SECURITY WARNING: Never run commands you don't understand. Always review code before execution. Use at your own risk.
FixMyError.net
Email New Added 26 October 2026

Postfix: SASL authentication failure: No worthy mechs found

Postfix tried to log in to the relay and Cyrus SASL could not find a mechanism the relay accepts. The username and password are not the problem. Either the plugin package is missing (libsasl2-modules on Debian and Ubuntu, cyrus-sasl-plain on RHEL), so PLAIN and LOGIN do not exist at all, or the security options still hold Postfix's default of noplaintext, which forbids exactly the mechanisms that Gmail, SES and most other relays use, even inside TLS.

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

Quick fix
# The warning, and the mechanisms the relay offers
sudo grep -i sasl /var/log/mail.log | tail -n 5
(echo "EHLO test"; sleep 2) | openssl s_client -starttls smtp -connect smtp.example.com:587 -crlf -quiet 2>/dev/null | grep -i "AUTH"

# Are the PLAIN and LOGIN plugins installed?
ls /usr/lib/*/sasl2/ /usr/lib64/sasl2/ 2>/dev/null
sudo apt install libsasl2-modules     # Debian / Ubuntu
sudo dnf install cyrus-sasl-plain     # RHEL / Fedora

# Allow plaintext mechanisms, and insist on TLS so they are never sent bare
sudo postconf -e 'smtp_sasl_security_options = noanonymous'
sudo postconf -e 'smtp_sasl_tls_security_options = noanonymous'
sudo postconf -e 'smtp_tls_security_level = encrypt'
sudo systemctl restart postfix
sudo postqueue -f

How to diagnose Email errors

SMTP errors follow a strict convention: a 4xx code is temporary and will be retried, a 5xx is permanent and will not. Beyond delivery mechanics, most modern email problems are authentication problems (SPF, DKIM and DMARC alignment) which cause silent filtering into spam rather than an explicit bounce, and therefore need to be checked proactively.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

  1. Read the full bounce message. The enhanced status code (for example 5.7.1) is far more specific than the three-digit code and usually names the exact policy that rejected the message.
  2. Test the SMTP conversation manually with swaks --to [email protected] --server smtp.example.com --tls. It shows each command and response.
  3. Verify SPF, DKIM and DMARC records with dig TXT example.com, dig TXT selector._domainkey.example.com and dig TXT _dmarc.example.com.
  4. Check DMARC alignment, not just presence: the domain in the From: header must align with the SPF or DKIM domain, or DMARC fails even when both pass individually.
  5. Confirm the sending IP is not on a blocklist and has valid reverse DNS. Missing PTR records cause rejection by many large providers.

Tools worth reaching for

  • swaks
  • dig TXT
  • openssl s_client -starttls smtp
  • postfix mail logs
  • DMARC aggregate reports

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

postfix.org postfix.org

Related Email errors

See all 20 Email errors →

Browse other categories

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.