Postfix complaining that "message size exceeds limit" even when below limit size

I have a Postfix server that is refusing to accept messages, complaining that they are above the size limit. The following is an attempt to send a message with a 2.5MB JPG attachment:

Mar 13 22:34:53 MX-VM postfix/smtpd[21494]: warning: 1305211FE75: BDAT request from unknown[xxxxxxx] exceeds message size limit

Disk space is more than adequate. I have set "message_size_limit = 0" and "virtual_mailbox_limit = 0" in main.cf. Changing these to something large (50000000) produces no change. Postfix still complains.

Here is main.cf

queue_directory = /var/spool/postfix
command_directory = /usr/bin
daemon_directory = /usr/lib/postfix/bin
data_directory = /var/lib/postfix
mail_owner = postfix
myhostname = x
mydomain = x
unknown_local_recipient_reject_code = 550
mynetworks = 127.0.0.0/8 [::1]/128
relay_domains =
alias_maps = hash:/etc/postfix/aliases
alias_database = $alias_maps
home_mailbox = Maildir/
smtpd_banner = $myhostname
debug_peer_list = x
debug_peer_level = 3
debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
         ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/bin/sendmail
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /etc/postfix/sample


broken_sasl_auth_clients = yes
readme_directory = /usr/share/doc/postfix
inet_protocols = all
inet_interfaces = all
smtpd_relay_restrictions = permit_sasl_authenticated permit_mynetworks defer_unauth_destination
smtpd_client_restrictions = check_client_access hash:/etc/postfix/sender_access
smtpd_helo_restrictions =
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_invalid_hostname
smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unknown_recipient_domain,
    reject_unauth_destination,
    check_sender_access hash:/etc/postfix/sender_access
    check_recipient_access hash:/etc/postfix/recipient_access
smtpd_sender_restrictions = hash:/etc/postfix/sender_access, pcre:/etc/postfix/tld_access
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
smtpd_sasl_local_domain = $mydomain
smtpd_tls_loglevel = 1
smtp_tls_loglevel = 1
disable_vrfy_command = yes
smtpd_helo_required = yes


virtual_alias_maps = hash:/etc/postfix/virtual_alias, mysql:/etc/postfix/mysql_virtual_forwards.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql_virtual_domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailboxes.cf
virtual_mailbox_base = /home/vmail
virtual_uid_maps = static:1001
virtual_gid_maps = static:1001
virtual_minimum_uid = 1001
virtual_mailbox_limit = 0


smtpd_tls_cert_file=x
smtpd_tls_key_file=x
smtpd_tls_CAfile=x
smtp_tls_CApath = /etc/ssl/certs
smtpd_tls_CApath = /etc/ssl/certs
smtpd_use_tls=yes
smtp_use_tls=yes
smtp_tls_security_level = may
smtpd_tls_security_level = may
smtpd_tls_ask_ccert = yes
#smtpd_tls_protocols = !SSLv2,!SSLv3,!TLSv1
#smtp_tls_protocols = !SSLv2,!SSLv3,!TLSv1
#smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1
#smtp_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1
smtpd_tls_protocols = !SSLv2,!SSLv3
smtp_tls_protocols = !SSLv2,!SSLv3
smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3
smtp_tls_mandatory_protocols = !SSLv2,!SSLv3
smtpd_tls_mandatory_ciphers = high
smtp_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL
smtp_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL
tls_preempt_cipherlist = yes
smtpd_tls_auth_only = yes
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
smtpd_hard_error_limit = 3
smtpd_client_connection_rate_limit = 3
message_size_limit = 0
mailbox_size_limit = 0
append_dot_mydomain = no

msa_cleanup_service_name = msa_cleanup
msa_header_checks = pcre:/etc/postfix/msa_header_checks
msa_body_checks = pcre:/etc/postfix/msa_body_checks

header_checks = regexp:/etc/postfix/header_checks

mime_header_checks = regexp:/etc/postfix/block_attachments
compatibility_level = 2

(btw, this Postfix server has been running in the same configuration for over 5 years, and I have emails in my inbox that are much larger than the one shown here. This randomly started happening.)

Why is Postfix refusing this?

Have you looked at the postfix log (/var/log/maillog)? Depending on your distribution, it may be different file.

The error is not about the size of the message, but about the size of the header.

I am a little confused, tho. You say

I have a Postfix server that is refusing to accept messages, complaining that they are above the size limit. The following is an attempt to send a message with a 2.5MB JPG attachment:

Is this a message being received by the postfix server? Or a message you're trying to send with it?

What does the BOUNCE message say, exactly, and which server is sending that message?

Originally Posted by scasey Is this a message being received by the postfix server? Or a message you're trying to send with it?

The Postfix server is receiving a message that I am sending to it. I am sending from my iPhone 8 using the builtin mail client, which has worked flawlessly ever since I got it. The iPhone has had no updates recently.

There are no other logs. I am using Arch Linux, and everything is logging to systemd journal. The error I listed in the first post is the only one. I don't see any BOUNCE message anywhere.

Originally Posted by psycroptic The Postfix server is receiving a message that I am sending to it. I am sending from my iPhone 8 using the builtin mail client, which has worked flawlessly ever since I got it. The iPhone has had no updates recently.

I am more confused. So, you are sending email from your iPhone, your server receives the email, then what? The recipient does not get the email? And no errors?
Where did you check to see if the server received the email?

Try this from a shell and what happens?

echo "hello - test email" |  mail -S smtp=<your_SMTP_server_IP> -s "test email" -r <your_email@your_domain.com>  <your_email@your_domain.com>

^ Yes. Confused. Looking again, I see that the logged message is a warning, not an error.
Does the incoming email actually get received and delivered?

From the iPhone, I am sending mail from myself to myself. The iPhone reports a failed send, and places the message in the Outbox. (It never says why it failed, only that it failed). The message never arrives in the mailbox. The logs I posted in the first post are the only log entries available.

what happens? echo "hello - test email" | mail -S smtp=<your_SMTP_server_IP> -s "test email" -r <your_email@your_domain.com> <your_email@your_domain.com>

This works fine. The message arrives.

Originally Posted by psycroptic From the iPhone, I am sending mail from myself to myself. The iPhone reports a failed send, and places the message in the Outbox. (It never says why it failed, only that it failed). The message never arrives in the mailbox. The logs I posted in the first post are the only log entries available. This works fine. The message arrives.

Did the mail ever worked from your iPhone?
The command you ran, did you run that from the mail server or a different machine?
Does the email work from another mail client / from different machine?

-Mail used to work on iPhone, but randomly started failung recently
-Ran command from another machine
-Mail sending works OK from Thunderbird (on that same machine).

I can find very little information on “BDAT request”. Putting it in quotes in Google returns mostly sites with the source code for Postfix. I cant be the only one with this problem...

Originally Posted by psycroptic From the iPhone, I am sending mail from myself to myself. The iPhone reports a failed send, and places the message in the Outbox. (It never says why it failed, only that it failed). The message never arrives in the mailbox. The logs I posted in the first post are the only log entries available.

Please clarify: When you say you are sending from the iPhone, do you mean that you are sending email from your Apple address to your postfix domain?
Or, do you mean that you are using your iPhone to send mail using your postfix domain?

Another way to ask that: Is the "from myself" address the same as, or different from, the "to myself" address?

Is the IP address obfuscated in your OP your IP?

The "from" and "to" address are the same:

from = me@mydomain.com (my Postfix domain)
to = me@mydomain.com (my Postfix domain)

Originally Posted by psycroptic The "from" and "to" address are the same: from = me@mydomain.com (my Postfix domain) to = me@mydomain.com (my Postfix domain)

So...you are using your iPhone to send mail using your postfix sever to your postfix server...and getting an error about (I think) the size of the header.
(You’re sending an email with your iPhone, not from your iPhone)
I’d check the settings on the iPhone and/or delete and re-add the account on the iPhone.

Since it works everywhere else, I suspect an issue with your iPhone settings.

Already deleted & re-added the mail account on the iPhone numerous times, using the exact same settings that work fine with Thunderbird....

I don't understand how this could randomly break... Nothing has changed about the email settings anywhere, on Postfix or the iPhone...