1) Initial checks to perform – 

You need to check if can reach the TCP ports below –

As mail servers commonly use Ports

25 – Standard SMTP for sending emails

587 – SMTP Submission (used for sending mail securely)

465 – SMTPS (less common, secure SMTP)

143 / 993 – IMAP (143 is standard, 993 is secure)

110 / 995 – POP3 (110 is standard, 995 is secure)

From a remote host:

telnet: telnet mail.domain_name 25

nc: nc -vz mail.domain_name 25

openssl for TLS: openssl s_client -connect mail.domain:465 -crlf

Check whether local services are running:

– For Zimbra: sudo su – zimbra -c “zmcontrol status”

– For Postfix (standalone): systemctl status postfix

If you discover that a port is closed, there could be a few reasons behind it. One common cause is a firewall , either on the server or somewhere in the network , that’s blocking traffic to that port. Another possibility is packet filtering, like rules set up with iptables, firewalld, or even an upstream router, which may be stopping connections from getting through. Additionally, the service expected to handle traffic on that port, such as Zimbra or Postfix for mail-related ports, may not actually be running or listening on the interface. 

In such cases, it’s important you need to verify whether the service is active on the server ,and service is properly bound to the correct IP address, and configured to accept incoming connections.

2) Check listening sockets and bound addresses

First, make sure your server is actually listening on the correct ports and addresses. 

If you notice that Postfix is only bound to localhost (127.0.0.1) but you want it to accept mail from outside, then take a look at the inet_interfaces setting in main.cf and update it accordingly.

3) Logs – We need to check these below logs paths on the server below for zimbra and postfix base service –

 Zimbra: /var/log/zimbra.log

If your mail is delivered to the MTA, but not to the mailbox and if you are seeing below in the logs  /var/log/zimbra.log

postfix/lmtp … deferred … connection refused

So as per the above error, there is no connection with port 7025 in order to perform the local mail transfer protocol for the delivery. 

As this issue mostly cause with the host those are configured on private IP and those does not have public IP interface on the server, 

so we can fix this issue by using native IP address lookup for lmtp instead of DNS. 

– Postfix:

You can look for connection attempts, TLS errors, and “lost connection” or “connection timed out”.

4) Firewall and network rules

– On the server:

– In cloud environments, we need to verify security groups / network ACLs allow inbound on ports 25, 587, 465 as needed

5) DNS and reverse DNS 

You need to check and ensure the MX records point to the correct host and that that host’s A record and PTR resolve properly . If not need to add the rDNS on the server. 

6) Certificates and TLS handshake problems

Expired or misconfigured certs will break SMTPS and submission with STARTTLS.

openssl s_client -starttls smtp -connect mail.domain:587 -showcerts

Look for “verify return code” and certificate chain problems in logs and openssl output.

7) Zimbra-specific checks

– If upgrades were done recently, verify Zimbra services were started and correct ports bound.

8) Postfix-specific checks

9) SELinux 

SELinux can block network bindings or file reads for certs:   – getenforce

10) use below commands to perform the few checks 

Run the following commands –

11) Check for Disk Space

You need to check and make sure there is sufficient disk space is free on the server, as disk full can also lead the emails issues. 

12) Common fixes based on findings

If you manage Zimbra or Postfix, you’ve probably seen situations where everything seems fine, yet mail just won’t move. However, our expert team can help you with this in a blink.