Postfix: SASL authentication failed; cannot authenticate to server (no mechanism available)

What the message looks like

postfix/smtp[2314]: warning: SASL authentication failure: No worthy mechs found
postfix/smtp[2314]: 4F1A2B3C4D: SASL authentication failed; cannot authenticate to server smtp.example.com[203.0.113.10]: no mechanism available

Common causes

• The package with the SASL mechanisms is missing: libsasl2-modules. That gives “no mechanism available”.
• The user name or password in /etc/postfix/sasl_passwd is wrong, or the file was changed but postmap was not run.
• The key in sasl_passwd does not match relayhost exactly, for example the square brackets or the port.
• The provider offers login only over TLS, but smtp_tls_security_level is not set.
• smtp_sasl_security_options forbids the mechanism the provider offers.

Check

1. Is the SASL module package installed?
   dpkg -l | grep libsasl2-modulesCopy
2. Relay, SASL and TLS settings
   postconf -n | grep -E 'relayhost|smtp_sasl|smtp_tls'Copy
3. Does the stored key match the relay host?
   sudo postmap -q '[smtp.example.com]:587' /etc/postfix/sasl_passwdCopy
4. What does the log say?
   journalctl -u postfix --since '1 hour ago' --no-pager | grep -i sasl | tail -n 10Copy

Fix

• Install the modules: apt install libsasl2-modules.
• Set the relay with brackets and the port: relayhost = [smtp.example.com]:587.
• Enable login and TLS: smtp_sasl_auth_enable = yes, smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd, smtp_sasl_security_options = noanonymous, smtp_tls_security_level = encrypt.
• Put [smtp.example.com]:587 user:password in sasl_passwd, then postmap /etc/postfix/sasl_passwd and chmod 600 /etc/postfix/sasl_passwd*.
• Reload: postfix reload, and test with a mail.

FAQ

What does “no mechanism available” mean?

Postfix has no usable SASL mechanism for this server. Either the plugin package is missing, or the server offers its mechanisms only after STARTTLS, which Postfix did not start.

How is this different from error 535?

With 535 the server answered and refused the credentials. Here Postfix could not even try.