Can't receive mail, Relay access denied

Question

Hello all,
I am new to Ma c OS Server, so i apologize if this topic has already been covered before. However, I have spent several hours browsing through different discussions and still couldn't figure out where my problem is.
I have set up a new Mac OS X Snow Leopard server with Mail services enabled. I have went through routine of configuring DNS, Open Directory and adding users. I could eventually run Mail services for the client for the outgoing mail, but I can't receive any incoming mail. Mail logs keep telling me that relay access is denied. Here is the example of this:
Jun 28 12:13:15 paulmacserver postfix/smtpd[5895]: NOQUEUE: reject: RCPT from va3ehsobe006.messaging.microsoft.com[216.32.180.16]: 554 5.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<VA3EHSOBE007.bigfish.com>
Jun 28 12:13:15 paulmacserver postfix/smtpd[5895]: disconnect from va3ehsobe006.messaging.microsoft.com[216.32.180.16]
Here is the log from postconf -n command:
paulmacserver:~ administrator$ postconf -n
biff = no
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/libexec/postfix
debug_peer_level = 2
enable_server_options = yes
header_checks =
html_directory = /usr/share/doc/postfix/html
inet_interfaces = all
mail_owner = _postfix
mailbox_size_limit = 0
mailbox_transport = dovecot
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
message_size_limit = 10485760
mydestination = $myhostname, localhost.$mydomain, localhost, mail.lifefor.net
mydomain = lifefor.net
mydomain_fallback = localhost
myhostname = paulmacserver.lifefor.net
mynetworks = 127.0.0.0/8
newaliases_path = /usr/bin/newaliases
queue_directory = /private/var/spool/postfix
readme_directory = /usr/share/doc/postfix
recipient_delimiter = +
relayhost =
sample_directory = /usr/share/doc/postfix/examples
sendmail_path = /usr/sbin/sendmail
setgid_group = _postdrop
smtpd_client_restrictions = permit_mynetworks permit_sasl_authenticated permit
smtpd_enforce_tls = no
smtpd_helo_required = no
smtpd_helo_restrictions =
smtpd_pw_server_security_options = gssapi,cram-md5
smtpd_recipient_restrictions = permit_sasl_authenticated permit_mynetworks  reject_unauth_destination permit
smtpd_sasl_auth_enable = yes
smtpd_tls_CAfile = /etc/certificates/paulmacserver.lifefor.net.6067B0918DA5FE13DDE10C3696E054EF3D3 29F34.chain.pem
smtpd_tls_cert_file = /etc/certificates/paulmacserver.lifefor.net.6067B0918DA5FE13DDE10C3696E054EF3D3 29F34.cert.pem
smtpd_tls_exclude_ciphers = SSLv2, aNULL, ADH, eNULL
smtpd_tls_key_file = /etc/certificates/paulmacserver.lifefor.net.6067B0918DA5FE13DDE10C3696E054EF3D3 29F34.key.pem
smtpd_use_pw_server = yes
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550
virtual_alias_maps = $virtual_maps
paulmacserver:~ administrator$
The server sits behind firewall and has NAT routing of port 25 to the local network address of the server. Local network address range - 192.168.10.0/24, server address - 192.168.10.5, gateway address - 192.168.10.1.
paulmacserver:~ administrator$ dig lifefor.net
; <<>> DiG 9.6.0-APPLE-P2 <<>> lifefor.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29752
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;lifefor.net.                              IN          A
;; AUTHORITY SECTION:
lifefor.net.                    10800          IN          SOA          paulmacserver.lifefor.net. administrator.lifefor.net.lifefor.net. 2011062801 86400 3600 604800 345600
;; Query time: 1 msec
;; SERVER: 192.168.10.5#53(192.168.10.5)
;; WHEN: Tue Jun 28 11:21:16 2011
;; MSG SIZE  rcvd: 105
paulmacserver:~ administrator$ sudo changeip -checkhostname
WARNING: Improper use of the sudo command could lead to data loss
or the deletion of important system files. Please double-check your
typing when using sudo. Type "man sudo" for more information.
To proceed, enter your password, or type Ctrl-C to abort.
Password:
Primary address     = 192.168.10.5
Current HostName    = paulmacserver.lifefor.net
DNS HostName        = paulmacserver.lifefor.net
The names match. There is nothing to change.
dirserv:success = "success"
All appears to be OK... But I still couldn't make incoming e-mail to work. What do I have wrong?
Thanks in advance!

Answer 1

I dislike split-horizon DNS configurations, and that looks to be what you are trying here.
Based on changeip, your private DNS looks OK, but your public DNS is incorrect.
In particular, you have no reverse DNS for your public IP address 80.244.227.174.  Work with your ISP to get that to mail.lifefor.net.  This misconfiguration will usually cause issues with outbound mail; many remote servers won't accept mail arriving from this server.
This entry mydestination = $myhostname, localhost.$mydomain, localhost, mail.lifefor.net does not include your domain name.  You'll want to add $mydomain into the list you'll accept mail for within Server Admin.  This is likely the central trigger for the relay error.
Additionally, you will probably want to have your mail server host configured to use the internet host name mail.lifefor.net within the mail setup (or switch your public name to paulmacserver); you're running split-horizon DNS, and you've chosen to use two different host names for this box.  It's both mail.lifefor.net and paulmacserver.lifefor.net.  It's possible to do that, but it tends to confuse things.
As for errata, you'll want to enable anti-spam and add zen.spamhaus.org or analogous within Server Admin to fix your current accept-from-everywhere setup.  With those changes, you'll see smtpd_recipient_restrictions add check_policy_service unix:private/policy and smtpd_client_restrictions will add reject_rbl_client zen.spamhaus.org