DriversRecommendedOutdated drivers can make a good PC feel brokenScan driver issues before chasing fixes manually.Scan NowHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan Now×
FREEDOM251

Freedom251 › Blog › Debian

How to Install and Configure Postfix on a Linux VPS

By Freedom251 Team · · 14 min read

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

To run Postfix safely on a Linux VPS, establish the server’s hostname and DNS first, choose whether the machine will deliver mail directly or relay through another SMTP service, then install Postfix and lock down its identity, relay permissions, TLS, authentication, and firewall. A send-only server can be relatively small; a VPS that also stores mailboxes needs additional delivery and mailbox software.

This guide uses Debian and Ubuntu conventions. Substitute your real domain for example.com and the server name for mail.example.com. The commands assume an account with sudo access.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Decide what the VPS must do

Postfix is an SMTP mail-transfer agent (MTA). It accepts messages from local applications or authenticated clients, places them in a queue, and either delivers them to recipient servers or forwards them to an upstream SMTP relay. It does not, by itself, provide a complete mailbox service with IMAP or POP3 access.

Deployment How mail leaves the VPS What you must operate
Direct Internet delivery Postfix connects to recipient domains’ MX servers, normally over TCP port 25. DNS, reverse DNS, TLS, sender authentication records, reputation, queue monitoring, and compliance with the VPS provider’s SMTP policy.
Upstream relay Postfix hands mail to a relay service that performs onward delivery. Relay credentials, the provider’s required TLS and authentication settings, and the relay’s sender and recipient policies. Port-25 reputation work is reduced, but the upstream service becomes a delivery dependency.
Send-only application server Local applications submit messages to Postfix; Postfix delivers directly or uses a relay. Usually no local user mailboxes. Keep relay permissions limited to the server itself or authenticated submission clients.
Mailbox server Postfix receives and routes mail for local users, while a separate delivery and access stack stores and serves it. An MDA and an IMAP/POP3 service in addition to Postfix, plus mailbox storage, quotas, filtering, and account management.

Choose the role before installation. The Debian/Ubuntu package dialog presents an Internet Site option for direct delivery and relay-oriented choices when another SMTP system will deliver the mail. Selecting the wrong role is recoverable, but it can leave identity, destination, and relay settings inconsistent.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

Complete the VPS and DNS prerequisites

Set a fully qualified hostname

Give the VPS a stable fully qualified domain name (FQDN), such as mail.example.com. The hostname should resolve to the VPS address and should be the name used in the SMTP greeting and certificate.

  1. Set the system hostname with your distribution’s supported hostname mechanism, then confirm it with hostname --fqdn.
  2. Add matching local name resolution in /etc/hosts if your operating-system setup requires it. Keep the canonical FQDN associated with the VPS address.
  3. Reopen your shell or restart services that cached the old hostname.

Publish forward and mail records

In the authoritative DNS zone, publish an A record for an IPv4 address and an AAAA record only when IPv6 is correctly routed and configured. For a receiving domain, publish an MX record pointing to the mail host, not directly to an address. A send-only host may not need an MX record for its own domain, but the domain’s sending and return-path design still needs to be intentional.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Arrange reverse DNS (PTR) with the VPS provider. The PTR should point the public address to the same FQDN used by Postfix, and forward DNS should resolve that name back to the address. Many receiving systems treat mismatches as a reputation or anti-abuse signal.

Check the provider’s network policy

Ask whether outbound TCP port 25 is blocked, rate-limited, or subject to an approval process. If direct delivery is unavailable, configure an upstream relay instead of trying to bypass the restriction. Keep the provider’s acceptable-use rules and abuse-contact requirements accessible for troubleshooting.

Prepare sender-authentication DNS

For the domain that appears in your envelope and message headers, plan SPF, DKIM, and DMARC records. Postfix can send mail without all three, but receiving systems increasingly evaluate them together. DKIM signing normally requires a separate signing component; it is not supplied by a basic Postfix installation.

Install Postfix on Ubuntu or Debian

Update package metadata and install the package:

sudo apt update
sudo apt install postfix

During the package configuration dialog, select the role matching your design. For direct server-to-server delivery choose Internet Site. For an upstream SMTP service, choose the relay-oriented setup and provide the relay host when prompted. The dialog may ask for the system mail name, destination domains, network ranges, local usernames, and mailbox format. Record each answer; these values become part of /etc/postfix/main.cf.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

After installation, verify that the service is enabled and running:

systemctl status postfix
sudo systemctl enable postfix

If the dialog was skipped or needs to be repeated, Debian-family systems provide:

sudo dpkg-reconfigure postfix

Understand Postfix’s configuration files

The Postfix project identifies main.cf and master.cf as its two most important files.

Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
  • /etc/postfix/main.cf contains site-wide parameters: identity, destinations, network trust, TLS, SASL, queues, and restrictions.
  • /etc/postfix/master.cf defines daemon services and listener behavior, including submission services. A service line beginning with # is disabled.

Use postconf for controlled edits and inspection instead of repeatedly rewriting files with ad-hoc scripts. Back up a working configuration before major changes:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo cp -a /etc/postfix/main.cf /etc/postfix/main.cf.backup
sudo cp -a /etc/postfix/master.cf /etc/postfix/master.cf.backup

Display only non-default settings with:

postconf -n

Postfix configuration files should remain owned by root and readable only as needed. Protect files containing private keys or relay passwords; do not paste secrets into tickets or shell history. After editing, validate and apply changes:

sudo postfix check
sudo systemctl reload postfix

Use a full restart when changing a service definition or when a reload does not replace a running listener:

sudo systemctl restart postfix

Set identity, destinations, and trust boundaries

The following parameters determine who the server is, which addresses it accepts, and which clients it trusts:

Parameter Purpose Typical consideration
myhostname The server’s FQDN and usual SMTP identity. Use the name with matching forward and reverse DNS, for example mail.example.com.
mydomain The parent domain used by other Postfix defaults. Set it deliberately when the system hostname alone does not produce the intended domain.
myorigin The domain appended to locally generated mail. Choose whether local system mail should appear from the host domain or the organization’s mail domain.
mydestination Domains Postfix treats as locally delivered. List only domains whose mail this server is genuinely responsible for. Do not add every domain you send from.
inet_interfaces Addresses on which Postfix listens. Use all only when every configured interface should accept SMTP; a send-only host can listen more narrowly.
mynetworks Networks trusted to relay without SASL. Keep this list narrow: loopback and explicitly controlled application addresses, never an entire public range.

Inspect current values and set explicit values with commands such as:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
postconf myhostname mydomain myorigin mydestination inet_interfaces mynetworks
sudo postconf -e 'myhostname = mail.example.com'
sudo postconf -e 'mydomain = example.com'
sudo postconf -e 'myorigin = $mydomain'
sudo postconf -e 'mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain'
sudo postconf -e 'inet_interfaces = all'
sudo postconf -e 'mynetworks = 127.0.0.0/8 [::1]/128'

Adjust the destination list for your actual role. A send-only machine should not accept mail for domains it does not host. If IPv6 is enabled, include only IPv6 ranges you control.

Prevent an open relay

Relay restrictions must require either a trusted network or successful authentication. Keep recipient restrictions enabled and review them after every package or configuration change. A baseline for a host that relays only for local applications is:

sudo postconf -e 'smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination'
sudo postconf -e 'smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination'

The exact restriction set may differ with your Postfix release and policy, but the essential rule is unchanged: unauthenticated clients on untrusted networks must not relay to arbitrary external recipients. Never test relay behavior against real third parties until you have verified the restriction order.

Choose local delivery or send-only operation

Postfix can deliver to local Unix users, but local delivery is not the same as a user-facing mailbox service. Ubuntu documents Maildir as an alternative format:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo postconf -e 'home_mailbox = Maildir/'

With that setting, locally delivered messages are placed under each user’s home directory in Maildir structure. Users still need a mail access service such as IMAP or POP3, and a complete mailbox deployment also needs account controls, storage permissions, filtering, and a delivery agent. Those components are outside a Postfix-only send-only setup.

For a send-only application host, avoid creating unnecessary local destinations. Configure the application to submit locally over loopback or to use authenticated submission, and keep local mailbox delivery disabled unless it is required for system notifications.

Configure TLS correctly

TLS protects SMTP traffic and SASL credentials. Obtain a certificate whose subject or subject-alternative name matches the hostname clients use, such as mail.example.com. Store the private key with restrictive ownership and permissions, and arrange renewal before expiration.

Server-side TLS settings

Point Postfix to the certificate and key, then choose a security level appropriate to the service:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo postconf -e 'smtpd_tls_cert_file = /etc/ssl/mail/mail.example.com/fullchain.pem'
sudo postconf -e 'smtpd_tls_key_file = /etc/ssl/mail/mail.example.com/privkey.pem'
sudo postconf -e 'smtpd_tls_security_level = may'
sudo postconf -e 'smtpd_tls_auth_only = yes'

may advertises STARTTLS when available without refusing every remote server that lacks TLS. Requiring TLS for all inbound Internet delivery can prevent legitimate mail because remote domains may not support it. For authenticated submission, require encryption before authentication by enabling TLS on the submission service and using smtpd_tls_auth_only = yes.

Client-side TLS for outbound delivery

For direct delivery, Postfix is the SMTP client. A common interoperability setting is opportunistic TLS:

sudo postconf -e 'smtp_tls_security_level = may'
sudo postconf -e 'smtp_tls_loglevel = 1'

When an upstream relay requires encryption, set the client policy to the level required by that provider and verify the relay’s certificate name. Do not apply a mandatory TLS policy globally unless every destination is known to support it; use destination-specific policies when only selected relays require strict encryption.

Protect the key and confirm STARTTLS

Limit the private-key file to the account and group that need it, then reload Postfix after renewal. From a controlled workstation, inspect the SMTP greeting and STARTTLS negotiation:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
openssl s_client -starttls smtp -connect mail.example.com:25 -servername mail.example.com
openssl s_client -starttls smtp -connect mail.example.com:587 -servername mail.example.com

Check that the presented certificate matches the hostname, chains to a trusted authority, and has not expired. A successful TLS handshake does not prove that authentication or relay authorization is configured correctly; test those separately.

Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.

Enable authenticated submission with SASL

SMTP-AUTH lets a client identify itself through a SASL mechanism, with TLS protecting the authentication exchange. Postfix supports Cyrus SASL and Dovecot SASL. Choose the backend that fits the rest of your mail stack; Dovecot SASL is a natural choice when Dovecot already provides mailbox access, while Cyrus SASL may fit an existing Cyrus deployment.

Use Dovecot SASL

Install and configure Dovecot’s authentication service so it exposes a Unix socket that Postfix can access. The socket path and group must match on both sides. Then configure Postfix:

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo postconf -e 'smtpd_sasl_auth_enable = yes'
sudo postconf -e 'smtpd_sasl_type = dovecot'
sudo postconf -e 'smtpd_sasl_path = private/auth'
sudo postconf -e 'smtpd_sasl_security_options = noanonymous'
sudo postconf -e 'smtpd_sasl_local_domain = $myhostname'
sudo postconf -e 'broken_sasl_auth_clients = yes'

The Dovecot socket must be reachable by the Postfix process, and Dovecot must offer only mechanisms appropriate for your TLS policy. Never enable anonymous authentication for public submission.

Use Cyrus SASL

With Cyrus SASL, install the mechanism packages required by your distribution, configure the SASL service name and authentication database, and point Postfix at the resulting SASL implementation. The precise package names and database configuration vary by Debian or Ubuntu release, so verify the installed module names locally before enabling a mechanism.

Expose a submission service on port 587

In /etc/postfix/master.cf, enable the submission service and apply settings that require TLS and authentication. A typical service block is:

submission inet n       -       y       -       -       smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_tls_auth_only=yes
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject

The exact spacing is not significant, but each continuation line must remain associated with the submission service. Reload Postfix and confirm that it is listening on port 587. Authenticated clients should submit there rather than sending credentials over the general port-25 listener.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use port 465 only when configured for implicit TLS

Port 465 is appropriate only when you deliberately configure an implicit-TLS submission service and your clients require it. It is not interchangeable with STARTTLS on port 587. Do not open port 465 merely because it is conventional; enable and test the service explicitly.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Configure an upstream relay when direct delivery is unsuitable

An upstream relay is useful when the provider blocks port 25, when you do not want to manage direct-delivery reputation, or when organizational policy centralizes outbound mail. Set the relay host and, if required, credentials:

sudo postconf -e 'relayhost = [smtp.relay.example]:587'
sudo postconf -e 'smtp_sasl_auth_enable = yes'
sudo postconf -e 'smtp_sasl_security_options = noanonymous'
sudo postconf -e 'smtp_tls_security_level = encrypt'
sudo postconf -e 'smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd'

Create the password map with the relay’s exact hostname and credentials, protect the source file, compile the database, and remove accidental world-readable permissions:

sudo chmod 600 /etc/postfix/sasl_passwd
sudo postmap /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd.db
sudo postfix check
sudo systemctl reload postfix

Use the relay provider’s required certificate policy, username format, sender restrictions, and port. Do not publish or reuse credentials in application configuration when local submission can centralize them safely.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Open only the ports the design needs

At the VPS firewall and any cloud security group, allow only required traffic:

Port Purpose When to open it
25/TCP Server-to-server SMTP and, on some designs, unencrypted-to-STARTTLS inbound SMTP. Open for direct delivery or inbound mail. Provider policy may block outbound use even when inbound access is allowed.
587/TCP Authenticated message submission with STARTTLS. Open when applications or users submit from networks outside the trusted local range.
465/TCP Authenticated submission with implicit TLS. Open only when that service is explicitly configured and required by clients.

Keep SSH access restricted separately. Do not expose administrative services on the mail interface, and do not assume that a listening Postfix port is safe merely because authentication is enabled elsewhere.

Verify the installation in layers

Validate configuration and service state

  1. Review effective non-default settings: postconf -n.
  2. Run the built-in consistency check: sudo postfix check. Correct every reported permission, directory, or syntax problem.
  3. Check the unit: systemctl status postfix.
  4. Confirm listeners with your operating system’s socket tool, then compare them with the ports you intended to expose.

Submit a controlled test message

Send a message from a local application or an SMTP client to an address you control. Watch the mail log in another terminal while submitting. On many Debian and Ubuntu systems the log is in /var/log/mail.log; systems using only the journal can be followed with:

sudo journalctl -u postfix -f

Check the queue immediately afterward:

postqueue -p

A successful delivery removes the message from the active queue and produces a delivery status in the log. A queued message is not proof of failure; it means Postfix is waiting for a retry or a correction.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Test submission authentication

Connect to port 587 with an SMTP client that supports AUTH and STARTTLS. Confirm that the server advertises STARTTLS, refuses authentication before encryption when your policy requires it, accepts valid credentials, and rejects invalid credentials. Then verify that an authenticated client can relay while an unauthenticated Internet client cannot.

Test externally

Deliver to controlled recipients at more than one external domain. Inspect the complete headers for the sending host, TLS use, SPF alignment, DKIM signature when a signer is installed, and DMARC results. Test both IPv4 and IPv6 if both are published; an unusable IPv6 path can cause inconsistent delivery when an AAAA record exists.

Read queue and SMTP errors correctly

4xx responses: temporary deferral

A 4xx SMTP response means the remote system or a local policy has deferred delivery. Leave the message queued while you investigate the log, DNS, network reachability, rate limits, and the remote response. Repeated deferrals can eventually produce a bounce after Postfix’s retry and expiration policy is exhausted.

5xx responses: permanent rejection

A 5xx response is treated as a permanent failure until the cause is corrected. Common causes include an invalid recipient, missing or mismatched DNS, a rejected sender domain, authentication failure at the relay, policy blocks, or a certificate-name problem. Fix the underlying issue before forcing repeated retries; retrying unchanged mail can worsen reputation and logs.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Useful queue operations

postqueue -p
sudo postqueue -f
sudo postsuper -d QUEUE_ID

Use postqueue -f only after correcting a temporary problem or changing delivery conditions. Delete a message with postsuper -d only when you have confirmed its queue ID and intend to discard it. Preserve the log entry before deletion if you need an audit trail.

Common failure patterns and fixes

  • Host-name mismatch: myhostname, forward DNS, PTR, and the certificate name differ. Choose one canonical FQDN and align all four.
  • Relay denied: the client is neither in mynetworks nor authenticated, or the submission service is not using the intended restrictions. Test on port 587 with valid credentials rather than broadening trust.
  • Open-relay risk: mynetworks contains a public network or recipient restrictions permit unauthenticated destinations. Narrow the network list immediately, reload, and test from an untrusted connection.
  • Authentication unavailable: the Dovecot or Cyrus socket, service name, permissions, or mechanism packages do not match Postfix. Check the SASL service log and the socket path before changing relay rules.
  • TLS handshake failure: the certificate is expired, the name does not match, the chain is incomplete, the private key is unreadable, or the client and server share no protocol or cipher. Validate with openssl s_client and inspect the log.
  • Messages remain queued: inspect the recipient’s latest SMTP response, DNS lookups, firewall egress, provider port-25 policy, and the retry schedule. Do not treat a full queue as a single diagnosis.
  • Local mail disappears from the expected place: confirm home_mailbox, local delivery permissions, and whether an MDA or mailbox service is installed. Postfix alone does not create an IMAP-accessible mailbox.

Operational checklist before production use

  • The VPS has a stable FQDN, matching forward and reverse DNS, and a certificate for the name clients use.
  • The intended direct-delivery or upstream-relay role is documented and reflected in the package configuration.
  • mydestination, inet_interfaces, and mynetworks contain only required values.
  • Relay restrictions reject unauthenticated external recipients, and an open-relay test has failed as expected.
  • Port 587 authentication requires TLS; port 465 is enabled only when explicitly configured.
  • SPF, DKIM, and DMARC are published or deliberately scheduled for the sending domain.
  • The VPS firewall and provider security group expose only required SMTP ports.
  • postfix check, postconf -n, service status, queue inspection, TLS negotiation, authenticated submission, and external delivery tests all pass.
  • Log retention, queue monitoring, certificate renewal, and a procedure for handling 4xx and 5xx responses are in place.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

DebianLinux VPSMail ServerPostfixSASLSMTPSMTP TLSUbuntu

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.