Sending but not receiving

Tekkie27

I’m using Apple Mail on my Mac as my email client for the gmail address. I just tried another from the gmail web interface. Here is the success for the outbound email:

52F6F56A025: to=<example@gmail.com>, relay=smtp.sendgrid.net[107.20.8.136]:587, delay=11, delays=8.3/0.02/2.6/0.09, dsn=2.0.0, status=sent (250 Ok: queued as IV3K2r78RlSJxX_Z3XGBrw)

I clicked reply from the gmail web interface, sent the reply, but it never arrived. I got the same error message as the last time:

C36E356A090: to=<example@gmail.com>, relay=smtp.sendgrid.net[54.146.218.5]:587, delay=0.36, delays=0.01/0.01/0.29/0.05, dsn=5.0.0, status=bounced (host smtp.sendgrid.net[54.146.218.5] said: 550 The from address does not match a verified Sender Identity. Mail cannot be sent until this error is resolved. Visit https://sendgrid.com/docs/for-developers/sending-email/sender-identity/ to see the Sender Identity requirements (in reply to end of DATA command))

DocFraggle

And for clarification, I’m sending the successful outbound test message from SOGO on the mailcow server.

DocFraggle

Ok, where exactly do you see the above error message? Is it a NDR you get in your Gmail account? Or do you see this in your mailcow postfix logs?

Tekkie27

DocFraggle

I am not getting an NDR in gmail at all. These are in the mailcow postfix logs.

I work in IT, mostly Helpdesk and administrating Microsoft servers, and I work with Exchange a lot. I started dipping my toe into Linux and Docker during the lockdown, and I’m making a big push into it now. When you say these are outbound logs, I know what you mean. They look like they would be. I just sent again from my gmail, not a reply, just a test message from my gmail to my mailcow email, and I got the same error:

D252756A1B6: to=<example@gmail.com>, relay=smtp.sendgrid.net[52.204.68.213]:587, delay=0.52, delays=0.01/0.01/0.39/0.13, dsn=5.0.0, status=bounced (host smtp.sendgrid.net[52.204.68.213] said: 550 The from address does not match a verified Sender Identity. Mail cannot be sent until this error is resolved. Visit https://sendgrid.com/docs/for-developers/sending-email/sender-identity/ to see the Sender Identity requirements (in reply to end of DATA command))

It’s almost as if the mailcow server is trying to relay the message instead of delivering it internally. Is it possible I misconfigured something that would cause/allow it to do that?

nso

if you set up a sendgrid relay for a domain, everything will go trough sendgrid. have you configured sender auth in sendgrid ?

Tekkie27

nso

Yes. Domain auth and sender auth are both configured. Outbound mail is routing through sendgrid as expected and working correctly. Inbound mail is not going through sendgrid. My MX records are set to deliver mail directly to my mail cow server, and the logs I’ve posted earlier in the thread indicate that the messages arrive at my mail server, but mail cow is not delivering them to my local mailboxes. Again, this issue is with inbound mail only, so Sendgrid should not come into the picture.

esackbauer

Did you set up MTA STS?
https://community.mailcow.email/d/2478-the-mx-host-does-not-match-any-mx-allowed-by-the-sts-policy

Tekkie27

Hey All, thanks for the help. Is MTA STS a requirement? I’m not getting an error about it, and I’ve never used it before. It really seems like the mail server is trying to relay inbound mail instead of delivering it to the local recipient.

I have my sendgrid API set up as the outbound transport

Am I missing something in this setting? What about on the inbound? I have these forwarding hosts set up:

But every time I send an email to my mailcow mailbox, I continue to get the same errors I attached previously. They look like outbound messages, but they only occur when I send an email to my mailcow mailbox from my gmail account.

Any ideas what I may be missing?

DocFraggle

Hi, just for my understanding (because I don’t use a relay service myself): I thought you use it for outbound mails only? But you set your MX records for your domain(s) to point at the Sendgrid servers as well? And you configured a forwarding in Sendgrid to your Mailcow instance?

Tekkie27

Sorry for the confusion, I am understanding that the forwarding hosts are probably not needed. I have one MX record that points directly to my mailcow server’s public IP address. Sendgrid is only being used for outbound.

balbulator

I have the same problem, I don’t receive incoming emails. But I don’t have any errors in the logs. Did you solve this problem?

esackbauer

balbulator

If you have no errors in postfix logs, and cannot find the receiving attempts there, then probably its a firewall issue (port 25 not open), or a DNS issue (reverse PTR record not set, MX record not set properly, hostname A record not set properly).

balbulator

esackbauer
Thanks for the quick response.
The DNS settings are correct and the tests have passed. Port 25 is open, which is evidenced by the fact that the emails are being sent successfully, I also checked port 25. Nothing with incoming emails was found in the Postfix logs and Docker-Compose logs

I tried to send emails to my Mailcow from different email addresses, nothing came. Gmail returned an email with the text: the recipient server did not accept our request to connect

esackbauer

balbulator Port 25 is open, which is evidenced by the fact that the emails are being sent successfully

No, that is only evidence that port 25 is outgoing allowed. for receiving mails, it must be also allowed inbound:
https://docs.mailcow.email/getstarted/prerequisite-system/#incoming-ports
Are firewalls really new to you?

And if you do not disclose your DNS settings or IP address, we cannot check if DNS settings are really correct.
Try it youself with mxtoolbox.com, check mx record and A records and SMTP test.

balbulator

esackbauer
Thanks, I found the problem in the router settings.
NAT Loopback

balbulator

I don’t have any rules configured in my firewall. Mailcow is installed according to the documentation on Ubuntu 25.04 on a virtual machine in Proxmox. I use CloudFlare DNS, I add the settings:

;;
;; Domain:     balbulator.pp.ua.
;; Exported:   2025-07-02 16:25:49
;;
;; This file is intended for use for informational and archival
;; purposes ONLY and MUST be edited before use on a production
;; DNS server.  In particular, you must:
;;   -- update the SOA record with the correct authoritative name server
;;   -- update the SOA record with the contact e-mail address information
;;   -- update the NS record(s) with the authoritative name servers for this domain.
;;
;; For further information, please consult the BIND documentation
;; located on the following website:
;;
;; http://www.isc.org/
;;
;; And RFC 1035:
;;
;; http://www.ietf.org/rfc/rfc1035.txt
;;
;; Please note that we do NOT offer technical support for any use
;; of this zone data, the BIND name server, or any other third-party
;; DNS software.
;;
;; Use at your own risk.
;; SOA Record
balbulator.pp.ua	3600	IN	SOA	austin.ns.cloudflare.com. dns.cloudflare.com. 2050314014 10000 2400 604800 3600

;; NS Records
balbulator.pp.ua.	86400	IN	NS	austin.ns.cloudflare.com.
balbulator.pp.ua.	86400	IN	NS	maya.ns.cloudflare.com.

;; A Records
mail.balbulator.pp.ua.	1	IN	A	45.89.89.105 ; cf_tags=cf-proxied:false

;; AAAA Records
mail.balbulator.pp.ua.	1	IN	AAAA	****:**** ; cf_tags=cf-proxied:false

;; CNAME Records
autoconfig.balbulator.pp.ua.	1	IN	CNAME	mail.balbulator.pp.ua. ; cf_tags=cf-proxied:false
autodiscover.balbulator.pp.ua.	1	IN	CNAME	mail.balbulator.pp.ua. ; cf_tags=cf-proxied:false
balbulator.pp.ua.	1	IN	CNAME	96421.bodis.com. ; cf_tags=cf-proxied:false

;; MX Records
balbulator.pp.ua.	1	IN	MX	10 mail.balbulator.pp.ua.

;; NS Records
aws.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
aws.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
dev.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
dev.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
e.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
e.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
email.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
email.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
info.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
info.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
k8s.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
k8s.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
mail1.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
mail1.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
news.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
news.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
newsletter.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
newsletter.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
ns1.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
ns1.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
ns2.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
ns2.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
spf.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
spf.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
test.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
test.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
track.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
track.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.
www.balbulator.pp.ua.	1	IN	NS	parked2.uadns.com.
www.balbulator.pp.ua.	1	IN	NS	parked1.uadns.com.

;; SRV Records
_autodiscover._tcp.balbulator.pp.ua.	1	IN	SRV	0 1 443 mail.balbulator.pp.ua.

;; TLSA Records
_25._tcp.mail.balbulator.pp.ua.	1	IN	TLSA	3 1 1 ****
;; TXT Records
balbulator.pp.ua.	1	IN	TXT	"v=spf1 a mx ip4:45.89.89.105 ip6:****:**** -all"
dkim._domainkey.balbulator.pp.ua.	1	IN	TXT	"v=DKIM1;k=rsa;t=s;s=email;p=******"
_dmarc.balbulator.pp.ua.	1	IN	TXT	"v=DMARC1; p=reject"

**** - long codes