RHEL 10 – Postfix starts but mail remains deferred due to SELinux policy denial – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Postfix service is active but outbound/inbound messages accumulate in deferred queue.

Environment & Reproduction

Seen after relay path changes, custom spool mounts, or policy tightening.

systemctl status postfix
postqueue -p | head -n 30
mailq | wc -l

Root Cause Analysis

SELinux policy denies Postfix process access to required network or filesystem resources.

Quick Triage

Correlate queue errors with audit denials.

journalctl -u postfix -n 80 --no-pager
ausearch -m avc -ts recent | tail -n 40
getenforce

Step-by-Step Diagnosis

Check relevant SELinux booleans, labels, and relay connectivity.

getsebool -a | grep postfix
ls -Zd /var/spool/postfix
ss -lntp | grep ':25 '

Solution – Primary Fix

Set required Postfix SELinux booleans and relabel spool path.

sudo setsebool -P allow_postfix_local_write_mail_spool on
sudo restorecon -Rv /var/spool/postfix
sudo systemctl restart postfix

Solution – Alternative Approaches

Generate minimal local policy module if denial is valid and repeated.

sudo ausearch -m avc -ts recent | audit2allow -M postfix_local
sudo semodule -i postfix_local.pp

Verification & Acceptance Criteria

Deferred queue drains and new messages are delivered successfully.

postqueue -f
mailq
journalctl -u postfix -n 40 --no-pager

Rollback Plan

Remove custom module/booleans if policy broadening is deemed unsafe.

sudo semodule -r postfix_local || true
sudo setsebool -P allow_postfix_local_write_mail_spool off

Prevention & Hardening

Review AVC alerts during change windows and avoid disabling SELinux.

sealert -a /var/log/audit/audit.log | head -n 60
getenforce

Related Errors & Cross-Refs

Related to DNS resolver issues, firewall SMTP blocks, and relay credential failures.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL mail server and SELinux policy tuning documentation for Postfix.