SASL Authentication Failed
Inspect mechanism availability, socket paths, credentials, TLS policy and Dovecot/Cyrus logs.
Production note: Back up configuration, run
postfix check, and stage changes before reloading.Recognize the symptom
Inspect mechanism availability, socket paths, credentials, TLS policy and Dovecot/Cyrus logs.
Capture timestamps, queue IDs, client/server addresses, and complete log lines before changing configuration.
Immediate triage
postfix status
postfix check
postqueue -p
journalctl -u postfix --since "30 minutes ago"Investigation path
- Confirm scope and first occurrence.
- Identify the relevant Postfix service.
- Query effective configuration with
postconf. - Reproduce with a controlled test.
- Compare against the last known-good state.
Recovery and verification
Make the smallest reversible correction, reload Postfix, repeat the controlled test, and monitor queue age and error rates.
Prevention
Add monitoring, configuration version control, documented ownership, and a tested rollback procedure.