Centos环境下Postfix+Dovecot+Roundcube无法发送邮件问题求助

问题现象 #

在CentOS系统上部署了Postfix、Dovecot和Roundcube，目前能正常接收邮件，但无法发送邮件。发送时出现以下错误：

Trying to send email... 
SMTP send:  NOT OK(Failed to set sender 'm.alikhani@rayancommerce.com': (Code: -1))

SMTP 日志（smtp.log） #

[21-Oct-2023 16:41:22 +0330]: <oefpt1vg> Connecting to tls://127.0.0.1:587...
[21-Oct-2023 16:42:08 +0330]: <oefpt1vg> Recv: 220 mail.rayancommerce.com ESMTP Postfix
[21-Oct-2023 16:42:08 +0330]: <oefpt1vg> Send: EHLO mail.rayancommerce.com
[21-Oct-2023 16:42:08 +0330]: <oefpt1vg> Recv: 250-mail.rayancommerce.com
[21-Oct-2023 16:42:08 +0330]: <oefpt1vg> Recv: 250-PIPELINING
[21-Oct-2023 16:42:08 +0330]: <oefpt1vg> Recv: 250-SIZE 10240000
[21-Oct-2023 16:42:08 +0330]: <oefpt1vg> Recv: 250-VRFY
[21-Oct-2023 16:42:08 +0330]: <oefpt1vg> Recv: 250-ETRN
[21-Oct-2023 16:42:08 +0330]: <oefpt1vg> Recv: 250-STARTTLS
[21-Oct-2023 16:42:08 +0330]: <oefpt1vg> Recv: 250-ENHANCEDSTATUSCODES
[21-Oct-2023 16:42:08 +0330]: <oefpt1vg> Recv: 250-8BITMIME
[21-Oct-2023 16:42:08 +0330]: <oefpt1vg> Recv: 250 DSN
[21-Oct-2023 16:42:08 +0330]: <oefpt1vg> Send: STARTTLS
[21-Oct-2023 16:42:08 +0330]: <oefpt1vg> Recv: 220 2.0.0 Ready to start TLS
[21-Oct-2023 16:42:08 +0330]: <oefpt1vg> Send: EHLO mail.rayancommerce.com
[21-Oct-2023 16:42:09 +0330]: <oefpt1vg> Send: HELO mail.rayancommerce.com
[21-Oct-2023 16:42:09 +0330]: <oefpt1vg> Send: MAIL FROM:<m.alikhani@rayancommerce.com>
[21-Oct-2023 16:42:09 +0330]: <oefpt1vg> Send: RSET

Roundcube 配置信息 #

$config['smtp_host'] = 'tls://127.0.0.1:587';
$config['smtp_debug'] = true;
$config['smtp_log'] = true;
$config['smtp_user'] = '';
$config['smtp_pass'] = '';

 $config['smtp_conn_options'] = [
  'ssl' => [
    'verify_peer' => false,
    'verify_peer_name' => false,
    'allow_self_signed' => true,
    'verify_depth' => 3,
    'cafile' => '/etc/httpd/ssl/server.crt',
  ],
];

排查与解决步骤 #

1. 配置Postfix的SMTP认证规则 #

从日志和Roundcube配置来看，当前未启用SMTP认证，而Postfix的587（submission）端口默认要求认证才能发件。

编辑Postfix主配置文件/etc/postfix/main.cf，添加/修改以下配置：

smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
smtpd_relay_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination

编辑/etc/postfix/master.cf，确保submission服务配置包含认证要求：

submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_helo_restrictions=
  -o smtpd_sender_restrictions=
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

重启Postfix生效：

systemctl restart postfix

2. 开启Roundcube的SMTP认证 #

修改Roundcube的config.inc.php配置文件，设置SMTP自动使用当前登录用户的凭据：

$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';

%u和%p会自动替换为当前登录用户的邮箱和密码，无需手动填写固定值。

3. 配置Dovecot的SASL认证接口 #

确保Dovecot提供的认证接口能被Postfix调用，编辑/etc/dovecot/conf.d/10-master.conf：

service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
  }
}

重启Dovecot生效：

systemctl restart dovecot

4. 测试SMTP连接与认证 #

用swaks工具直接测试SMTP发件，验证配置是否正常：

swaks --to test@example.com --from m.alikhani@rayancommerce.com --server 127.0.0.1:587 --auth-user m.alikhani@rayancommerce.com --auth-password 你的邮箱密码 --tls

如果测试成功，再回到Roundcube尝试发件。

5. 调整SELinux策略 #

CentOS的SELinux可能会阻止相关服务通信，执行以下命令开放权限：

setsebool -P postfix_can_sendmail on
setsebool -P httpd_can_sendmail on

内容的提问来源于stack exchange，提问作者Mehdi Alikhani