Chapter 4. Postfix

Table of Contents

4.1. Initial settings
4.2. Virtual users and domains
4.3. MySQL
4.4. Saslauthd
4.5. Preventing unwanted access
4.6. TLS
4.7. Submission port
4.8. Blocking certain attachments
4.9. Maximum message size
4.10. Commit your changes
4.11. Important commands
4.12. Quota support

The time has finally come to install Postfix.

apt-get install postfix

During installation Postfix will ask you to choose the type of installation and a domain.

Choose Internet site and enter your servers name atlantis.example.com. It is important that your server name is not just example.com.

After installation finishes we can check if Postfix is runing by connecting to port 25 on your localhost with telnet:

# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 atlantis.example.com ESMTP Postfix (Debian/GNU)

Type quit to exit.

If you see Postfix responding, Postfix is working. For another check we can try to send email to one of your email accounts that are located on another server:

atlantis:~# mail your-other-email@somedomain.com
Subject: test email from example.com
test body of the email.
.
Cc:

The single dot on the line is a sign that your are done with the emails body.

You should be getting this email message on the account you specified.

Check that you have your example.com in a file /etc/mailname.

4.1. Initial settings

[Note]Note

Do not be afraid to play with config files at this stage. If you have installed etckeeper as suggested, you can always revert to the previous state. Just remember to commit your changes every time you change something by running etckeeper commit "Descirption of the changes made". The default Postfix configuration files were already commited when we installed Postfix.

First we are going to delete the content of the /etc/postfix/main.cf file so we can fill it with our own.

atlantis:~# cat /dev/null > /etc/postfix/main.cf

Now copy and paste these lines, but make sure to replace myhostname = atlantis.example.com with your hostname.

##################
# Default settings
##################
biff = no
append_dot_mydomain = no
#delay_warning_time = 4h
readme_directory = no
smtpd_banner = $myhostname ESMTP $mail_name

################
# TLS parameters
################
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

###############
# Main settings
###############
myhostname = atlantis.example.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $mydomain, localhost.$mydomain, localhost
relayhost = 
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
[Tip]Tip

Postfix extracts $mydomain from the value of the myhostname and strips the part before the first dot, including the dot. So in this case mydomain is example.com.

If you are not using IPv6 you can remove IPv6 addresses from mynetworks and leave just mynetworks = 127.0.0.0/8. We will use the mynetworks variable to tell Postfix that all computers specified in the my networks range can send emails without authentification. We are leaving only the localhost here so we make sure that mail originating from the server (like outputs of cron jobs and other system messages) do not get blocked by other rules we will implement.

Restart Postfix by running invoke-rc.d postfix restart and try to send another test mail to check that we didn't mess something up.

Now it would be a good time to also test if Postfix is receiving mails as well. Try sending an email to just and to using the mail command as described in the previous section. If everything works the received emails should be located in /var/mail/root. Check that file and make sure that you are sending email from the right domain (sender should be ). If you do not receive an email check the Postifx log file to see what could have gone wrong.