Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
If Postfix can send mail but cannot receive it, troubleshoot the inbound path separately. Outbound delivery uses a connection from your server to another mail server (or to a relayhost). Inbound delivery requires the sender to find your domain’s MX record, connect to your public address on TCP port 25, reach a Postfix SMTP listener, pass recipient and relay checks, and hand the message to the correct local or virtual mailbox. A successful outbound test proves none of those inbound stages.
Work through the checks in order: confirm the server’s intended role, verify MX and address records, test port 25 from outside the network, inspect Postfix listeners and destination maps, then use the SMTP response and mail log to isolate the failing layer. Do not loosen relay restrictions as a quick fix; an apparently working server can become an open relay.
1. Confirm what this Postfix host is supposed to do
Before changing a parameter, identify the mail architecture. A host configured only to submit outbound mail through a relayhost is not expected to accept Internet mail. A final-MX server accepts mail for domains hosted on it, while a backup MX accepts mail temporarily and forwards it later. The required DNS, listener, destination, and relay settings differ for each role.
| Architecture | What remote senders should do | Postfix behavior you need |
|---|---|---|
| Final MX | Deliver directly to this host after looking up the domain’s MX record. | Public TCP 25, an externally reachable smtpd service, and local or virtual destination and mailbox configuration. |
| Backup MX | Deliver here when the primary MX is unavailable. | Public TCP 25 and an explicit relay policy for the domains being backed up; queued mail must have a route to the primary server. |
| Outbound relayhost | Send through the configured relay; other servers do not normally deliver inbound mail here. | Submission or client settings, authentication as required, and no expectation of direct Internet reception. |
| Submission-only client | Use authenticated submission, normally on port 465 or 587, rather than server-to-server SMTP. | A submission service and credentials; an MX record pointing at this host is not needed for outbound-only use. |
If your design is outbound-only, “cannot receive Internet mail” is the intended result. If it should be a final or backup MX, continue with the inbound checks.
#1 Best Overall
2. Understand the complete inbound delivery path
For a message sent to user@example.net, the remote sender asks DNS for the MX record of example.net. It resolves the selected MX hostname to an A record and, if applicable, an AAAA record, then opens a server-to-server SMTP connection to that address on TCP port 25. The address may be a firewall, NAT gateway, load balancer, or mail proxy that must forward the connection to the Postfix host.
After the TCP connection, Postfix’s smtpd service presents an SMTP greeting and applies connection, client, sender, and recipient restrictions. It accepts the recipient only when the domain is a configured local or virtual destination and the mailbox, alias, or delivery map can handle that address. Finally, a local delivery agent or virtual delivery service writes the message to the mailbox. A break at any earlier stage can coexist with completely successful outbound sending.
Recommended Free Tools
3. Check MX, A, and AAAA records from outside
Run DNS queries from a resolver that is not on the mail server’s private network. This avoids mistaking an internal split-DNS answer for the public Internet route.
dig MX example.net
dig A mail.example.net
dig AAAA mail.example.net
# Alternative syntax
nslookup -type=mx example.net
The MX answer should name the host that is intended to receive mail. That hostname must resolve to the public address that actually forwards TCP 25 to the Postfix system. Check every MX record and its preference value; a lower preference number is tried first, but another MX can still receive mail when the first is unavailable.
- An MX pointing at an old server, a web host, or an internal address sends remote mail somewhere other than your Postfix host.
- An MX hostname without a usable A or AAAA record cannot be contacted reliably.
- An AAAA record causes IPv6-capable senders to try IPv6. If IPv6 is published but not routed or permitted to the server, those senders may time out before trying IPv4. Remove an incorrect AAAA record or make IPv6 forwarding and firewall rules work.
- Do not put an IP address in an MX record; MX targets are hostnames. The target hostname then supplies the address record.
Test the public result with more than one external resolver if a DNS change is recent. Also verify that the address is not merely the server’s private LAN address. When NAT or a proxy is present, map TCP 25 from the public address to the internal address where Postfix listens.
4. Test inbound TCP 25 from an unrelated network
Use a machine outside the server’s LAN—such as a different office, a mobile connection, or an external monitoring host—to test the MX hostname. Testing from the same network can hide perimeter or hairpin-NAT problems.
nc -v mail.example.net 25
# or
telnet mail.example.net 25
A working server normally returns an SMTP greeting beginning with a 220 status. Type EHLO test.example only after receiving the greeting, then close the session with QUIT.
| Observed result | Likely layer | Next check |
|---|---|---|
| Connection times out | Provider block, firewall/security group, missing NAT rule, routing failure, or an unreachable IPv6 address. | Inspect perimeter rules, provider policy, route tables, and A/AAAA behavior. |
| Connection is refused immediately | The address is reachable, but no service is listening on that address and port, or a firewall is actively rejecting it. | Run ss locally and inspect the enabled smtp service in master.cf. |
| SMTP greeting appears | Network reachability and a listener are working. | Send a controlled message and inspect recipient restrictions and delivery logs. |
| Greeting appears from the wrong server | The MX or NAT path points to another mail system. | Correct DNS or forwarding before changing Postfix. |
Port 25 is the server-to-server SMTP port. Ports 465 and 587 provide authenticated submission services and do not replace an Internet-facing port-25 listener for receiving mail from unrelated domains.
5. Verify that Postfix listens on the public-facing address
Display the effective settings rather than relying on comments in main.cf:
postconf inet_interfaces proxy_interfaces
ss -ltnp | grep ':25'
postconf -M smtp/inet
The inet_interfaces parameter is the set of network addresses on which Postfix listens. A value of loopback-only, 127.0.0.1, or only a private address prevents Internet senders from connecting. If a NAT or proxy terminates the public connection, proxy_interfaces identifies addresses that Postfix should treat as proxy-facing in configurations that require it.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Inspect the SMTP service in master.cf. It should be enabled as an Internet SMTP service, normally the smtp inet n - n - - smtpd entry. A line beginning with a comment marker is disabled. Do not confuse a submission service on 465 or 587 with the port-25 service.
After changing inet_interfaces, perform the stop/start operation required by the Postfix documentation for that parameter, then confirm the socket again:
Rank #3
sudo systemctl stop postfix
sudo systemctl start postfix
ss -ltnp | grep ':25'
Use your distribution’s service manager if it is not systemd. If the socket still binds only to loopback, check for an address typo, a disabled service, another process using port 25, or a configuration error shown by the service status command.
6. Make sure the recipient domain is accepted
A reachable SMTP server can still reject every recipient if the domain is not configured as a destination. Inspect the relevant parameters:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →postconf mydestination virtual_alias_domains virtual_mailbox_domains
postconf virtual_alias_maps virtual_mailbox_maps local_recipient_maps
For local delivery, the recipient domain normally appears in mydestination (along with the host’s local names as appropriate). For virtual delivery, place it in virtual_alias_domains or virtual_mailbox_domains, then configure the corresponding alias or mailbox map. The address must also exist in the selected map, unless your deliberate configuration accepts catch-all or dynamic recipients.
Postfix’s default acceptance rules cover mail to destinations matching $inet_interfaces, $proxy_interfaces, $mydestination, $virtual_alias_domains, or $virtual_mailbox_domains. A domain absent from all applicable destination settings is normally rejected as an unauthorized destination rather than delivered locally.
Check the exact address
Verify spelling, aliases, and case-insensitive domain handling. If sales@example.net is an alias for a local account, query the alias map with the map-specific command or inspect its source file, then rebuild any database map required by your distribution. For virtual mailboxes, confirm the mailbox path, ownership, permissions, quota, and the virtual delivery service. A valid domain with a nonexistent recipient can produce a recipient rejection or a later local-delivery failure, depending on the map and restrictions.
7. Preserve relay restrictions while fixing reception
Receiving mail for your own domains and relaying mail for arbitrary domains are different permissions. Inspect both modern and older restriction parameters:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #4
- Used Book in Good Condition
postconf smtpd_relay_restrictions smtpd_recipient_restrictions
Postfix requires either smtpd_relay_restrictions or (on older configurations) smtpd_recipient_restrictions to contain at least one protective restriction such as reject or reject_unauth_destination. Without that protection, Postfix can refuse to receive mail or, if replaced with a blanket permit, become an open relay.
A typical policy permits trusted clients and authenticated users, then rejects unauthorized destinations. Preserve permit_mynetworks and/or permit_sasl_authenticated where your design needs them, but do not replace the list with permit for every client. A recipient rejection for a domain you do not host is expected; a rejection for your own configured domain indicates a destination-map or restriction-order problem.
8. Use the SMTP response and logs to classify the failure
Watch the mail log while sending a test message from an unrelated provider. Distribution-specific locations vary; systemd systems commonly expose the same records through the journal.
journalctl -u postfix --since '15 minutes ago'
# Common file-based alternatives
sudo tail -f /var/log/mail.log
sudo tail -f /var/log/maillog
Record the remote SMTP response and any Postfix queue ID. The combination tells you which layer to fix.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Evidence | Meaning |
|---|---|
| No connection log at all | The sender did not reach this Postfix instance. Recheck MX, A/AAAA, routing, firewall, NAT, and provider policy. |
NOQUEUE: reject |
The message was rejected during SMTP before entering the queue. Read the accompanying reason; common causes are an unauthorized destination, recipient restriction, client policy, or malformed command. |
Immediate 4xx response or status=deferred |
The receiving side or a downstream delivery step asked the sender/Postfix to retry. Check the detailed defer reason, DNS, remote connectivity, and queue state. |
| 5xx response | A permanent rejection occurred. Correct the named policy, destination, recipient, or address problem before retrying. |
| Accepted with a queue ID, then local-delivery success | Postfix accepted and handed off the message. If it is not visible, inspect the mailbox path, alias expansion, quota, content filtering, and the final delivery agent. |
| Accepted, but no local-delivery record | The queue or delivery service may be stopped, paused, or repeatedly deferring. Inspect postqueue -p, service status, and the queue ID’s subsequent log lines. |
Do not treat “the sender says sent” as proof of delivery. Many senders report success when their own SMTP server has queued the message; the receiving server can still reject or defer it later.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.9. Check firewalls, cloud policy, NAT, and proxies
Confirm that every perimeter layer allows inbound TCP 25 from the Internet and forwards it to the correct internal host:
- The operating-system firewall must allow the port on the interface where Postfix listens.
- A cloud security group, network ACL, or virtual appliance must allow inbound TCP 25, not only web or SSH ports.
- A VPS, residential, or corporate provider may block port 25 or require an approval process. Ask whether inbound SMTP is permitted for the service and address.
- NAT must forward the public port to the private Postfix address. If a mail proxy terminates SMTP, it must pass the connection to Postfix and preserve the expected proxy configuration.
- IPv6 requires its own route and firewall rule. Publishing AAAA without working IPv6 can create intermittent failures.
Reverse DNS is important for sender reputation and some receiving policies, but it does not make an unreachable port 25 reachable. First establish DNS-to-socket connectivity, then address provider requirements such as reverse DNS or a permitted mail IP.
10. Apply fixes by the symptom you observed
MX points somewhere else
Correct the domain’s MX record and the target’s A/AAAA records, then verify the public answers from outside. Remove stale records only after confirming that no legitimate mail system still uses them.
Port 25 times out
Trace the path from the public address inward: provider policy, cloud security group, host firewall, NAT or proxy rule, and routing. Retest externally after each change. A local ss result cannot prove that the public path works.
Port 25 is refused
Start or enable Postfix, ensure the port-25 smtp service is active in master.cf, and set inet_interfaces to the intended reachable address. Check for another process occupying the port.
Postfix greets but rejects your domain
Add the domain to the correct local or virtual destination parameter and reload the relevant maps. Confirm that relay restrictions still include reject_unauth_destination or an equivalent safeguard.
The domain is accepted but the mailbox is empty
Follow the queue ID through the log. Check alias expansion, virtual mailbox maps, delivery-service status, filesystem permissions, quota, and filtering. The SMTP acceptance event alone does not prove that the message reached the user’s mailbox.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors11. Run a controlled end-to-end test
- Choose a sender account at an unrelated mail provider and a recipient address that definitely exists in your Postfix maps.
- Start the Postfix log watcher before sending the message.
- Confirm the sender’s domain selected your expected MX, either in its delivery details or by querying DNS independently.
- Send one message and capture the exact SMTP result if the sender exposes it.
- Find the queue ID in the Postfix log and follow every line until local delivery completes, defers, or rejects.
- After a configuration change, repeat the external TCP 25 test and the message test; do not rely on a test from the server itself.
For a quick configuration snapshot, use:
postconf -n
postconf inet_interfaces proxy_interfaces mydestination virtual_alias_domains virtual_mailbox_domains smtpd_relay_restrictions
ss -ltnp | grep ':25'
Compare the output with the intended architecture before editing values. Save a known-good configuration, make one logical change at a time, and use the parameter’s documented reload or restart requirement.
Quick Recap
12. Final receive checklist
- The host is intentionally a final MX or backup MX, not an outbound-only relayhost.
- The public MX target is the correct hostname and its A/AAAA records resolve to the address that reaches this server.
- External TCP 25 reaches the expected machine and returns the Postfix SMTP greeting.
inet_interfaces,proxy_interfaces, and themaster.cfsmtp service expose the intended interface.- The recipient domain is listed in the appropriate local or virtual destination setting.
- The recipient exists in the alias or mailbox map and the delivery service, permissions, and quota are healthy.
- Relay restrictions protect unrelated domains with
rejectorreject_unauth_destination. - Logs show the queue ID progressing to local delivery rather than a rejection or repeated defer.
- Provider, cloud, host-firewall, NAT, proxy, and IPv6 policies permit inbound SMTP.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
