Postfix Mail Transfer Agent

Overview

• What you’ll learn: How to install, configure, and manage Postfix as a Mail Transfer Agent (MTA) on Ubuntu Server — including main.cf configuration, virtual domains, relay settings, and basic troubleshooting.
• Prerequisites: Email Protocols (SMTP, IMAP, POP3), basic Linux administration, DNS concepts
• Estimated reading time: 18 minutes

Introduction

Postfix is one of the most popular and widely deployed Mail Transfer Agents (MTAs) on the Internet. Originally written by Wietse Venema as a secure, fast alternative to Sendmail, Postfix has become the default MTA on many Linux distributions, including Ubuntu. It handles the SMTP side of email — accepting messages from clients and other servers, routing them, and delivering them to their final destination.

Postfix follows a modular architecture where different processes handle different tasks (receiving mail, delivering mail, managing queues). This design improves both security and performance, as each component runs with minimal privileges and can be independently configured.

In this lesson, you will learn how to install Postfix on Ubuntu Server, understand its configuration system, set up basic mail delivery, and troubleshoot common issues.

Installing Postfix

Postfix is available in the Ubuntu default repositories and can be installed with a single command. During installation, you will be prompted to select a configuration type. For a server that sends and receives mail directly, choose “Internet Site.”

# Install Postfix
$ sudo apt update
$ sudo apt install postfix -y

# During installation, select:
#   General type of mail configuration: Internet Site
#   System mail name: example.com

# Verify installation
$ sudo systemctl status postfix
● postfix.service - Postfix Mail Transport Agent
     Loaded: loaded (/lib/systemd/system/postfix.service; enabled)
     Active: active (running)

# Check Postfix version
$ postconf mail_version
mail_version = 3.6.4

# Verify Postfix is listening on port 25
$ sudo ss -tlnp | grep :25
LISTEN  0  100  0.0.0.0:25  0.0.0.0:*  users:(("master",pid=1234,fd=13))

Postfix Architecture

Postfix uses a master process (master) that supervises specialized daemon processes:

• smtpd: Receives incoming mail via SMTP from other servers and authenticated clients.
• smtp: Delivers outgoing mail to remote servers via SMTP.
• local: Delivers mail to local mailboxes.
• pickup: Picks up locally posted mail from the maildrop directory.
• qmgr: The queue manager that schedules mail for delivery.
• cleanup: Processes incoming mail before it enters the queue (header checks, rewriting).

Core Configuration: main.cf

The primary Postfix configuration file is /etc/postfix/main.cf. This file controls virtually all aspects of Postfix behavior. After installation, Ubuntu provides sensible defaults, but you will need to customize several parameters for a production environment.

# View the current non-default configuration
$ postconf -n

# Key parameters in /etc/postfix/main.cf:

# The hostname of this mail system
myhostname = mail.example.com

# The domain name used in outgoing mail
mydomain = example.com

# The domain appended to locally posted mail
myorigin = $mydomain

# Domains this server accepts mail for
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

# Networks allowed to relay through this server
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

# Mailbox format — Maildir is recommended for modern setups
home_mailbox = Maildir/

# Size limit for messages (10 MB)
message_size_limit = 10240000

# The banner shown to connecting clients
smtpd_banner = $myhostname ESMTP $mail_name

# Disable the SMTP VRFY command (prevents address harvesting)
disable_vrfy_command = yes

After editing main.cf, always check for syntax errors and reload:

# Check configuration for errors
$ sudo postfix check

# Reload configuration without restarting
$ sudo systemctl reload postfix

# Or restart completely
$ sudo systemctl restart postfix

TLS Encryption and Authentication

In a production environment, all SMTP communication should be encrypted with TLS. Postfix supports both opportunistic TLS (STARTTLS on port 587) and mandatory TLS for client submissions.

# TLS configuration in /etc/postfix/main.cf

# Enable TLS for incoming connections
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_tls_security_level = may
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

# Enable TLS for outgoing connections
smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# Modern TLS protocols only
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1

# Enable SASL authentication for submission
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    reject_unauth_destination

You must also enable the submission port (587) in /etc/postfix/master.cf:

# In /etc/postfix/master.cf, uncomment the submission line:
submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject

Managing the Mail Queue

Postfix maintains a queue of messages waiting for delivery. Understanding how to inspect and manage this queue is essential for troubleshooting delivery issues.

# View the mail queue
$ mailq
-Queue ID-  --Size-- ----Arrival Time---- -Sender/Recipient-------
A1B2C3D4E5    2048 Mon Mar  2 10:15:00  sender@example.com
                                         recipient@remote.com
-- 1 Kbytes in 1 Request.

# Alternative: use postqueue
$ sudo postqueue -p

# Force immediate delivery of all queued mail
$ sudo postqueue -f

# Delete a specific message from the queue
$ sudo postsuper -d A1B2C3D4E5

# Delete ALL messages from the queue (use with caution)
$ sudo postsuper -d ALL

# View the content of a queued message
$ sudo postcat -q A1B2C3D4E5

# Check mail logs for delivery information
$ sudo tail -f /var/log/mail.log
Mar  2 10:15:01 mail postfix/smtp[5678]: A1B2C3D4E5: to=<recipient@remote.com>,
  relay=mx.remote.com[198.51.100.10]:25, delay=0.5, delays=0.1/0.01/0.2/0.19,
  dsn=2.0.0, status=sent (250 2.0.0 Ok: queued)

Key Takeaways

• Postfix is a modular, secure MTA that uses separate processes (smtpd, smtp, local, qmgr) for different tasks, each running with minimal privileges.
• The primary configuration file /etc/postfix/main.cf controls hostname, domains, networks, TLS, and authentication; always run postfix check after changes.
• TLS should be configured for both inbound (smtpd_tls) and outbound (smtp_tls) connections; the submission port 587 should require encryption and authentication.
• The mail queue can be inspected with mailq, flushed with postqueue -f, and managed with postsuper; delivery logs are in /var/log/mail.log.
• For production use, always disable VRFY, set appropriate size limits, restrict relay access via mynetworks and SASL authentication, and integrate with Dovecot for user authentication.

What’s Next

In the next lesson, you will learn about Dovecot, which complements Postfix by providing IMAP and POP3 access so users can retrieve their email with mail clients.

# 安裝 Postfix
$ sudo apt update
$ sudo apt install postfix -y

# 安裝期間選擇：
#   郵件設定的一般類型：Internet Site
#   系統郵件名稱：example.com

# 驗證安裝
$ sudo systemctl status postfix

# 檢查 Postfix 版本
$ postconf mail_version
mail_version = 3.6.4

# 驗證 Postfix 正在監聽連接埠 25
$ sudo ss -tlnp | grep :25

# 檢視目前的非預設設定
$ postconf -n

# /etc/postfix/main.cf 中的關鍵參數：
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
home_mailbox = Maildir/
message_size_limit = 10240000
disable_vrfy_command = yes

# 檢查設定是否有錯誤
$ sudo postfix check

# 不重啟重新載入設定
$ sudo systemctl reload postfix

# /etc/postfix/main.cf 中的 TLS 設定

# 為傳入連線啟用 TLS
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_tls_security_level = may

# 為外送連線啟用 TLS
smtp_tls_security_level = may

# 啟用 SASL 身份驗證
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes

# 檢視郵件佇列
$ mailq

# 強制立即投遞所有佇列中的郵件
$ sudo postqueue -f

# 從佇列中刪除特定郵件
$ sudo postsuper -d A1B2C3D4E5

# 檢查郵件日誌中的投遞資訊
$ sudo tail -f /var/log/mail.log

# Postfix のインストール
$ sudo apt update
$ sudo apt install postfix -y

# インストール中の選択：
#   メール設定の一般タイプ：Internet Site
#   システムメール名：example.com

# インストールの確認
$ sudo systemctl status postfix

# Postfix バージョンの確認
$ postconf mail_version
mail_version = 3.6.4

# Postfix がポート 25 でリッスンしていることを確認
$ sudo ss -tlnp | grep :25

# 現在のデフォルト以外の設定を表示
$ postconf -n

# /etc/postfix/main.cf の主要パラメータ：
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
home_mailbox = Maildir/
message_size_limit = 10240000
disable_vrfy_command = yes

# 設定のエラーチェック
$ sudo postfix check

# 再起動せずに設定をリロード
$ sudo systemctl reload postfix

# /etc/postfix/main.cf の TLS 設定

# 受信接続の TLS を有効化
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_tls_security_level = may

# 送信接続の TLS を有効化
smtp_tls_security_level = may

# SASL 認証を有効化
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes

# メールキューの表示
$ mailq

# キュー内のすべてのメールを即座に配信
$ sudo postqueue -f

# キューから特定のメッセージを削除
$ sudo postsuper -d A1B2C3D4E5

# メールログで配信情報を確認
$ sudo tail -f /var/log/mail.log