Configuring Postfix to send email from your VPS

A server often needs to send email: monitoring alerts, Logwatch reports, a website's password resets, application notifications. This guide configures send-only Postfix, the simplest and most reliable configuration for these uses.

1. What do you need?

• Sending notifications from the server: that is what this guide covers.
• Sending from a website (WordPress, shop): the simplest option is often to configure the site to use an SMTP provider directly, through a plugin. Postfix remains useful if several applications need to send.
• Hosting complete mailboxes, with receiving and webmail: a much heavier project, which requires IP reputation, monitoring and maintenance. For most projects, hosted email or the mail included with Plesk web hosting is more sensible.

2. Why go through an SMTP relay

In theory a server can send email directly to the destination servers. In practice, it is the best way to end up in spam: large providers such as Gmail or Outlook distrust server IP addresses with no sending history, and many hosts filter outbound port 25 to fight spam.

The solution is to relay: Postfix hands messages to a specialised SMTP provider (Brevo, Mailjet, Amazon SES, Postmark, or your domain's mail service), which takes care of deliverability. Sending goes through port 587, authenticated and encrypted.

3. Install Postfix

apt update && apt install -y postfix libsasl2-modules mailutils

When asked for the configuration type, choose Satellite system. As the mail name, enter the server's full name, for example web01.yourdomain.com, and as the relay your provider's SMTP address in square brackets, for example [smtp.provider.com]:587. The brackets tell Postfix to use the name as is, without looking for an MX record.

4. Configure the relay

Add these lines to /etc/postfix/main.cf, or check they are there:

relayhost = [smtp.provider.com]:587
inet_interfaces = loopback-only
mydestination =
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

• inet_interfaces = loopback-only: Postfix only accepts messages from the server itself. It cannot be used as a relay by strangers, and no port needs opening in the firewall.
• Empty mydestination: the server does not consider itself the destination for any domain, so everything is relayed.
• smtp_tls_security_level = encrypt: the connection to the relay is always encrypted; credentials never travel in clear text.

5. SMTP credentials

Create /etc/postfix/sasl_passwd with the username and password provided by your relay:

[smtp.provider.com]:587 username:password

chmod 600 /etc/postfix/sasl_passwd
postmap /etc/postfix/sasl_passwd
systemctl restart postfix

The postmap command creates the version Postfix actually reads. Run it again after every change to the file.

6. The sender address

By default, messages are sent from [email protected]. Most relays refuse a sender that does not belong to a domain verified with them. Rewrite the sender address to an address on your domain:

echo '/.+/ [email protected]' > /etc/postfix/sender_canonical
echo 'sender_canonical_maps = regexp:/etc/postfix/sender_canonical' >> /etc/postfix/main.cf
systemctl reload postfix

For these messages not to land in spam, the domain must be authenticated: see configuring SPF, DKIM and DMARC.

7. Test

echo "Test from $(hostname)" | mail -s "Postfix test" [email protected]
journalctl -u 'postfix*' -n 20 --no-pager

In the log, look for status=sent: the relay accepted the message. If you receive it, check it is not in the spam folder. To receive messages addressed to root, such as cron's, add the line root: [email protected] to /etc/aliases, then run newaliases.

8. Troubleshoot

The queue of pending messages is shown with mailq, and postqueue -f forces a new delivery attempt.

Frequently asked questions