Repository navigation
Inconsistent maximum message size #7318
Description
Contribution guidelines
- I've read the contribution guidelines and wholeheartedly agree
Checklist prior issue creation
- I understand that failure to follow below instructions may cause this issue to be closed.
- I understand that vague, incomplete or inaccurate information may cause this issue to be closed.
- I understand that this form is intended solely for reporting software bugs and not for support-related inquiries.
- I understand that all responses are voluntary and community-driven, and do not constitute commercial support.
- I confirm that I have reviewed previous issues to ensure this matter has not already been addressed.
- I confirm that my environment meets all prerequisite requirements as specified in the official documentation.
Description
The message size limit configured in each service is inconsistant. We have received issue reports that mails are stuck in outbound message queues of other servers because mailcow temporarily rejects these messages forever.
The problem seems to be a mismatch between different configurations. https://docs.mailcow.email/manual-guides/Postfix/u_e-postfix-attachment_size/ very helpfully lists all the places to look at, and comparing to this repo we found the following:
postfix configures 104857600 (100 MB)
rspamd configures 20971520 for clamav (20 MB)
rspamd configures 3145728 (3MB) for olefy
clamav configures 25 MB / 50MB
Maybe I missed some.
This is causing difficult to debug delivery failures for us because the upstream mailserver will retry until their timeout, because mail is neither rejected nor approved. I am not entirely sure which of these settings is at fault, but the problem definitely occurs with mails > 50 MB
Steps to reproduce:
- Send a mail with an attachment > 50 MB from a server that supports this message size
- Notice that the mail gets temporarily rejected forever
Logs:
postfix-mailcow-1 | 2026-06-18T23:50:20.039385917Z Jun 19 01:50:20 3d5eca37d0ad postfix/smtpd[141546]: connect from <upstream>[1.2.3.4]
postfix-mailcow-1 | 2026-06-18T23:50:20.061853368Z Jun 19 01:50:20 3d5eca37d0ad postfix/smtpd[141546]: Anonymous TLS connection e
stablished from <upstream>[1.2.3.4]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519
server-signature RSA-PSS (4096 bits) server-digest SHA256
postfix-mailcow-1 | 2026-06-18T23:50:20.162536206Z Jun 19 01:50:20 3d5eca37d0ad postfix/smtpd[141546]: 277098B3BB: client=<upstream>[1.2.3.4]
postfix-mailcow-1 | 2026-06-18T23:50:20.564447432Z Jun 19 01:50:20 3d5eca37d0ad postfix/cleanup[141728]: 277098B3BB: message-id=<
7CBA5DDF-F5DF-4495-811B-D9ED0C659225@fu-berlin.de>
rspamd-mailcow-1 | 2026-06-18T23:50:21.501079605Z 2026-06-19 01:50:21 #33(rspamd_proxy) <8ceb8e>; proxy; proxy_backend_master_er
ror_handler: cannot connect to upstream, maximum retries has been reached: 5
postfix-mailcow-1 | 2026-06-18T23:50:21.502490454Z Jun 19 01:50:21 3d5eca37d0ad postfix/cleanup[141728]: warning: milter inet:rsp
amd:9900: can't read SMFIC_BODYEOB reply packet header: Application error
postfix-mailcow-1 | 2026-06-18T23:50:21.502532703Z Jun 19 01:50:21 3d5eca37d0ad postfix/cleanup[141728]: 277098B3BB: milter-reject: END-OF-MESSAGE from <upstream>[1.2.3.4]: 4.7.1 Service unavailable - try again later; from=<redacted@upstream> to=<redacted@downstream> proto=ESMTP helo=<<upstream>>
postfix-mailcow-1 | 2026-06-18T23:50:21.517726768Z Jun 19 01:50:21 3d5eca37d0ad postfix/smtpd[141546]: disconnect from <upstream>[1.2.3.4] ehlo=2 starttls=1 mail=1 rcpt=1 data=0/1 quit=1 commands=6/7
Which branch are you using?
master (stable)
Which architecture are you using?
x86_64
Operating System:
Debian 13
Server/VM specifications:
12 Cores / 8 GB
Is Apparmor, SELinux or similar active?
apparmor
Virtualization technology:
kvm
Docker version:
Docker version 29.6.0, build fb59821
docker-compose version or docker compose version:
Docker Compose version v5.1.4
mailcow version:
2026-05c
Reverse proxy:
caddy
Logs of git diff:
# git diff origin/master
diff --git a/data/conf/postfix/main.cf b/data/conf/postfix/main.cf
index f091cb3f..9f006516 100644
--- a/data/conf/postfix/main.cf
+++ b/data/conf/postfix/main.cf
@@ -174,3 +174,26 @@ lmtp_destination_recipient_limit=1
# DO NOT EDIT ANYTHING BELOW #
# Overrides #
+
+postscreen_dnsbl_sites = wl.mailspike.net=127.0.0.[18;19;20]*-2
+ hostkarma.junkemailfilter.com=127.0.0.1*-2
+ list.dnswl.org=127.0.[0..255].0*-2
+ list.dnswl.org=127.0.[0..255].1*-4
+ list.dnswl.org=127.0.[0..255].2*-6
+ list.dnswl.org=127.0.[0..255].3*-8
+ bl.spamcop.net*2
+ bl.suomispam.net*2
+ hostkarma.junkemailfilter.com=127.0.0.2*3
+ hostkarma.junkemailfilter.com=127.0.0.4*2
+ hostkarma.junkemailfilter.com=127.0.1.2*1
+ backscatter.spameatingmonkey.net*2
+ bl.ipv6.spameatingmonkey.net*2
+ bl.spameatingmonkey.net*2
+ b.barracudacentral.org=127.0.0.2*7
+ bl.mailspike.net=127.0.0.2*5
+ bl.mailspike.net=127.0.0.[10;11;12]*4
+
+
+# User Overrides
+myhostname = <redacted>
+
Logs of iptables -L -vn:
# iptables -L -vn
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
29M 36G MAILCOW all -- * * 0.0.0.0/0 0.0.0.0/0 /* mailcow */
58M 69G DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0
58M 69G DOCKER-FORWARD all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:12345
171 8688 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:4190
1874 109K ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:995
35472 2155K ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:993
4538 300K ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:143
4133 244K ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:110
14687 865K ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.253 tcp dpt:587
47695 2852K ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.253 tcp dpt:465
36921 2165K ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.253 tcp dpt:25
0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.7 tcp dpt:3306
0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.249 tcp dpt:6379
0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.3 tcp dpt:443
0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.3 tcp dpt:80
0 0 DROP all -- !br-mailcow br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- !docker0 docker0 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-BRIDGE (1 references)
pkts bytes target prot opt in out source destination
145K 8699K DOCKER all -- * br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-CT (1 references)
pkts bytes target prot opt in out source destination
27M 14G ACCEPT all -- * br-mailcow 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
Chain DOCKER-FORWARD (1 references)
pkts bytes target prot opt in out source destination
58M 69G DOCKER-CT all -- * * 0.0.0.0/0 0.0.0.0/0
30M 55G DOCKER-INTERNAL all -- * * 0.0.0.0/0 0.0.0.0/0
30M 55G DOCKER-BRIDGE all -- * * 0.0.0.0/0 0.0.0.0/0
30M 55G ACCEPT all -- br-mailcow * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-INTERNAL (1 references)
pkts bytes target prot opt in out source destination
Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
Chain MAILCOW (1 references)
pkts bytes target prot opt in out source destination
440 28269 DROP all -- * * 189.203.99.107 0.0.0.0/0
0 0 DROP tcp -- !br-mailcow br-mailcow 0.0.0.0/0 0.0.0.0/0 /* mailcow isolation */
Logs of ip6tables -L -vn:
# ip6tables -L -vn
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
2451K 1747M MAILCOW all -- * * ::/0 ::/0 /* mailcow */
11M 8066M DOCKER-USER all -- * * ::/0 ::/0
11M 8066M DOCKER-FORWARD all -- * * ::/0 ::/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
6 480 ACCEPT tcp -- !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::13 tcp dpt:4190
283 21612 ACCEPT tcp -- !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::13 tcp dpt:995
18865 1521K ACCEPT tcp -- !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::13 tcp dpt:993
536 48076 ACCEPT tcp -- !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::13 tcp dpt:143
73 5108 ACCEPT tcp -- !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::13 tcp dpt:110
61 4588 ACCEPT tcp -- !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::10 tcp dpt:587
14141 1131K ACCEPT tcp -- !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::10 tcp dpt:465
799 63108 ACCEPT tcp -- !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::10 tcp dpt:25
476K 38M ACCEPT tcp -- !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::4 tcp dpt:443
418K 33M ACCEPT tcp -- !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::4 tcp dpt:80
0 0 DROP all -- !br-mailcow br-mailcow ::/0 ::/0
0 0 DROP all -- !docker0 docker0 ::/0 ::/0
Chain DOCKER-BRIDGE (1 references)
pkts bytes target prot opt in out source destination
928K 74M DOCKER all -- * br-mailcow ::/0 ::/0
0 0 DOCKER all -- * docker0 ::/0 ::/0
Chain DOCKER-CT (1 references)
pkts bytes target prot opt in out source destination
5120K 1517M ACCEPT all -- * br-mailcow ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- * docker0 ::/0 ::/0 ctstate RELATED,ESTABLISHED
Chain DOCKER-FORWARD (1 references)
pkts bytes target prot opt in out source destination
11M 8066M DOCKER-CT all -- * * ::/0 ::/0
5445K 6549M DOCKER-INTERNAL all -- * * ::/0 ::/0
5445K 6549M DOCKER-BRIDGE all -- * * ::/0 ::/0
4517K 6475M ACCEPT all -- br-mailcow * ::/0 ::/0
0 0 ACCEPT all -- docker0 * ::/0 ::/0
Chain DOCKER-INTERNAL (1 references)
pkts bytes target prot opt in out source destination
Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
Chain MAILCOW (1 references)
pkts bytes target prot opt in out source destination
102 8858 DROP all -- * * <redacted>
Logs of iptables -L -vn -t nat:
# iptables -L -vn -t nat
Chain PREROUTING (policy ACCEPT 2015K packets, 161M bytes)
pkts bytes target prot opt in out source destination
151K 9052K DOCKER all -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 15781 packets, 1133K bytes)
pkts bytes target prot opt in out source destination
0 0 DOCKER all -- * * 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT 161K packets, 9833K bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0
2014K 161M MASQUERADE all -- * !br-mailcow 172.22.1.0/24 0.0.0.0/0
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:172.22.1.3:80
0 0 DNAT tcp -- !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:172.22.1.3:443
0 0 DNAT tcp -- !br-mailcow * 0.0.0.0/0 127.0.0.1 tcp dpt:7654 to:172.22.1.249:6379
0 0 DNAT tcp -- !br-mailcow * 0.0.0.0/0 127.0.0.1 tcp dpt:13306 to:172.22.1.7:3306
36926 2165K DNAT tcp -- !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 to:172.22.1.253:25
47720 2854K DNAT tcp -- !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:465 to:172.22.1.253:465
14720 866K DNAT tcp -- !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:587 to:172.22.1.253:587
4133 244K DNAT tcp -- !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:110 to:172.22.1.250:110
4538 300K DNAT tcp -- !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:143 to:172.22.1.250:143
41075 2505K DNAT tcp -- !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:993 to:172.22.1.250:993
1874 109K DNAT tcp -- !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:995 to:172.22.1.250:995
171 8688 DNAT tcp -- !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:4190 to:172.22.1.250:4190
0 0 DNAT tcp -- !br-mailcow * 0.0.0.0/0 127.0.0.1 tcp dpt:19991 to:172.22.1.250:12345
Logs of ip6tables -L -vn -t nat:
# ip6tables -L -vn -t nat
Chain PREROUTING (policy ACCEPT 961K packets, 95M bytes)
pkts bytes target prot opt in out source destination
933K 75M DOCKER all -- * * ::/0 ::/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 2897 packets, 232K bytes)
pkts bytes target prot opt in out source destination
0 0 DOCKER all -- * * ::/0 !::1 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT 931K packets, 75M bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * !docker0 fd00:0:4000::/64 ::/0
960K 95M MASQUERADE all -- * !br-mailcow fd4d:6169:6c63:6f77::/64 ::/0
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
418K 33M DNAT tcp -- !br-mailcow * !fe80::/10 ::/0 tcp dpt:80 to:[fd4d:6169:6c63:6f77::4]:80
476K 38M DNAT tcp -- !br-mailcow * !fe80::/10 ::/0 tcp dpt:443 to:[fd4d:6169:6c63:6f77::4]:443
799 63108 DNAT tcp -- !br-mailcow * !fe80::/10 ::/0 tcp dpt:25 to:[fd4d:6169:6c63:6f77::10]:25
14143 1131K DNAT tcp -- !br-mailcow * !fe80::/10 ::/0 tcp dpt:465 to:[fd4d:6169:6c63:6f77::10]:465
61 4588 DNAT tcp -- !br-mailcow * !fe80::/10 ::/0 tcp dpt:587 to:[fd4d:6169:6c63:6f77::10]:587
73 5108 DNAT tcp -- !br-mailcow * !fe80::/10 ::/0 tcp dpt:110 to:[fd4d:6169:6c63:6f77::13]:110
536 48076 DNAT tcp -- !br-mailcow * !fe80::/10 ::/0 tcp dpt:143 to:[fd4d:6169:6c63:6f77::13]:143
23335 1890K DNAT tcp -- !br-mailcow * !fe80::/10 ::/0 tcp dpt:993 to:[fd4d:6169:6c63:6f77::13]:993
283 21612 DNAT tcp -- !br-mailcow * !fe80::/10 ::/0 tcp dpt:995 to:[fd4d:6169:6c63:6f77::13]:995
6 480 DNAT tcp -- !br-mailcow * !fe80::/10 ::/0 tcp dpt:4190 to:[fd4d:6169:6c63:6f77::13]:4190
DNS check:
# docker exec -it $(docker ps -qf name=acme-mailcow) dig +short stackoverflow.com @172.22.1.254
198.252.206.1
Activity
AlexanderS commentedon Jul 8, 2026
max_messageof rspamd defaults to 50MB: https://docs.rspamd.com/configuration/options/#:~:text=DoS%20(default%3A%201024)-,max_message,-maximum%20size%20ofAnd according to this message: https://lists.rspamd.com/pipermail/users/2019-May/000617.html mails over the configured size will not just skip scanning, but will be rejected.
smares commentedon Aug 11, 2026
I also got complains from my users about outgoing mails that fail with either 5.3.4 or 4.7.1 when sending large / many attachments. Is it possible to have a central variable that applies the limit to all services? Also, any idea why the different status codes? 🤔
milkmaker commentedon Oct 10, 2026
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
KillVirus commentedon Oct 13, 2026
I'm also interested in seeing this addressed.
Consistent message size limits across all mailcow components, ideally configurable through a single setting, would be nice to see.