DMS behind a STMP relay

[remogatto]

Hello everyone,

I have configured an SMTP relay on my homelab internal network and I want to use DMS as the exit node for my emails. In particular, I have a Grafana instance running on my homelab that is using the relay to send alerting messages. I have also configured a DMS instance on my public VPS. I created a do-not-reply@mydomain.com account and it is working correctly with my e-mail client: I can send and receive emails from the account. The relay is based on this project and it's configured in order to connect to the DMS through the port 465. However, when I send an email from Grafana through the relay, I get a "relay access denied" on the DMS side. Now I'm wondering if my use case is expected or if I'm doing something wrong. Relevant configuration follows. Please note that I'm using podman-systemd quadlets instead of compose files but I don't think it could be related to the issue. Thanks in advance.

EDIT: Also note that a letsencrypt certificate is generated for a whoami container in order to get traefik automation as in here.

EDIT 2: Add log from DMS

DMS logs

Mar 15 14:00:33 c0-homelab mailserver[4087249]: 2026-03-15T15:00:33.520296+01:00 mail postfix/postscreen[177517]: CONNECT from [REDACTED_IP]:44776 to [10.88.0.46]:25
Mar 15 14:00:33 c0-homelab mailserver[4087249]: 2026-03-15T15:00:33.520966+01:00 mail postfix/postscreen[177517]: PASS OLD [87.15.239.179]:44776
Mar 15 14:00:33 c0-homelab mailserver[4087249]: 2026-03-15T15:00:33.634933+01:00 mail postfix/smtpd[177611]: connect from REDACTED_HOST_IP
Mar 15 14:00:33 c0-homelab mailserver[4087249]: 2026-03-15T15:00:33.812148+01:00 mail postfix/smtpd[177611]: Anonymous TLS connection established from REDACTED_HOST_IP: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
Mar 15 14:00:33 c0-homelab mailserver[4087249]: 2026-03-15T15:00:33.976015+01:00 mail postfix/smtpd[177611]: NOQUEUE: reject: RCPT from REDACTED_HOST_IP: 554 5.7.1 <REDACTED_DEST_ADDRESS>: Relay access denied; from=<do-not-reply@REDACTED_DOMAIN> to=<REDACTED_DEST_ADDRESS> proto=ESMTP helo=<metrics>
Mar 15 14:00:34 c0-homelab mailserver[4087249]: 2026-03-15T15:00:34.011596+01:00 mail postfix/smtpd[177611]: disconnect from REDACTED_HOST_IP ehlo=2 starttls=1 mail=1 rcpt=0/1 quit=1 commands=5/6

smtprelay.container

[Container]
ContainerName=smtprelay
Environment=SMTP_SERVER=mail.mydomain.com
Environment=SMTP_PORT=465
Environment=SMTP_USERNAME=do-not-reply@mydomain.com
Environment=SMTP_PASSWORD=password
Environment=SERVER_HOSTNAME=smtp.int.mydomain.com
Image=docker.io/juanluisbaptiste/postfix
PublishPort=25:25
Volume=/etc/localtime:/etc/localtime:ro
AutoUpdate=registry

[Service]
Restart=always

[Install]
WantedBy=default.target

mailserver.container

[Container]
Image=ghcr.io/docker-mailserver/docker-mailserver:latest
AddCapability=CAP_NET_ADMIN
ContainerName=mailserver
PublishPort=993:993
PublishPort=465:465
PublishPort=25:25
PublishPort=143:143
Environment=LOG_LEVEL=info
Environment=ENABLE_UPDATE_CHECK=1
Environment=UPDATE_CHECK_INTERVAL=1d
Environment=PERMIT_DOCKER=none
Environment=TZ=Europe/Rome
Environment=ENABLE_SRS=0
Environment=ENABLE_OPENDKIM=1
Environment=ENABLE_OPENDMARC=1
Environment=ENABLE_POLICYD_SPF=1
Environment=ENABLE_IMAP=1
Environment=ENABLE_CLAMAV=1
Environment=ENABLE_RSPAMD=0
Environment=RSPAMD_LEARN=0
Environment=ENABLE_AMAVIS=1
Environment=AMAVIS_LOGLEVEL=0
Environment=ENABLE_DNSBL=0
Environment=ENABLE_FAIL2BAN=0
Environment=FAIL2BAN_BLOCKTYPE=drop
Environment=POSTSCREEN_ACTION=enforce
Environment=SSL_TYPE=letsencrypt
Environment=ENABLE_QUOTAS=1
Environment=LOGROTATE_INTERVAL=weekly
Environment=LOGROTATE_COUNT=4
Environment=POSTFIX_REJECT_UNKNOWN_CLIENT_HOSTNAME=0
Environment=POSTFIX_INET_PROTOCOLS=all
Environment=ENABLE_MTA_STS=0
Environment=DOVECOT_INET_PROTOCOLS=all
Environment=ENABLE_SPAMASSASSIN=1
Environment=ENABLE_SPAMASSASSIN_KAM=0
Environment=SPAMASSASSIN_SPAM_TO_INBOX=1
Environment=MOVE_SPAM_TO_JUNK=1
Environment=MARK_SPAM_AS_READ=0
Environment=SA_TAG=2.0
Environment=SA_TAG2=6.31
Environment=SA_KILL=10.0
Environment=ENABLE_FETCHMAIL=0
Environment=FETCHMAIL_POLL=300
Environment=FETCHMAIL_PARALLEL=0
Environment=ENABLE_GETMAIL=0
Environment=GETMAIL_POLL=5
Environment=DOVECOT_MAILBOX_FORMAT=maildir
Environment=SRS_SENDER_CLASSES=envelope_sender
Volume=/srv/podman/volumes/mailserver/mail-data:/var/mail:z
Volume=/srv/podman/volumes/mailserver/mail-state:/var/mail-state:z
Volume=/srv/podman/volumes/mailserver/mail-logs:/var/log/mail:z
Volume=/srv/podman/volumes/mailserver/config:/tmp/docker-mailserver:z
Volume=/srv/podman/volumes/traefik/certificates/acme.json:/etc/letsencrypt/acme.json:z
HostName = mail.mydomain.com
AutoUpdate=registry

[Service]
Restart=always

[Install]
WantedBy=default.target

grafana.container (only the relevant part)

[Container]
...
ContainerName=grafana
Environment=GF_SMTP_ENABLED=True
Environment=GF_SMTP_HOST=smtp.int.mydomain.com:25
Environment=GF_SMTP_SKIP_VERIFY=True
Environment=GF_SMTP_FROM_ADDRESS=do-not-reply@mydomain.com
Environment=GF_SMTP_FROM_NAME=Grafana
...

[remogatto]

Nevermind, It was a misconfiguration by my side (wrong DNS entry for the relay). I catched the error using swaks tool:

swaks --to noc@mydomain.com --from do-not-reply@mydomain.com --server smtp.int.mydomain.com # <--- that one has a wrong DNS entry

Closing the discussion, sorry for the noise and thank you for your work!

[usualdesigner]

This is mynetworks/trust, not a cert or port issue. DMS only relays for hosts it trusts (SASL auth or an IP in mynetworks), and with PERMIT_DOCKER=none your relay container's IP isn't automatically trusted even though it's on the same host. Two ways out: either bump PERMIT_DOCKER to a setting that trusts your docker network (check the docs table, there are a few levels), or better, set up SASL auth on the relay container so it authenticates to DMS on 465 instead of relying on IP trust — more portable if that relay's IP ever changes. The 'relay access denied' with no sasl_username in your log is the tell — it connected but never authenticated.