https://www.gstatic.com/ipranges/goog.json.

In other words my MX record points to google. and google forwards to me from one of those IPs. I update the IPs every hour if they change..

Paul

mynetworks = 127.0.0.0/8 10.1.1.0/24 -- has only those entries.

Why does yours need a whole list of entries?

I am still on 25.6.1 and will not update as long there are so many issues with 25.9.0 version.

Once the upfrade completed I got the same error described in:

https://community.zextras.com/forum/carbonio-setup/upgrading-from-carbonio-ce-25-6-1-to-25-9-0/

The resolution posted in the post worked for me. 

However I face another issue that seems to be related to the errors:

/opt/zextras/common/sbin/postconf: warning: removed link : support for parameter "smtpd_tls_eecdh_grade" will be removed; instead, do not specify (leave at default)
/opt/zextras/common/sbin/postconf: warning: removed link : support for parameter "smtpd_use_tls" will be removed; instead, specify "smtpd_tls_security_level"
/opt/zextras/common/sbin/postconf: warning: removed link : support for parameter "disable_dns_lookups" will be removed; instead, specify "smtp_dns_support_level"

I see those when I update my trusted networks.

I use Carbonio behind gmail (gemail being a relay) emails come in through gmail, and gmail relays through port 587 (all was working fine on 25.6.1)

I have a script that updates regularly the gmail servers ips in my trusted networks. The error I see in the logs when an email comes in is:

Nov 3 03:17:55 mail postfix/submission/smtpd: Anonymous TLS connection established from mail-qt1-f198.google.com: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
Nov 3 03:17:55 mail postfix/submission/smtpd: NOQUEUE: reject: RCPT from mail-qt1-f198.google.com: 554 5.7.1 <mail-qt1-f198.google.com>: Client host rejected: Access denied; from=

My trusted networks are:

postconf mynetworks
mynetworks = 127.0.0.0/8 8.8.4.0/24 8.8.8.0/24 8.34.208.0/20 8.35.192.0/20 8.228.0.0/14 8.232.0.0/14 8.236.0.0/15 23.236.48.0/20 23.251.128.0/19 34.0.0.0/15 34.2.0.0/16 34.3.0.0/23 34.3.3.0/24 34.3.4.0/24 34.3.8.0/21 34.3.16.0/20 34.3.32.0/19 34.3.64.0/18 34.4.0.0/14 34.8.0.0/13 34.16.0.0/12 34.32.0.0/11 34.64.0.0/10 34.128.0.0/10 35.184.0.0/13 35.192.0.0/14 35.196.0.0/15 35.198.0.0/16 35.199.0.0/17 35.199.128.0/18 35.200.0.0/13 35.208.0.0/12 35.224.0.0/12 35.240.0.0/13 35.252.0.0/14 64.15.112.0/20 64.233.160.0/19 66.102.0.0/20 66.249.64.0/19 70.32.128.0/19 72.14.192.0/18 74.114.24.0/21 74.125.0.0/16 104.154.0.0/15 104.196.0.0/14 104.237.160.0/19 107.167.160.0/19 107.178.192.0/18 108.59.80.0/20 108.170.192.0/18 108.177.0.0/17 130.211.0.0/16 136.22.2.0/23 136.22.4.0/23 136.22.8.0/22 136.22.160.0/20 136.22.176.0/21 136.22.184.0/23 136.22.186.0/24 136.23.48.0/20 136.23.64.0/18 136.64.0.0/11 136.107.0.0/16 136.108.0.0/14 136.112.0.0/13 136.120.0.0/22 136.124.0.0/15 142.250.0.0/15 146.148.0.0/17 162.120.128.0/17 162.216.148.0/22 162.222.176.0/21 172.110.32.0/21 172.217.0.0/16 172.253.0.0/16 173.194.0.0/16 173.255.112.0/20 192.104.160.0/23 192.158.28.0/22 192.178.0.0/15 193.186.4.0/24 199.36.154.0/23 199.36.156.0/24 199.192.112.0/22 199.223.232.0/21 207.175.0.0/16 207.223.160.0/20 208.65.152.0/22 208.68.108.0/22 208.81.188.0/22 208.117.224.0/19 209.85.128.0/17 216.58.192.0/19 216.73.80.0/20 216.239.32.0/19 216.252.220.0/22 (I removed my local networks from the list for the post)

209.85.128.0/17 contains 209.85.160.198 and I do not understand why the "Client host rejected: Access denied"

Any help would be greatly appreciated.

Thank you,

Paul