SMTP "554 5.7.1 Relay access denied": What It Means and Fixes

"Relay access denied" means you asked a mail server to deliver a message to an address in a domain it is not responsible for, and it does not trust you enough to forward it. Servers refuse that on purpose. A server that relays for anyone is an open relay and gets abused by spammers within hours.

You see it as a bounce or as an error in a mail client or application when sending. In a Postfix log it looks like this:

NOQUEUE: reject: RCPT from unknown[198.51.100.9]: 554 5.7.1 <friend@gmail.com>: Relay access denied; from=<me@example.com> to=<friend@gmail.com> proto=ESMTP helo=<laptop>

Exim says relay not permitted and some other servers say 550 5.7.1 Relaying denied. The cause is the same in all of them.

Causes, most likely first

1. Your client is not authenticating. SMTP AUTH is off in the client or application, or the credentials are not being sent.
2. You are connecting to the wrong server or port. For example, you point a mail client at the recipient's MX server, or at port 25, instead of your provider's submission server on 587 or 465.
3. The recipient domain is not hosted on this server, and no relay permission applies. Common when sending to your own domain's MX that points elsewhere.
4. Postfix or Exim restrictions are too strict, or mynetworks does not include your application server's IP.
5. The MX record of your own domain points to a server that does not know the domain, so inbound mail from outside is refused with the same message.

First: which direction is failing?

• Outgoing mail from you fails. Your client or app is talking to a server for which it is not authorized. Look at points 1, 2 and 4.
• Incoming mail to your domain bounces for senders. The receiving server does not consider itself responsible for your domain. Look at points 3 and 5.

Check where your domain's mail goes:

dig +short MX example.com

Or use the MX लुकअप tool. Then compare with the server you or your senders actually reach.

Fix for outgoing mail: authenticate on the submission port

Use these settings for SMTP submission, with the host name from your provider:

Test from the command line with the swaks tool (install from your package manager):

swaks --to friend@gmail.com --from me@example.com \
  --server smtp.example.com --port 587 --tls \
  --auth LOGIN --auth-user me@example.com

If authentication succeeds and relaying is still denied, the account may not be allowed to send for that From address. If authentication fails instead, see SMTP 535 authentication failed.

Many hosts and ISPs block outbound port 25 from consumer and cloud networks, so use 587 or 465 for sending. Confirm a port is open with the पोर्ट चेकर.

Fix on your own Postfix server

Check the relay-related settings:

postconf -n | grep -E "smtpd_relay_restrictions|smtpd_recipient_restrictions|mynetworks|relay_domains|virtual_mailbox_domains|mydestination"

A safe, modern baseline in /etc/postfix/main.cf is:

smtpd_relay_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    defer_unauth_destination

defer_unauth_destination is what produces "Relay access denied" for senders who are neither trusted nor authenticated, so it should stay. To let authenticated users send, SASL must be configured (smtpd_sasl_auth_enable = yes, usually backed by Dovecot) and the submission service enabled in master.cf. Add your application server to mynetworks only if it is a fixed, trusted address and you cannot use authentication.

If the denial is for incoming mail to your own domain, make Postfix aware of it by adding the domain to virtual_mailbox_domains, virtual_alias_domains or mydestination, depending on your design, and run sudo postfix reload. For Exim, check that the domain is listed in local_domains or relay_to_domains.

Fix for incoming mail: correct the MX record

If senders get this bounce when emailing you, the MX for your domain probably points to a server that does not host your mailboxes, for example a web host's server after you moved email to another provider. Update the MX to the host given by your mail provider and wait for DNS to propagate; see MX records explained और how long DNS propagation takes. Verify with the MX लुकअप and the Email DNS Checker.

How to verify

Send a test message to an outside address with swaks or your mail client and confirm it is accepted (250 2.0.0 OK). Check the mail log for status=sent. For inbound fixes, send from an external account and check that it arrives, and confirm the MX and A records with the DNS चेकर. Verify that you did not create an open relay by testing from outside with an unauthenticated address; the server must still say "Relay access denied" for foreign recipients.

अगले कदम

• Look up your mail routing with the MX लुकअप.
• Test connectivity with the पोर्ट चेकर.
• Read email bounce codes explained.
• If messages are accepted but rejected later, see SMTP 550 5.7.1 rejected.

सामान्य प्रश्न

Is relay access denied a spam problem?

Not usually. It is an authorization problem: the server refused to forward your message. Authenticate or send through the correct server.

Which port should I use to send mail?

Use 587 with STARTTLS or 465 with implicit TLS, both with authentication. Port 25 is meant for server to server delivery and is often blocked for clients.

Why does it work from one device but not another?

The working device may be in a trusted network (mynetworks) or authenticating, while the other is not. Compare client settings and IP addresses.

Should I turn relay checks off to make it work?

No. Disabling them creates an open relay. Fix authentication or the allowed networks instead.

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.