That is not the error, your are looking in the logs when postfix is trying to send the forwarded email, ideally the whole transaction from when postfix receives the email (that should be forwarded) to the end of the forwarding transaction. You should be looking in /var/log/mail.log and not /var/log/mail.err
“/var/log/mail.log” :
2026-07-01T09:15:31.234080+02:00 sd-xxxxxxx postfix/smtpd[3781713]: lost connection after AUTH from unknown[111.26.115.122]
2026-07-01T09:15:31.234309+02:00 sd-xxxxxxx postfix/smtpd[3781713]: disconnect from unknown[111.26.115.122] ehlo=1 auth=0/1 commands=1/2
2026-07-01T09:15:31.571698+02:00 sd-xxxxxxx opendkim[2608981]: 3099D9A19A7: DKIM verification successful
2026-07-01T09:15:31.571910+02:00 sd-xxxxxxx opendkim[2608981]: 3099D9A19A7: s=s1 d=gocardless.com a=rsa-sha256 SSL
2026-07-01T09:15:31.616960+02:00 sd-xxxxxxx postfix/qmgr[3750833]: 3099D9A19A7: from=<bounces+1827704-44dd-tresorier=soxxxxxxl.fr@email.gocardless.com>, size=27483, nrcpt=1 (queue active)
2026-07-01T09:15:31.731906+02:00 sd-xxxxxxx postfix/smtpd[3772999]: disconnect from o4.ptr7180.gocardless.io[159.183.145.30] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7
2026-07-01T09:15:32.859804+02:00 sd-xxxxxxx postfix/local[3785092]: 3099D9A19A7: to=<"tresorier@soxxxxxxl.fr"@sd-xxxxxxx.dedibox.fr>, orig_to=<tresorier@soxxxxxxl.fr>, relay=local, delay=4.8, delays=3.5/0.01/0/1.2, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME)
2026-07-01T09:15:32.861594+02:00 sd-xxxxxxx postfix/cleanup[3785081]: 99FAD9A26DF: message-id=<DBkqCVb8S4mZByhgvMfTwA@geopod-ismtpd-4>
2026-07-01T09:15:32.864289+02:00 sd-xxxxxxx postfix/local[3785092]: 3099D9A19A7: to=<"tresorier@soxxxxxxl.fr"@sd-xxxxxxx.dedibox.fr>, orig_to=<tresorier@soxxxxxxl.fr>, relay=local, delay=4.8, delays=3.5/0.01/0/1.2, dsn=2.0.0, status=sent (forwarded as 99FAD9A26DF)
2026-07-01T09:15:32.865010+02:00 sd-xxxxxxx postfix/qmgr[3750833]: 99FAD9A26DF: from=<bounces+1827704-44dd-tresorier=soxxxxxxl.fr@email.gocardless.com>, size=27852, nrcpt=4 (queue active)
2026-07-01T09:15:32.866009+02:00 sd-xxxxxxx postfix/qmgr[3750833]: 3099D9A19A7: removed
2026-07-01T09:15:32.898258+02:00 sd-xxxxxxx postfix/smtp[3785118]: warning: DNSSEC validation may be unavailable
2026-07-01T09:15:32.898523+02:00 sd-xxxxxxx postfix/smtp[3785118]: warning: reason: dnssec_probe 'ns:.' received a response that is not DNSSEC validated
2026-07-01T09:15:32.927298+02:00 sd-xxxxxxx postfix/smtp[3785120]: warning: DNSSEC validation may be unavailable
2026-07-01T09:15:32.927558+02:00 sd-xxxxxxx postfix/smtp[3785120]: warning: reason: dnssec_probe 'ns:.' received a response that is not DNSSEC validated
2026-07-01T09:15:32.956083+02:00 sd-xxxxxxx postfix/smtp[3785121]: warning: DNSSEC validation may be unavailable
2026-07-01T09:15:32.956301+02:00 sd-xxxxxxx postfix/smtp[3785121]: warning: reason: dnssec_probe 'ns:.' received a response that is not DNSSEC validated
2026-07-01T09:15:32.985856+02:00 sd-xxxxxxx postfix/smtp[3785122]: warning: DNSSEC validation may be unavailable
2026-07-01T09:15:32.986079+02:00 sd-xxxxxxx postfix/smtp[3785122]: warning: reason: dnssec_probe 'ns:.' received a response that is not DNSSEC validated
2026-07-01T09:15:33.300464+02:00 sd-xxxxxxx postfix/smtp[3785120]: 99FAD9A26DF: to=<xxxxxxxxx@hotmail.com>, orig_to=<tresorier@soxxxxxxl.fr>, relay=hotmail-com.olc.protection.outlook.com[52.101.73.14]:25, delay=1.7, delays=1.2/0.06/0.11/0.25, dsn=5.7.515, status=bounced (host hotmail-com.olc.protection.outlook.com[52.101.73.14] said: 550 5.7.515 Access denied, sending domain GOCARDLESS.COM doesn't meet the required authentication level. The sender's domain in the 5322.From address doesn't meet the authentication requirements defined for the sender. To learn how to fix this see: https://go.microsoft.com/fwlink/p/?linkid=2319303 Spf= Fail , Dkim= Pass , DMARC= Pass [PAWPR03MB9106.eurprd03.prod.outlook.com 2026-07-01T07:15:33.272Z 08DED6C910AF7E6C] [AM8P189CA0019.EURP189.PROD.OUTLOOK.COM 2026-07-01T07:15:33.274Z 08DED6F5B0BA7889] [AM4PEPF00027A62.eurprd04.prod.outlook.com 2026-07-01T07:15:33.275Z 08DED23135E70C8A] (in reply to end of DATA command))
2026-07-01T09:15:33.356943+02:00 sd-xxxxxxx postfix/smtp[3785121]: 99FAD9A26DF: to=<fxxxxxxxx@hotmail.fr>, orig_to=<tresorier@soxxxxxxl.fr>, relay=eur.olc.protection.outlook.com[52.101.73.25]:25, delay=1.7, delays=1.2/0.09/0.1/0.3, dsn=5.7.515, status=bounced (host eur.olc.protection.outlook.com[52.101.73.25] said: 550 5.7.515 Access denied, sending domain GOCARDLESS.COM doesn't meet the required authentication level. The sender's domain in the 5322.From address doesn't meet the authentication requirements defined for the sender. To learn how to fix this see: https://go.microsoft.com/fwlink/p/?linkid=2319303 Spf= Fail , Dkim= Pass , DMARC= Pass [DBBPR05MB11297.eurprd05.prod.outlook.com 2026-07-01T07:15:33.337Z 08DED64585F58E78] [AS9PR05CA0030.eurprd05.prod.outlook.com 2026-07-01T07:15:33.346Z 08DED666C576C0CA] [AM2PEPF0001C713.eurprd05.prod.outlook.com 2026-07-01T07:15:33.347Z 08DED234368F0FBC] (in reply to end of DATA command))
2026-07-01T09:15:33.428150+02:00 sd-xxxxxxx postfix/smtp[3785118]: 99FAD9A26DF: to=<mxxxxxx@gmail.com>, orig_to=<tresorier@soxxxxxxl.fr>, relay=gmail-smtp-in.l.google.com[108.177.15.27]:25, delay=1.8, delays=1.2/0.03/0.13/0.4, dsn=2.0.0, status=sent (250 2.0.0 OK 1782890133 ffacd0b85a97d-47564a83774si9703785f8f.124 - gsmtp)
2026-07-01T09:15:39.282039+02:00 sd-xxxxxxx postfix/smtp[3785122]: 99FAD9A26DF: to=<brxxxxxx@sfr.fr>, orig_to=<tresorier@soxxxxxxl.fr>, relay=smtp-in.sfr.fr[93.17.128.165]:25, delay=7.7, delays=1.2/0.12/6.2/0.15, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 4gqrrq1Bxrz1LQKcw)
2026-07-01T09:15:39.284413+02:00 sd-xxxxxxx postfix/cleanup[3785081]: 44EF09A292E: message-id=<20260701071539.44EF09A292E@sd-xxxxxxx.dedibox.fr>
2026-07-01T09:15:39.288575+02:00 sd-xxxxxxx postfix/bounce[3785123]: 99FAD9A26DF: sender non-delivery notification: 44EF09A292E
2026-07-01T09:15:39.289284+02:00 sd-xxxxxxx postfix/qmgr[3750833]: 44EF09A292E: from=<>, size=32994, nrcpt=1 (queue active)
2026-07-01T09:15:39.290287+02:00 sd-xxxxxxx postfix/qmgr[3750833]: 99FAD9A26DF: removed
2026-07-01T09:15:40.389732+02:00 sd-xxxxxxx postfix/smtp[3785120]: 44EF09A292E: to=<bounces+1827704-44dd-tresorier=soxxxxxxl.fr@email.gocardless.com>, relay=mx.sendgrid.net[18.224.101.244]:25, delay=1.1, delays=0.01/0/0.78/0.31, dsn=2.0.0, status=sent (250 Ok: queued as dKr3MOGPQoCIeOqtm9ppJw)
2026-07-01T09:15:40.390378+02:00 sd-xxxxxxx postfix/qmgr[3750833]: 44EF09A292E: removed
And how do I check the Postfix configuration? What should I look for that might be causing a blockage?
so when an email is delivered there is never a log message to say it’s been delivered or are you just missing the part when it should forward ?
I’ve included all the logging steps for this morning’s email; I don’t think I’ve missed anything.
So does that mean you are seeing the email being delivered in mail.log but not the forwarding part or are you seeing nothing ?
on Ubuntu i thought it used systemd for everything. I do not have /var/log/mail.log
| SYSTEM INFORMATION | |
|---|---|
| OS type and version | Ubuntu Linux 22.04.5 |
| Webmin version | 2.650 |
| Usermin version | 2.540 |
| Virtualmin version | 8.1.0 Professional |
| Theme version | 26.50.1 |
xxxxxxx postfix/smtp[3785120]: 99FAD9A26DF: to=<xxxxxxxxx@hotmail.com>, orig_to=<tresorier@soxxxxxxl.fr>, relay=hotmail-com.olc.protection.outlook.com[52.101.73.14]:25, delay=1.7, delays=1.2/0.06/0.11/0.25, dsn=5.7.515, status=bounced (host hotmail-com.olc.protection.outlook.com[52.101.73.14] said: 550 5.7.515 Access denied, sending domain GOCARDLESS.COM doesn't meet the required authentication level. The sender's domain in the 5322.From address doesn't meet the authentication requirements defined for the sender. To learn how to fix this see: https://go.microsoft.com/fwlink/p/?linkid=2319303 Spf= Fail , Dkim= Pass , DMARC= Pass [PAWPR03MB9106.eurprd03.prod.outlook.com 2026-07-01T07:15:33.272Z 08DED6C910AF7E6C] [AM8P189CA0019.EURP189.PROD.OUTLOOK.COM 2026-07-01T07:15:33.274Z 08DED6F5B0BA7889] [AM4PEPF00027A62.eurprd04.prod.outlook.com 2026-07-01T07:15:33.275Z 08DED23135E70C8A] (in reply to end of DATA command))
- This failure is caused soley because the email is being forwarded.
- This could be resolved if virtualmin had
SRS - You are fowarding an email from
gocardless.comas is, so when outlook/gmail checks the email against the SPF/DKIM and other records atgocardless.comit finds the email to not be allowed and blocks it.
AI Description
Root cause: You (or your mail server) are forwarding an email that was originally sent by GoCardless, and the forward breaks SPF alignment because it’s relayed through a server not authorized by GoCardless’s SPF record. Outlook’s newer anti-spoofing policy no longer accepts DKIM-only alignment for certain domains — it wants full SPF+DKIM authentication to be preserved through the forward.
interesting, was this something you enabled yourself or is it a default thing?
Maybe it is an Ubuntu Linux 24.04.4 thing?
No I’ve had those logs from the beginning (Ubuntu 8.04)
just one quick follow up, did you do in place ubunutu upgrades to get to this point or is your current install fresh?
Every release I start from scratch with my suppliers image, may be the image is setup to provide those logs IDK. Over the years I have used many suppliers.
This has gone off topic
- This is a users implmentation of
PostSRSd - Some other notes
- The email statck is being looked at
Sorry for the delay in replying. The issue persists; I’ve checked SPF and DKIM, and installed ARC and PostSRSd. Everything is configured correctly, yet I’m still finding that emails arrive at the actual mailbox but aren’t necessarily being forwarded to Gmail, Outlook, etc.
I think the simplest solution would be to set up the actual mailbox directly for the users involved, rather than using aliases.