Client host rejected: Access denied

 

Mail is delivered to the MTA, but not to the mailbox

If there is a line in the /var/log/zimbra.log like:

 postfix/lmtp ... deferred ... connection refused

There is no connection to port 7025 to perform Local Mail Transfer Protocol (LMTP) delivery.

This is nearly always caused by a host that is configured on private IP Space (or using NAT) and that does not have an interface for the public IP address the server resides on. This can be easily fixed by simply using native IP address lookups for lmtp rather than DNS. Alternatively, you could have your internal network's domain name configured to lookup differently internally than it does externally. Using that method is beyond the scope of this document.

Zimbra Collaboration 8.5 or above

ZCS 8.5 or above onwards this attribute is now in ldap - zimbraMtaLmtpHostLookup

 zmprov ms mtaserver.com zimbraMtaLmtpHostLookup native
 zmprov ms `zmhostname` zimbraMtaLmtpHostLookup native

In case that you are using Single Server, be aware always of the Global Config as well:

 zmprov mcf zimbraMtaLmtpHostLookup native

Once this is done, you'll need to restart the mta:

 zmmtactl restart

Zimbra Collaboration 8.0 or previous

To lookup lmtp addresses natively instead of by DNS, simply modify the following localconfig values on all mta's:

 zmlocalconfig -e postfix_lmtp_host_lookup=native

Once this is done, you'll need to restart the mta:

 zmmtactl restart

change to dns from native