Problem: Mail delivery fails with address extensions when antivirus scanning is enabled

scheinig · June 25, 2026, 10:12am

Problem

After enabling antivirus scanning on a UCS mail server with ucr set mail/antivir=yes, emails sent to recipient addresses containing address extensions (e.g., user+tag@domain.com) are rejected during mail re-injection from the Amavis scanner.

Symptoms

Mails sent to mailing list addresses that use address extensions for routing are rejected
Antivirus is enabled: mail/antivir=yes
Error message in mail logs:
Recipient address rejected: User unknown in virtual mailbox table (in reply to end of DATA command)
Mail delivery works without antivirus enabled (mail/antivir=no)

Typical Setup

This issue typically occurs in the following configuration:

Shared mailbox addresses as mailing lists in LDAP

Example mailing list address: gruppexyz@schein.me
Mailing list recipients: oxadmin+schein-shared/gruppexyz@schein.me

Global Sieve rules that process address extensions

The + character and text after it is used to determine the target folder
Example: oxadmin+schein-shared/gruppexyz routes mail to the schein-shared/gruppexyz folder

Antivirus scanning enabled

Configuration: mail/antivir=yes
Mail is scanned via Amavis on ports 10024 (input) and 10025 (re-injection)

Investigation

Check if antivirus is enabled

ucr get mail/antivir

If the output is yes, antivirus is enabled and may be the cause of the issue.
Check mail logs for rejection messages
Look for error messages related to recipient rejection in /var/log/mail.log: tail -f /var/log/mail.log | grep "Recipient address rejected"
You should see entries like:

postfix/smtpd[PID]: NOQUEUE: reject: RCPT from amavis[127.0.0.1]: 550 5.1.1 oxadmin+schein-shared/gruppexyz@schein.me: Recipient address rejected: User unknown in virtual mailbox table

This indicates that the SMTPD service on port 10025 (antivirus re-injection) is rejecting the address.

Verify Amavis configuration

Check that Amavis is listening on port 10024 and forwarding to port 10025:
netstat -tlnp | grep -E “10024|10025”
Expected output:

tcp 0 0 127.0.0.1:10024 0.0.0.0:* LISTEN [amavisd-new PID]
tcp 0 0 127.0.0.1:10025 0.0.0.0:* LISTEN [master PID]

Check Postfix master.cf configuration for port 10025
Examine the SMTPD service definition for port 10025:
postconf -M | grep 10025
Or view the relevant configuration file:
grep -A 15 "127.0.0.1:10025" /etc/postfix/master.cf
Look for the receive_override_options parameter. The issue occurs when this is set to no_address_mappings without a corresponding recipient_delimiter setting.

Solution:

The Port 10025 SMTPD service (used for antivirus re-injection) requires explicit configuration of the recipient_delimiter parameter to properly handle address extensions.

Root Cause

The Postfix configuration for the antivirus re-injection service on port 10025 lacks the recipient_delimiter parameter. While port 25 (the main SMTP service) implicitly handles address extensions through internal mechanisms, port 10025 requires explicit configuration because:

The receive_override_options=no_address_mappings setting disables address mapping features
Without explicit recipient_delimiter, Postfix cannot recognize address extensions (the + character)
Addresses like user+tag@domain.com are treated as literal mailbox names and fail lookups
Implementation
Add the recipient_delimiter=+ parameter to the port 10025 SMTPD service definition.
Edit the file: /etc/postfix/master.cf
Find this section:

127.0.0.1:10025 inet n	-	n	-	-  smtpd
	-o content_filter=
	-o local_recipient_maps=
	-o relay_recipient_maps=
	-o smtpd_restriction_classes=
	-o smtpd_client_restrictions=
	-o smtpd_helo_restrictions=
	-o smtpd_sender_restrictions=
	-o smtpd_recipient_restrictions=permit_mynetworks,reject
	-o mynetworks=127.0.0.0/8
	-o smtpd_authorized_xforward_hosts=127.0.0.0/8
	-o strict_rfc821_envelopes=yes
	-o smtpd_error_sleep_time=0
	-o smtpd_soft_error_limit=1001
	-o smtpd_hard_error_limit=1000
	-o receive_override_options=no_address_mappings
Add this line:
	-o recipient_delimiter=+
Result after modification:
127.0.0.1:10025 inet n	-	n	-	-  smtpd
	-o content_filter=
	-o local_recipient_maps=
	-o relay_recipient_maps=
	-o smtpd_restriction_classes=
	-o smtpd_client_restrictions=
	-o smtpd_helo_restrictions=
	-o smtpd_sender_restrictions=
	-o smtpd_recipient_restrictions=permit_mynetworks,reject
	-o mynetworks=127.0.0.0/8
	-o smtpd_authorized_xforward_hosts=127.0.0.0/8
	-o strict_rfc821_envelopes=yes
	-o smtpd_error_sleep_time=0
	-o smtpd_soft_error_limit=1001
	-o smtpd_hard_error_limit=1000
	-o receive_override_options=no_address_mappings
	-o recipient_delimiter=+

Permanent fix via UCS configuration management
To make this change permanent and prevent it from being overwritten during system updates, modify the UCS configuration template:
Copy the file: cp /etc/univention/template/files/etc/postfix/master.cf.d/30_antivir ~/30_antivir
Edit the file: /etc/univention/templates/files/etc/postfix/master.cf.d/30_antivir
Add the parameter to the port 10025 service definition (add this line before the closing triple quotes):
-o recipient_delimiter=+
The complete section should look like:

@!@
# flake8: noqa
if configRegistry.is_true('mail/antivir', False):
    print('''
smtp-amavis unix -      -       n     -       %(maxproc)s  smtp
	-o smtp_data_done_timeout=1200
	-o smtp_send_xforward_command=yes
	-o disable_dns_lookups=yes
127.0.0.1:10025 inet n	-		n	  -		  -	 smtpd
	-o content_filter=
	-o local_recipient_maps=
	-o relay_recipient_maps=
	-o smtpd_restriction_classes=
	-o smtpd_client_restrictions=
	-o smtpd_helo_restrictions=
	-o smtpd_sender_restrictions=
	-o smtpd_recipient_restrictions=permit_mynetworks,reject
	-o mynetworks=127.0.0.0/8
	-o smtpd_authorized_xforward_hosts=127.0.0.0/8
	-o strict_rfc821_envelopes=yes
	-o smtpd_error_sleep_time=0
	-o smtpd_soft_error_limit=1001
	-o smtpd_hard_error_limit=1000
	-o receive_override_options=no_address_mappings
	-o recipient_delimiter=+''' % {"maxproc": configRegistry.get("mail/antivir/max_servers", "2")})  # noqa: E101
@!@

After modifying the template, run:

ucr commit /etc/postfix/master.cf.d/30_antivir
postfix reload

Verification

Test mail delivery with address extensions:
- Send a test email to a mailing list address that uses address extensions
- Example: gruppexyz@schein.me (which routes to oxadmin+schein-shared/gruppexyz@schein.me)
Verify successful delivery:
- Check that the email is delivered to the correct mailbox
- Verify that Sieve filters receive the correct address extension
- Check /var/log/mail.log for any rejection errors
Confirm in logs:
grep “oxadmin+schein-shared/gruppexyz” /var/log/mail.log

Should show successful delivery, not rejection.