SMTP 550 5.7.1: relay access denied and policy rejections

What the message looks like

550 5.7.1 <info@beispiel.de>: Relay access denied

Common causes

• The mail client or application sends without SMTP AUTH.
• Mail is submitted on port 25 instead of submission port 587 (or 465) with login.
• The recipient domain is missing from virtual_mailbox_domains, mydestination or relay_domains.
• The application server's IP is not in mynetworks.
• The receiving server (e.g. an Exchange receive connector) rejects the sender or IP by policy.

Check

1. Show Postfix relay settings
   postconf -n | grep -E 'mynetworks|relay_domains|smtpd_relay_restrictions|virtual_mailbox_domains'Copy
2. Find rejected attempts and client IPs in the log
   journalctl -u postfix --since '1 hour ago' | grep 'Relay access denied'Copy
3. Test authenticated submission on port 587 (prompts for the password)
   swaks --to test@example.com --from info@example.com --server mail.example.com --port 587 --tls --auth LOGIN --auth-user info@example.comCopy
4. Check that the submission ports are listening
   ss -ltnp | grep -E ':(25|465|587) 'Copy

Fix

• Enable SMTP AUTH in the client and use port 587 with STARTTLS.
• Add your domains to virtual_mailbox_domains or relay_domains, then run postfix reload.
• Set clean relay rules: smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination.
• Add fixed internal servers to mynetworks as single /32 entries – never whole networks.
• If a remote server rejects you, read the full bounce text and clarify the named policy with the recipient's admin.

FAQ

Does 550 5.7.1 always mean relay access denied?

No. 5.7.1 is a generic policy code. Microsoft 365, spam filters and sender restrictions use it too. The text after the code tells you what actually happened.

Can I just widen mynetworks?

Only for single trusted hosts. Something like 0.0.0.0/0 turns the server into an open relay that ends up on blocklists within hours.