Sending but not receiving

Tekkie27

Hello. I recently set up a dockerized mailcow server. It was pretty straightforward. I am using my home internet with a dynamic IP address, using a Godaddy API to update the relevant DNS records when there is a change.

I am using n-able for spam filtering. All inbound and outbound mail is routed through n-able. I seem to have my SPF, DMARC, and DKIM records all in order. I am testing using the web interface. I send an email to my gmail account, and it is received. I reply to that email and it never arrives.

I see relevant logs in Postfix, so I know mail is traveling through my firewall and arriving at my mailcow server. At first I was getting this error:

NOQUEUE: reject: RCPT from out16-200.antispamcloud.com[185.201.18.200]: 554 5.7.1 <out16-200.antispamcloud.com[185.201.18.200]>: Client host rejected: Access denied; from=<example@gmail.com> to=<example@mydomain.com> proto=ESMTP helo=<out16-200.antispamcloud.com>

So I added a mynetworks line in extra.conf that includes the IP range of the spam filtering service, then restarted the postfix container. Now I am getting this error.

0D727589C96: to=<example@mydomain.com>, relay=smtpout.mtaroutes.com[38.89.254.227]:587, delay=4.7, delays=0.1/0.01/1/3.6, dsn=5.0.0, status=bounced (host smtpout.mtaroutes.com[38.89.254.227] said: 550 You do not have permission to send from gmail.com (in reply to end of DATA command))

Which has thrown me for a complete loop. Any ideas?

Tekkie27

I deleted everything, including all associated images and volumes. I started from scratch. I switched to Sendgrid for outbound, and am taking email delivery directly with no filter between the internet and my mailcow server.

I am in a similar situation as the first time. I can send email outbound, and verify that it is delivered through sendgrid, but when I reply, or send an email from my gmail account, I am getting the following error messages:

9694956A01E: to=<example@mydomain>, relay=smtp.sendgrid.net[54.157.14.6]:587, delay=11, delays=10/0.01/0.97/0.08, dsn=5.0.0, status=bounced (host smtp.sendgrid.net[54.157.14.6] said: 550 The from address does not match a verified Sender Identity. Mail cannot be sent until this error is resolved. Visit https://sendgrid.com/docs/for-developers/sending-email/sender-identity/ to see the Sender Identity requirements (in reply to end of DATA command))

5D97956A220: to=<example@gmail.com>, relay=smtp.sendgrid.net[54.157.14.6]:587, delay=0.27, delays=0.01/0.01/0.19/0.06, dsn=5.0.0, status=bounced (host smtp.sendgrid.net[54.157.14.6] said: 550 The from address does not match a verified Sender Identity. Mail cannot be sent until this error is resolved. Visit https://sendgrid.com/docs/for-developers/sending-email/sender-identity/ to see the Sender Identity requirements (in reply to end of DATA command))

It’s almost like mailcow is interpreting these as outbound messages it is trying to send, instead of delivering them to the mailbox on the mailcow server. I’m sure I have something configured incorrectly, but I can’t for the life of me figure out what it is.

I have two domains set up, one address/mailbox, and one alias.
I have a transport set up with a * destination, next hop is smtp.sendgrid.net:587

Not sure where to look next?

DocFraggle

Well, did you setup your “Sender Identity” as stated here:

https://docs.sendgrid.com/for-developers/sending-email/sender-identity

Tekkie27

DocFraggle

Yes, and my mailcow server is sending outbound through send grid without issue. Inbound mail is not working. My domain has a single MX record which is the FQDN of the server itself. Inbound mail is not routing through send grid.

DocFraggle

The log entries you posted above are from outbound emails

Tekkie27

That’s very strange. When I send an outbound message to example@gmail.com, from my mailcow server with the address example@mydomain.com it goes through normally and I receive it in my gmail inbox. I see the following corresponding event in the postfix log:

F408856A19F: replace: header Received: from a9f19bf81508 (mailcowdockerized-sogo-mailcow-1.mailcowdockerized_mailcow-network [172.22.1.248])??(Authenticated sender: example@mydomain.com)??by mail.mydomain.com (Postcow) from mailcowdockerized-sogo-mailcow-1.mailcowdockerized_mailcow-network[172.22.1.248]; from=<example@mydomain.com> to=<example@gmail.com> proto=ESMTP helo=<a9f19bf81508>: Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPA id F408856A19F??for <example@gmail.com>; Fri, 29 Mar 2024 12:44:58 -0400 (EDT)

and

F408856A19F: to=<example@gmail.com>, relay=smtp.sendgrid.net[18.223.240.158]:587, delay=9.6, delays=8.4/0.03/1.1/0.04, dsn=2.0.0, status=sent (250 Ok: queued as _sg6eo83Sq-z--uzkbGLYQ)

If I reply to that email from my gmail inbox, it never arrives in my mailcow mailbox, and that’s when I get this event in the postfix log:

55A1556A19A: to=<example@gmail.com>, relay=smtp.sendgrid.net[18.223.240.158]:587, delay=0.12, delays=0.01/0/0.08/0.03, dsn=5.0.0, status=bounced (host smtp.sendgrid.net[18.223.240.158] said: 550 The from address does not match a verified Sender Identity. Mail cannot be sent until this error is resolved. Visit https://sendgrid.com/docs/for-developers/sending-email/sender-identity/ to see the Sender Identity requirements (in reply to end of DATA command))

and

2CAEF56A1B6: to=<example@mydomain.com>, relay=smtp.sendgrid.net[18.223.240.158]:587, delay=13, delays=11/0.06/2.4/0.06, dsn=5.0.0, status=bounced (host smtp.sendgrid.net[18.223.240.158] said: 550 The from address does not match a verified Sender Identity. Mail cannot be sent until this error is resolved. Visit https://sendgrid.com/docs/for-developers/sending-email/sender-identity/ to see the Sender Identity requirements (in reply to end of DATA command))

I am not sending an outbound message when I see these in the log, but I am replying to the test message I sent from my gmail address, so I’m not sure why these appear as outbound emails. Is there a different log I should be examining?

DocFraggle

How exactly do you reply? Sogo? Another email client? Did you accidentally configure another email address in your mail client?

Tekkie27

DocFraggle

I’m using Apple Mail on my Mac as my email client for the gmail address. I just tried another from the gmail web interface. Here is the success for the outbound email:

52F6F56A025: to=<example@gmail.com>, relay=smtp.sendgrid.net[107.20.8.136]:587, delay=11, delays=8.3/0.02/2.6/0.09, dsn=2.0.0, status=sent (250 Ok: queued as IV3K2r78RlSJxX_Z3XGBrw)

I clicked reply from the gmail web interface, sent the reply, but it never arrived. I got the same error message as the last time:

C36E356A090: to=<example@gmail.com>, relay=smtp.sendgrid.net[54.146.218.5]:587, delay=0.36, delays=0.01/0.01/0.29/0.05, dsn=5.0.0, status=bounced (host smtp.sendgrid.net[54.146.218.5] said: 550 The from address does not match a verified Sender Identity. Mail cannot be sent until this error is resolved. Visit https://sendgrid.com/docs/for-developers/sending-email/sender-identity/ to see the Sender Identity requirements (in reply to end of DATA command))

DocFraggle

And for clarification, I’m sending the successful outbound test message from SOGO on the mailcow server.

DocFraggle

Ok, where exactly do you see the above error message? Is it a NDR you get in your Gmail account? Or do you see this in your mailcow postfix logs?

Tekkie27

DocFraggle

I am not getting an NDR in gmail at all. These are in the mailcow postfix logs.

I work in IT, mostly Helpdesk and administrating Microsoft servers, and I work with Exchange a lot. I started dipping my toe into Linux and Docker during the lockdown, and I’m making a big push into it now. When you say these are outbound logs, I know what you mean. They look like they would be. I just sent again from my gmail, not a reply, just a test message from my gmail to my mailcow email, and I got the same error:

D252756A1B6: to=<example@gmail.com>, relay=smtp.sendgrid.net[52.204.68.213]:587, delay=0.52, delays=0.01/0.01/0.39/0.13, dsn=5.0.0, status=bounced (host smtp.sendgrid.net[52.204.68.213] said: 550 The from address does not match a verified Sender Identity. Mail cannot be sent until this error is resolved. Visit https://sendgrid.com/docs/for-developers/sending-email/sender-identity/ to see the Sender Identity requirements (in reply to end of DATA command))

It’s almost as if the mailcow server is trying to relay the message instead of delivering it internally. Is it possible I misconfigured something that would cause/allow it to do that?

nso

if you set up a sendgrid relay for a domain, everything will go trough sendgrid. have you configured sender auth in sendgrid ?

Tekkie27

nso

Yes. Domain auth and sender auth are both configured. Outbound mail is routing through sendgrid as expected and working correctly. Inbound mail is not going through sendgrid. My MX records are set to deliver mail directly to my mail cow server, and the logs I’ve posted earlier in the thread indicate that the messages arrive at my mail server, but mail cow is not delivering them to my local mailboxes. Again, this issue is with inbound mail only, so Sendgrid should not come into the picture.

esackbauer

Did you set up MTA STS?
https://community.mailcow.email/d/2478-the-mx-host-does-not-match-any-mx-allowed-by-the-sts-policy

Tekkie27

Hey All, thanks for the help. Is MTA STS a requirement? I’m not getting an error about it, and I’ve never used it before. It really seems like the mail server is trying to relay inbound mail instead of delivering it to the local recipient.

I have my sendgrid API set up as the outbound transport

Am I missing something in this setting? What about on the inbound? I have these forwarding hosts set up:

But every time I send an email to my mailcow mailbox, I continue to get the same errors I attached previously. They look like outbound messages, but they only occur when I send an email to my mailcow mailbox from my gmail account.

Any ideas what I may be missing?

DocFraggle

Hi, just for my understanding (because I don’t use a relay service myself): I thought you use it for outbound mails only? But you set your MX records for your domain(s) to point at the Sendgrid servers as well? And you configured a forwarding in Sendgrid to your Mailcow instance?

Tekkie27

Sorry for the confusion, I am understanding that the forwarding hosts are probably not needed. I have one MX record that points directly to my mailcow server’s public IP address. Sendgrid is only being used for outbound.