How to Fix "Sender address rejected: need fully-qualified address" in Postfix

Postfix rejects outgoing mail with the error "Sender address rejected: need fully-qualified address" when the SMTP envelope sender address - the MAIL FROM field - does not include a full domain. The message gets stuck in the queue, no delivery attempt is made, and you are left staring at mailq wondering what happened.

This is a specific, solvable problem - and one that DMARCFlow can help you catch before it causes production failures. Here is what causes it and how to fix it.

What "fully-qualified sender address" means in Postfix

SMTP separates two sender addresses:

• Envelope sender (MAIL FROM): the technical address used by MTAs to route bounces and delivery instructions. It is not visible to end users.
• From: header (From:): the human-readable address shown in email clients.

Postfix's SMTP server requires the envelope sender to be a complete address - app@example.com, not just app. This is RFC 5321 compliance. Some configurations are strict by default; others become strict after a migration or configuration change.

configuration change.

Common causes of this error

strict_rfc821_envelopes = yes

This parameter, when enabled in main.cf, tells Postfix to reject any MAIL FROM that does not contain a fully-qualified domain. It is the most direct cause of this error. Many Linux distributions enable it in their default Postfix configurations.

myorigin is missing or unqualified

myorigin sets the domain appended to bare usernames for outgoing mail. If it is not set, or set to a value without a domain (myorigin = $myhostname where $myhostname is just a hostname without a domain), Postfix sends mail with an unqualified sender address.

masquerade_domains stripping the domain

Address masquerading rewrites sender addresses to hide subdomain detail. If configured too aggressively, it can strip the domain from the envelope sender, leaving it unqualified.

Legacy applications sending MAIL FROM without a domain

Some applications, scripts, and monitoring tools send ode>MAIL FROM: without a domain - for example, alerts instead of alerts@example.com. When these connect through Postfix, the unqualified address passes through to the SMTP session and gets rejected.

Outbound relay with missing envelope mapping

When Postfix acts as a relay for systems that submit mail without a domain in the envelope sender, the relay configuration must rewrite the envelope sender before forwarding. If the rewrite map is missing, the unqualified address travels upstream and gets rejected.

How to diagnose the exact cause

Run this to see which parameters are set to non-default values:

postconf -n | grep -E "strict_rfc821|myorigin|masquerade|relay_domains|sender_dependent"

Look specifically for:

• strict_rfc821_envelopes = yes - this is the most likely culprit
• myorigin not set or set to a bare hostname
• masquerade_domains including a domain that covers your sender addresses

To see the SMTP conversation that failed, find the message ID from mailq output, then:

postfix/smtp -v -v

Or enable verbose logging temporarily:

postconf -e "maillog_file = /var/log/postfix-verbose.log"
postfix reload

Then try sending a test message and check the log.

Fix 1 - Set myorigin correctly

Add to main.cf:

myorigin = $mydomain

Or explicitly:

myorigin = example.com

Then reload Postfix:

postfix reload

If $mydomain is not set, define it:

mydomain = example.com

This alone fixes the problem in most cases where myorigin was missing or unqualified.

Fix 2 - Adjust masquerade_domains

If masquerade_domains is stripping the domain from your envelope sender, either remove the domain from the masquerade list or add the affected subdomain to masquerade_exceptions:

masquerade_exceptions = alert@, monitor@

This tells Postfix not to masquerade addresses from those specific users. Adjust the list to match your use case.

Fix 3 - Disable strict_rfc821_envelopes when appropriate

If the root cause is a legacy application that you cannot modify, and the other fixes do not apply, you can disable the strict enforcement:

postconf -e strict_rfc821_envelopes = no
postfix reload

Security note: Disabling this allows unqualified sender addresses to pass through your MTA. This can cause DMARC alignment failures and deliverability problems downstream, because the envelope sender may not match your DKIM signature domain or your SPF authorized servers. Only disable it in controlled environments where you understand the downstream impact.

The better long-term fix is to fix the root cause - the sending application or the myorigin configuration.

Fix 4 - Use /etc/postfix/generic for envelope rewriting

The generic table rewrites envelope sender addresses on a per-user or per-domain basis:

postconf -e sender_generic_maps = hash:/etc/postfix/generic

In /etc/postfix/generic:

root            alerts@example.com
monitoring      alerts@example.com
@oldsystem.local    alerts@example.com

Then:

postmap /etc/postfix/generic
postfix reload

This is the cleanest solution for legacy systems that submit mail with bare usernames - you rewrite the envelope sender at the Postfix layer without touching the application.

Fix 5 - Configure sender_dependent_relayhost maps for relay scenarios

If you are relaying mail for multiple domains and need per-domain envelope sender rewriting, use sender_dependent_relayhost_maps:

sender_dependent_relayhost_maps = hash:/etc/postfix/relay_maps

In /etc/postfix/relay_maps:

user1@example.com    [smtp-relay.example.com]:587
user2@example.com    [smtp-relay.example.com]:587

Then rebuild the hash and reload:

postmap /etc/postfix/relay_maps
postfix reload

The generic table rewrites envelope sender addresses on a per-user or per-domain basis:

postconf -e sender_generic_maps = hash:/etc/postfix/generic

In /etc/postfix/generic:

root            alerts@example.com
monitoring      alerts@example.com
@oldsystem.local    alerts@example.com

Then:

postmap /etc/postfix/generic
postfix reload

This is the cleanest solution for legacy systems that submit mail with bare usernames - you rewrite the envelope sender at the Postfix layer without touching the application.

How DMARCFlow detects envelope_from problems before production

Envelope_from misconfigurations are a common source of DMARC failures. When the envelope sender domain does not align with your DKIM signature domain or your SPF authorized servers, DMARC alignment fails - and emails get rejected or land in spam without any warning.

DMARCFlow monitors your DNS mail configuration continuously. If your envelope sender becomes unqualified after a configuration change - for example, after a Postfix migration that alters myorigin - DMARCFlow flags the issue before you start getting bounces.

Setting up an envelope_from health check in DMARCFlow takes a few minutes:

• Connect your domain and verify DKIM.
• Run a DNS health check - DMARCFlow verifies your SPF, DKIM, and DMARC records and checks for envelope_from alignment issues.
• Set an alert threshold for DNS record changes - any modification to myorigin, masquerade_domains, or related parameters that affects envelope sender qualification triggers an alert.

This is not a theoretical feature. Envelope_from misalignment is one of the most common causes of mail delivery failures after infrastructure changes, and it is invisible without active monitoring.

Quick checklist

• Run postconf -n and check strict_rfc821_envelopes, myorigin, masquerade_domains
• Set myorigin = $mydomain if it is missing or unqualified
• Add affected addresses to masquerade_exceptions if masquerading is the cause
• Only disable strict_rfc821_envelopes temporarily in controlled environments
• Use /etc/postfix/generic to rewrite envelope senders from legacy applications
• Run a DNS health check in DMARCFlow after any Postfix configuration change
• Monitor mailq after changes to confirm mail is flowing

FAQ

What is a fully-qualified sender address in Postfix?

A fully-qualified sender address has both a local part and a domain part - alerts@example.com, not just alerts. Postfix requires this for the SMTP envelope sender under RFC 5321.

Why did this start happening after a migration?

Migrations often change myorigin, masquerade_domains, or relayhost settings. If your old MTA did not enforce RFC 5321 strictly, a new Postfix configuration that has strict_rfc821_envelopes = yes will reject mail that previously passed through without issue.

Is it safe to disable strict_rfc821_envelopes?

Only in controlled environments where you have assessed the downstream impact. Disabling it allows unqualified sender addresses, which can cause DMARC alignment failures and deliverability problems. Fix the root cause rather than disabling the check.

Does this affect DMARC validation?

Yes. If your envelope sender domain does not align with your DKIM signature domain or your SPF authorized servers, DMARC alignment fails. DMARCFlow detects this misalignment automatically as part of its DNS health checks.