Iis – SMTP fails with Status: 5.3.5 when sending to a local mail server

TLS just enables encryption on the smtp session and doesn't directly affect whether or not Postfix will be allowed to relay a message.

The relaying denied message occurs because the smtpd_recipient_restrictions rules was not matched. One of those conditions must be fulfilled to allow the message to go through:

smtpd_recipient_restrictions =
    permit_sasl_authenticated
    check_recipient_access hash:/etc/postfix/filtered_domains
    permit_mynetworks
    reject_unauth_destination

To explain those rules:

permit_sasl_authenticated

permits authenticated senders through SASL. This will be necessary to authenticate users outside of your network which are normally blocked.

check_recipient_access

This will cause postfix to look in /etc/postfix/filtered_domains for rules based on the recipient address. (Judging by the file name on the file name, it is probably just blocking specific domains... Check to see if gmail.com is listed in there?)

permit_mynetworks

This will permit hosts by IP address that match IP ranges specified in $mynetworks. In the main.cf you posted, $mynetworks was set to 127.0.0.1, so it will only relay emails generated by the server itself.

Based on that configuration, your mail client will need to use SMTP Authentication before being allowed to relay messages. I'm not sure what database SASL is using. That is specified in /usr/lib/sasl2/smtpd.conf Presumably it also uses the same database as your virtual mailboxes, so you should be able enable SMTP authentication in your mail client and be all set.

This could be caused from 1 of 3 potential issues. Either A) Google mail is catching the email as spam, B) something on the local machine is hotwiring the emails or C) the SMTP server isn't setup correctly to allow relaying.

In the case of A), it's worth doing in any case. In your TXT record for your DNS zone, make sure to add all of the IP addresses used for outgoing email from your server. Maybe it's 82.80.200.20 and already there if your web server only has 1 IP address, but best to confirm. If you are sending from something not listed as an approved SPF sending server then your messages will be flagged as potential spam. Also, check for any unusual patterns in your emails that gmail may not like (blank subjects, spamming keywords, etc).

For B), confirm that your IIS SMTP settings don't define your domain name as an account. The IIS install should be very straight forward. Basically just set 127.0.0.1 as an allowed relay, everything else should be default for an outgoing smtp server.

For C), it's basically what I mentioned in the previous point, to make sure that you have the relay set to 127.0.0.1, or you're authenticating when sending.

Another test is to send to a non-gmail account and see if it arrives. That will confirm that the smtp server is working correctly.

Additionally, you can do a nslookup test to confirm that there isn't another DNS server hotwiring DNS. You can test it with the following from the command line:

nslookup
set type=mx
yourdomain.com