How to read Postfix logs and investigate mail delivery

Find the log destination

Identify the server, incident time, time zone and envelope addresses first. Postfix normally logs through syslog but can use its own logging service. Common filenames include /var/log/maillog and /var/log/mail.log; the operating system alone does not determine the destination.

postconf mail_version maillog_file
sudo tail -n 100 /var/log/maillog

Replace the path with your actual log. An empty maillog_file means you should inspect syslog routing, for example in /etc/rsyslog.conf and /etc/rsyslog.d/ when rsyslog is used. Older Postfix versions may not recognize this parameter. A nonempty value selects Postfix's own destination.

On systems using the systemd journal, use a time window such as sudo journalctl --since '2026-09-20 10:00:00' --until '2026-09-20 11:00:00' and find the Postfix processes. Filtering only by one service unit can miss other instances. Adjust the dates to the incident and server time zone.

If output is missing, check read permissions, service activity, syslog rules, rotated files and container output. A missing file does not establish that no delivery occurred. References: official logging guide and debugging guide.

Trace a Queue ID through a log example

This fictional example uses documentation addresses, IPs and a made-up Queue ID. Actual formatting varies with the version, logging configuration and delivery transport.

Sep 20 10:15:01 mail postfix/smtpd[1201]: 4F2A812345: client=client.example.org[192.0.2.10]
Sep 20 10:15:01 mail postfix/cleanup[1202]: 4F2A812345: message-id=<example-001@example.org>
Sep 20 10:15:01 mail postfix/qmgr[1203]: 4F2A812345: from=<sender@example.org>, size=2048, nrcpt=1 (queue active)
Sep 20 10:15:02 mail postfix/smtp[1204]: 4F2A812345: to=<recipient@example.net>, relay=mx.example.net[198.51.100.20]:25, delay=1.2, delays=0.1/0.1/0.4/0.6, dsn=2.0.0, status=sent (250 2.0.0 accepted)
Sep 20 10:15:02 mail postfix/qmgr[1203]: 4F2A812345: removed

The Queue ID 4F2A812345 ties the entries together. smtpd records the client, cleanup prepares the message, qmgr manages delivery and smtp hands it to the relay. See the official architecture overview.

sudo grep -F '4F2A812345:' /var/log/maillog

Replace the ID and path, and inspect surrounding entries. Filtering or forwarding can assign a new ID. Queue IDs are not globally unique across servers and may be reused on one instance; correlate the time and message-id too.

Investigate failures and delays

1. Check acceptance: NOQUEUE: reject indicates rejection before queueing. For entries such as SASL authentication failed, check the authentication configuration, client and time.
2. Check each recipient: sent means the delivery operation succeeded, deferred is temporary deferral and bounced is permanent failure. SMTP acceptance does not prove inbox placement or reading.
3. Read the response: distinguish DNS lookup errors, connection timeouts and remote rejection using the actual error. A delay alone does not prove a network fault.
4. Follow later attempts: look for a later sent result or inspect the current queue. A successful final result can hide earlier temporary problems.

delay records elapsed delivery time. delays=a/b/c/d breaks it into arrival to the last active-queue entry, then waiting to begin connection setup, connection setup, and message transmission. Setup can include DNS and SMTP/TLS handshakes. See the official delay logging definition.

Limit verbose logging to the relevant peer and investigation period. It increases storage and can expose sensitive information. Follow the official debugging procedure and restore normal settings afterward.

Inspect the current queue and message content

postqueue -p

Inspect queue IDs, sizes, arrival times, senders, outstanding recipients and recorded failure reasons. * marks active and ! marks hold. The queue changes while running; its current size is different from historical log event counts. Supported versions also provide JSON Lines through postqueue -j. See the postqueue manual.

Ordinary delivery logs do not contain complete message bodies. An authorized administrator can use sudo postcat -q QUEUE_ID while the message remains in the queue, replacing QUEUE_ID with the relevant ID. Output can include private content: do not paste it unredacted into a public issue or website. See the postcat manual.

The inspection commands here do not delete mail or request redelivery. Deleting a queue before investigation can remove the message you need to examine.

Visualize historical logs and monitor live activity

For larger investigations, load saved Postfix text logs into the LogGraphic desktop app and filter by start date, Queue ID or address. This guide page does not provide a browser upload for your logs.

ADDRESS FLOW shows email-address relationships; MAIL FLOW shows relay servers. Replay, pause and fast-forward let you follow recorded activity. Configure SSH for LIVE monitoring. DKIM views represent processing recorded in logs; they do not independently verify message signatures.

Historical log workflow · Flow and monitoring features · Install on Kali Linux · Version 1.17.0 notes

Frequently asked questions