How to Fix 554 5.7.1 Relay Access Denied (Postfix, Gmail)

Updated: 18 October 2026 · Applies to: Postfix 3.10 with Dovecot 2.4 SASL on Debian 13 (tested); the same settings work on Ubuntu 24.04 and 26.04, AlmaLinux and Rocky Linux 9 and 10; cPanel (Exim) and Gmail from the vendors' documentation

554 5.7.1 <user@example.net>: Relay access denied means the mail server you connected to refused to pass your message on to another domain, because it does not know you: you did not log in (SMTP authentication) and your IP address is not on its trusted list. In most cases the fix is on the sending side: turn on authentication for the outgoing server in your mail app and send through port 587. If the error comes back when someone writes to your domain, the receiving server does not treat your domain as its own (step 4).

First look at the bounce: it names the server that answered, for example host mail.example.com said: 554 5.7.1 .... That server is the one to fix.

1. Sending from a mail app (the "relay access denied" when mailing Gmail)

When you send to a Gmail address and get this error, Gmail never saw the message: your own outgoing server refused it. Mail to colleagues on the same server often still works, because that is local delivery and not relaying. That is what we saw in the lab with a client that had not logged in: RCPT TO:<alice@example.com>, a mailbox on the same server, got 250 2.1.5 Ok, while the Gmail address was refused:

 -> MAIL FROM:<sender@example.net>
<-  250 2.1.0 Ok
 -> RCPT TO:<friend@gmail.com>
<** 454 4.7.1 <friend@gmail.com>: Relay access denied

Fix it in the outgoing (SMTP) settings of the mail app:

1. Server: your mail server's name, port 587, security STARTTLS (or port 465 with SSL/TLS if your server offers it).
2. Turn on authentication and use the same user name (usually the full email address) and password as for incoming mail. In Outlook, according to Microsoft, this is More Settings, Outgoing Server, My outgoing server (SMTP) requires authentication.
3. Send a test message to an outside address.

Websites and scripts need the same: log in to the SMTP server, see How to Send Email from PHP with SMTP (PHPMailer) and Set Up SMTP for WordPress Emails. Port numbers are explained in SMTP Port Numbers Explained: 25, 587, 465 and 2525.

2. Postfix: find the rule that refused the mail

The mail log has one line per refusal (/var/log/mail.log on Debian and Ubuntu, /var/log/maillog or journalctl -u postfix on AlmaLinux and Rocky Linux):

NOQUEUE: reject: RCPT from unknown[127.0.0.5]: 454 4.7.1 <friend@gmail.com>: Relay access denied; from=<sender@example.net> to=<friend@gmail.com> proto=ESMTP helo=<client.example.net>

(Lab example; the test client used 127.0.0.5, an address outside the trusted networks.) The settings that decide it:

$ postconf mynetworks smtpd_relay_restrictions
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination

These are the Debian 13 defaults. Postfix relays for clients in mynetworks and for clients that logged in; everyone else may only send to domains this server handles. With defer_unauth_destination the answer is the temporary 454 4.7.1; with reject_unauth_destination (common in older guides and custom configurations) it is the permanent 554 5.7.1. We saw both in the lab. A sending server retries after a 454 and bounces later; after a 554 it bounces at once.

3. Postfix: let your users log in (SMTP AUTH on port 587)

The usual way is Dovecot's authentication service. In /etc/postfix/main.cf:

smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth

In /etc/postfix/master.cf, enable the submission port:

submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_tls_auth_only=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject

Dovecot must offer its auth socket to Postfix (Dovecot 2.4 syntax):

service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
  }
}

Then sudo postfix check, sudo systemctl reload postfix dovecot. Our lab results on port 587:

• Without TLS, AUTH is not offered (Host did not advertise authentication), because of smtpd_tls_auth_only.
• TLS, no login: 554 5.7.1 <unknown[127.0.0.5]>: Client host rejected: Access denied
• Wrong password: 535 5.7.8 Error: authentication failed
• Correct login: 235 2.7.0 Authentication successful, then 250 2.1.5 Ok for the Gmail recipient.

A full Postfix and Dovecot setup is in How to Set Up an Email Server on Linux with Postfix and Dovecot.

For another server that must relay through yours without a password (a backup or application server with a fixed IP address), add only that address: sudo postconf -e 'mynetworks = 127.0.0.0/8 [::1]/128 198.51.100.20/32' and sudo postfix reload. Never add 0.0.0.0/0 or a whole provider range: that makes an open relay, which spammers find quickly and which gets your IP address blocklisted.

4. Mail to your own domain is refused

If outside senders, Gmail included, get "Relay access denied" when they write to you@yourdomain, your server does not list that domain as one it receives mail for. In the lab, bob@example.org got 454 4.7.1 ... Relay access denied until the domain was added:

sudo postconf -e 'virtual_alias_domains = example.org' 'virtual_alias_maps = hash:/etc/postfix/virtual'
echo 'bob@example.org alice' | sudo tee -a /etc/postfix/virtual
sudo postmap /etc/postfix/virtual
sudo postfix reload

After that the same test returned 250 2.1.5 Ok. Use mydestination for domains whose users are system accounts, or virtual_mailbox_domains if you use virtual mailboxes. Also check that the domain's MX record points to this server, especially after a migration: Email DNS Records Explained: MX, SPF, DKIM, DMARC and PTR.

5. cPanel servers (Exim)

Exim words it differently. According to cPanel, the bounce reads 550 Please turn on SMTP Authentication in your mail client ... is not permitted to relay through this server without authentication. For a mail app the fix is the same as step 1. If it happens to mail sent to a domain on the server, the domain's mail routing is usually set to remote: in cPanel open Email, Email Routing and choose Local Mail Exchanger (the domain should then be listed in /etc/localdomains, not /etc/remotedomains).

6. Sending through Gmail or Google Workspace

If your server or app relays through Google, the errors come from Google and look different. According to Google, smtp.gmail.com answers 530 5.7.0 Authentication required or 530 5.7.0 Must issue a STARTTLS command first when the client does not log in over TLS. The Workspace SMTP relay (smtp-relay.gmail.com) answers 550 5.7.0 Email relay denied with Invalid credentials for relay when your server's IP address is not registered. An administrator fixes that in the Admin console under Apps, Google Workspace, Gmail, Routing, SMTP relay service, by allowing the server's IP address or requiring SMTP authentication.

Port 25 is open on all Ucartz servers, so a VPS or dedicated server can deliver its own mail; follow the mail rules in section 3 of our Acceptable Use Policy. To read other Postfix errors, see How to read Postfix logs and understand common SMTP error codes.

Official documentation: postconf(5), Gmail SMTP errors and codes and cPanel Email Routing.