Postfix "553 5.7.1 Sender address rejected: not owned by user": fix

What it means

Your Postfix server checks that the person who logged in is allowed to send with the sender address they use. When they are not, it refuses the message:

553 5.7.1 <info@yourdomain.com>: Sender address rejected: not owned by user john@yourdomain.com

A related message appears when someone uses one of your addresses without logging in at all:

553 5.7.1 <info@yourdomain.com>: Sender address rejected: not logged in

This is a protection, not a bug: it stops one user (or a stolen password) from sending as another person. The fix is to tell Postfix who may use which address, or to send with the right account.

Why it happens

The check comes from the restriction reject_sender_login_mismatch (or its variants reject_authenticated_sender_login_mismatch and reject_known_sender_login_mismatch). It compares two things:

• the envelope sender (the MAIL FROM address given by the mail program, not always the visible From header), and
• the login name used for SMTP authentication.

Postfix looks up the sender in the table set by smtpd_sender_login_maps. If the login is not listed as an owner, it rejects. Typical situations:

• A user sends from a shared or alias address (info@, sales@) that is not mapped to their login.
• A website, printer or script logs in as one account but sends as another address.
• The login name is john but the table lists john@yourdomain.com (or the reverse).
• The table was edited but postmap was not run, so Postfix still reads the old version.
• An app sets a different envelope sender (bounce address) than the From address.

How to check

1. Read the mail log for the exact sender and login:

   grep "not owned by user" /var/log/mail.log | tail

2. See the active settings:

   postconf smtpd_sender_login_maps smtpd_sender_restrictions
   postconf -M submission/inet

   The second command shows the -o overrides of the submission service (port 587) in master.cf, where this restriction is often set.
3. Ask the table directly:

   postmap -q info@yourdomain.com hash:/etc/postfix/sender_login

   It prints the logins allowed for that address, or nothing.
4. Reproduce with swaks:

   swaks --server mail.yourdomain.com:587 --tls \
     --auth LOGIN --auth-user john@yourdomain.com \
     --from info@yourdomain.com --to you@example.com

How to fix it

Allow the login to use the address

Edit the sender login table, one sender per line, followed by the allowed logins separated by commas:

# /etc/postfix/sender_login
john@yourdomain.com     john@yourdomain.com
info@yourdomain.com     john@yourdomain.com, mary@yourdomain.com
@yourdomain.com         admin@yourdomain.com

The last line lets admin@yourdomain.com send as any address of the domain; use it carefully. Then rebuild the table and reload:

postmap /etc/postfix/sender_login
systemctl reload postfix

Make sure main.cf points to it:

smtpd_sender_login_maps = hash:/etc/postfix/sender_login

If your users are in a database (MySQL, PostgreSQL, LDAP), the map is a query; add the alias permission there instead. Control panels and mail server bundles usually expose this as a "send as" or alias permission for each mailbox.

Or log in with the right account

For a website or device, the simplest fix is often to log in with the account that owns the address, or to create a mailbox for the address it sends from.

Fix the envelope sender of apps

If the visible From is right but the log shows another sender, the app sets a different envelope sender. Set it to an address the login owns (for PHPMailer, $mail->Sender; for nodemailer, the envelope option). See Return-Path, envelope sender and From.

Do not just remove the restriction

Removing reject_sender_login_mismatch makes the error disappear but lets any user send as anyone. Also do not use visitors' addresses as sender on contact forms (see contact form emails sent "From" the visitor). If the error is "Relay access denied" instead, see 554 5.7.1 Relay access denied.

Check that it is fixed

Run the same swaks command: it should end with 250 2.0.0 Ok: queued. Then send from the real app or mail client to the unique address on the Delivmail home page and check in the report that SPF, DKIM and DMARC pass for the sender address. Finally resend the message that was rejected.