各位大佬好，我在搭建Postfix+Dovecot邮件服务器时遇到了Thunderbird无法接收邮件的问题，折腾了好一阵还是没搞定，想请大家帮忙排查下~

环境概述 #

• 服务器：Ubuntu Server最新版，IP 192.168.1.16，主机名ubuntuserver，Postfix的myhostname设为ubuntumailsystem
• 客户端：Ubuntu Desktop最新版，IP 192.168.1.21，主机名clientnorbert-1-2
• 服务端口：Postfix SMTP用25端口，Dovecot IMAP用143端口
• 邮件客户端：两端都用Thunderbird，目前配置的是无连接安全、明文密码认证

核心问题现象 #

1. 发送邮件时Postfix日志反复出现error looking up passwd info for clientnorbert: No such file or directory，导致大量邮件状态为deferred（延迟）
2. 重启Postfix后出现smtpd致命错误：127:0.0.1:8891: valid hostname or network address required，smtpd进程启动失败
3. Dovecot日志出现SSL握手失败记录：SSL_accept() failed: error:0A000412:SSL routines::sslv3 alert bad certificate
4. 虽然部分邮件日志显示status=sent（已发送），但Thunderbird客户端完全收不到邮件

已做的配置内容 #

Postfix配置（postconf -n输出） #

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
compatibility_level = 3.6
home_mailbox = maildir:~/Maildir
inet_interfaces = all
inet_protocols = all
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
mydestination = ubuntuserver.home, ubuntumailsystem, ubuntuserver, localhost.localdomain, localhost
mydomain = ubuntuserver
myhostname = ubuntumailsystem
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.1.0/24
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relayhost =
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt
smtpd_tls_key_file = /etc/ssl/private/smtpd.key
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
virtual_alias_domains = clientnorbert-1-2
virtual_alias_maps = hash:/etc/postfix/virtual

Dovecot配置（dovecot -n输出） #

# 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.5.20 (149edcf2)
# OS: Linux 6.5.0-17-generic x86_64 Ubuntu 23.10
# Hostname: ubuntuserver
auth_verbose = yes
disable_plaintext_auth = no
mail_location = maildir:~/Maildir
passdb {
args = /etc/dovecot/passwd
driver = passwd-file
}
pop3_uidl_format = %g
protocols = pop3 imap
service auth {
unix_listener /var/spool/postfix/private/auth {
group = postfix
mode = 0600
user = postfix
}
}
ssl = no
userdb {
args = uid=vmail gid=vmail home=/home/vmail/%u
driver = static
}

系统别名配置（/etc/aliases） #

# See man 5 aliases for format
postmaster:    norbert
clamav: root
root: norbert@ubuntumailsystem

Postfix虚拟映射配置（/etc/postfix/virtual） #

norbert@ubuntumailsystem    norbert
clientnorbert@ubuntumailsystem  clientnorbert
clientnorbert@clientnorbert-1-2 clientnorbert

Dovecot密码文件（/etc/dovecot/passwd） #

norbert@ubuntumailsystem:{PLAIN}ubuntu::::::
clientnorbert@ubuntumailsystem:{PLAIN}ubuntu::::::

Thunderbird具体配置 #

服务器端（ubuntuserver上的norbert@ubuntumailsystem）

• IMAP：服务器名ubuntumailsystem，端口143，连接安全选「无」，认证方式「密码，不安全传输」
• SMTP：服务器名ubuntumailsystem，端口25，用户名norbert@ubuntumailsystem，连接安全选「无」，认证方式「密码，不安全传输」

客户端（clientnorbert-1-2上的clientnorbert@ubuntumailsystem）

• IMAP：服务器名192.168.1.16，端口143，用户名clientnorbert@ubuntumailsystem，连接安全选「无」，认证方式「密码，不安全传输」
• SMTP：服务器名192.168.1.16，端口25，用户名clientnorbert@ubuntumailsystem，连接安全选「无」，认证方式「密码，不安全传输」

关键日志片段 #

初始发送成功但带延迟错误的日志 #

2024-02-19T16:04:34.634091+00:00 ubuntuserver postfix/smtpd[14514]: connect from clientnorbert-1-2[192.168.1.21]
2024-02-19T16:04:34.671871+00:00 ubuntuserver postfix/smtpd[14514]: A4027E1FBA: client=clientnorbert-1-2[192.168.1.21], sasl_method=PLAIN, sasl_username=clientnorbert@ubuntumailsystem
2024-02-19T16:04:34.689052+00:00 ubuntuserver postfix/cleanup[14517]: A4027E1FBA: message-id=<0030a836-f965-488f-a802-c6a75347d83b@ubuntumailsystem>
2024-02-19T16:04:34.693262+00:00 ubuntuserver postfix/qmgr[14473]: A4027E1FBA: from=<clientnorbert@ubuntumailsystem>, size=577, nrcpt=1 (queue active)
2024-02-19T16:04:34.707728+00:00 ubuntuserver postfix/local[14475]: A4027E1FBA: to=<norbert@ubuntuserver>, orig_to=<norbert@ubuntumailsystem>, relay=local, delay=0.04, delays=0.03/0/0/0.01, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
2024-02-19T16:14:20.220805+00:00 ubuntuserver postfix/local[15073]: warning: error looking up passwd info for clientnorbert: No such file or directory
2024-02-19T16:14:20.225083+00:00 ubuntuserver postfix/local[15074]: B8C66E1FBA: to=<clientnorbert@ubuntuserver>, orig_to=<clientnorbert@ubuntumailsystem>, relay=local, delay=531, delays=531/0.02/0/0.01, dsn=4.0.0, status=deferred (user lookup error)

后续出现的新错误日志 #

2024-02-20T10:50:55.467018+00:00 ubuntuserver dovecot: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:0A000412:SSL routines::sslv3 alert bad certificate: SSL alert number 42 (disconnected before auth was ready, waited 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:0A000412:SSL routines::sslv3 alert bad certificate: SSL alert number 42, session=<OAEV/M0Rkt9/AAAB>
2024-02-20T10:29:24.401307+00:00 ubuntuserver postfix/smtpd[14643]: fatal: 127:0.0.1:8891: valid hostname or network address required
2024-02-20T10:29:25.391343+00:00 ubuntuserver postfix/master[14637]: warning: process /usr/lib/postfix/sbin/smtpd pid 14643 exit status 1

已尝试的操作 #

• 配置了Postfix的virtual_alias_domains和virtual_alias_maps来映射邮箱账号
• 用useradd和passwd在系统中创建了clientnorbert用户
• 完全按照某GitHub教程的步骤配置，但还是出现各种错误

想请教的问题 #

1. 目前的核心问题是SASL机制配置不当、Dovecot LDA未配置，还是SSL相关设置导致的？
2. 明明Postfix日志显示邮件status=sent，但Thunderbird收不到，可能的原因是什么？
3. Postfix启动时出现的127:0.0.1:8891: valid hostname or network address required错误该怎么解决？
4. 现在这种测试环境下，应该用STARTTLS、TLS/SSL还是保持「None」的连接安全设置？

备注：内容来源于stack exchange，提问作者Doujinx