestination or virtual-domain settings; mailbox or alias exists locally. |
| Final MX behind NAT | MX points to the NAT public address. | Router forwards TCP 25 to the internal Postfix address. | Postfix listens on the internal interface; NAT and any proxy_interfaces settings are correct. |
| SMTP proxy or gateway | MX points to the gateway’s public name and address. | Gateway accepts TCP 25 and forwards SMTP to Postfix. | Gateway recipient policy and Postfix destination maps must agree. |
| Backup MX | MX preference sends mail here when the primary is unavailable. | Port 25 is publicly reachable. | Temporary relay behavior is intentional; forwarding to the primary is authorized and monitored. |
| Outbound relay or submission host | No public MX points here unless it is also an inbound server. | Usually accepts authenticated submission, not Internet delivery. | relayhost or submission services are configured; lack of inbound mail is expected. |
A safe diagnostic command set
Collect the effective configuration and listener state before editing anything:
Recommended Free Tools
postconf -n
postconf inet_interfaces proxy_interfaces mydestination virtual_alias_domains virtual_mailbox_domains smtpd_relay_restrictions smtpd_recipient_restrictions
ss -ltnp | grep ':25'
journalctl -u postfix --since '15 minutes ago'Compare the output with the intended architecture. Change one layer at a time, reload or restart only as required by the parameter, and repeat the external TCP and SMTP test. Keep a copy of the previous configuration so a failed change can be reverted quickly.
Failure patterns and targeted fixes
Outbound mail works, but external senders time out
Focus on MX resolution, the public address, provider restrictions, security-group rules, NAT, and TCP 25 forwarding. Postfix configuration changes cannot repair a packet that never reaches the host.
External senders connect but receive “Relay access denied”
Verify that the recipient domain is listed in mydestination, virtual_alias_domains, or virtual_mailbox_domains, as appropriate. Keep reject_unauth_destination or another safe destination restriction; do not solve a destination mismatch by permitting all relaying.
Postfix accepts the message but the mailbox remains empty
Use the queue ID and delivery log. Confirm the alias or mailbox map, delivery service, filesystem permissions, quota, and filtering rules. A successful SMTP acceptance is only the beginning of local delivery.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Mail works for one domain but not another
Compare each domain’s MX target, A/AAAA records, destination-map entry, and recipient map. Multi-domain configurations often have a correct listener but an omitted virtual domain or mailbox map entry.
Mail works over IPv4 but not IPv6
Test the AAAA address directly. Repair IPv6 routing, firewall, and Postfix listening settings, or remove the AAAA record until the IPv6 SMTP path is ready.
What a successful final test looks like
- The public MX query returns the intended hostname.
- The MX hostname resolves to a reachable public address with a working NAT or proxy path.
- An external TCP 25 test receives an SMTP banner.
- Postfix logs the connection and accepts the intended recipient without an unauthorized-relay error.
- The message receives a queue ID and a final delivery status.
- The mailbox, alias target, or downstream relay contains the message.
Test from outside the server’s network and use a sender at an unrelated provider. Local loopback tests can succeed while the public path remains blocked.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
