RHEL 7 Postfix queue growth due to DNS and firewalld egress restrictions

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Outgoing mail accumulates in deferred queue and delivery latency increases significantly. Alerts and business notifications are delayed, impacting operational awareness and customer communications.

Environment & Reproduction

Seen after DNS resolver changes, firewall hardening, or relay policy updates. Reproduce by blocking DNS/SMTP egress and sending test mail through Postfix.

Root Cause Analysis

Postfix cannot resolve MX records or connect to relay destinations because DNS or outbound ports are blocked. Queue manager retries but messages remain deferred until connectivity returns.

Quick Triage

Check mailq, test DNS resolution, and verify firewalld egress. Review systemctl status postfix and journalctl -u postfix for timeout, host lookup, or relay refusal messages.

Step-by-Step Diagnosis

Trace one deferred message end-to-end, validate resolver configuration, and test TCP reachability to relay hosts. Use journalctl correlation to confirm whether failures are DNS or transport-related.

Solution – Primary Fix

Correct resolver settings, permit required SMTP/DNS traffic in firewalld, and reload postfix with systemctl reload postfix or service postfix reload. Process queued mail after connectivity is restored.

Solution – Alternative Approaches

Use authenticated smart host, add redundant DNS resolvers, or route notifications through secondary messaging channels during SMTP incidents.

Verification & Acceptance Criteria

Deferred queue should drain, new test messages should deliver within SLA, and journalctl must show successful connection and delivery logs without recurring retries.

Rollback Plan

Restore prior DNS and firewall configuration from backups if changes cause side effects. Keep message queue intact and avoid destructive cleanup until delivery path is validated.

Prevention & Hardening

Monitor queue depth and resolver health, codify firewalld egress policy for mail hosts, and test relay endpoints periodically. Keep SELinux contexts and postfix policies consistent after changes.

Related Errors & Cross-Refs

Common related messages include Name service error and Connection timed out in postfix logs. Cross-reference network ACL changes and resolver service restarts around incident start times.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

See Postfix and DNS operations documentation, Red Hat mail service guides, and internal incident runbooks for queued mail handling.