Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsPostfix can send Ubuntu’s outbound mail through Google instead of connecting directly to recipient mail servers. For a personal Gmail or Google Workspace mailbox, configure Postfix to use [smtp.gmail.com]:587, authenticate with a Google app password, require STARTTLS, and keep the credential map readable only by root. Organizations that need IP- or policy-based delivery should use Google Workspace’s separate smtp-relay.gmail.com service instead.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What this setup does
Postfix is Ubuntu’s mail transfer agent. In this arrangement it acts as a local SMTP client: applications submit mail to the local Postfix service, and Postfix hands the messages to Google over an authenticated, encrypted connection. Google then performs the external delivery.
As an Amazon Associate I earn from qualifying purchases.
This is a send-only relay configuration. It does not turn your Ubuntu host into a Gmail inbox, and it does not require you to accept mail from the Internet. The host still needs a valid local hostname and working DNS, but it does not need to expose an inbound SMTP port for this use case.
Choose the Google endpoint that matches your account
| Use case | Hostname | Authentication model | Typical ports | Administrative control |
|---|---|---|---|---|
| One Gmail or Google Workspace mailbox | smtp.gmail.com |
Mailbox authentication, normally an app password when the client cannot perform OAuth | 587 with STARTTLS; 465 with implicit SSL | Controlled by the mailbox and Workspace security policy |
| Applications managed by a Google Workspace organization | smtp-relay.gmail.com |
Workspace administrator policy, commonly approved source IPs or authenticated policy settings | 25, 465, or 587, depending on the configured security mode | Controlled centrally by the Workspace administrator |
Do not replace one hostname with the other without changing the authentication and administrator configuration. They are different Google services.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prerequisites on Ubuntu
- An Ubuntu server or desktop with administrator access and a working network connection.
- A fully qualified local hostname. Check it with
hostname --fqdn; correct it before troubleshooting SMTP. - A Gmail or Google Workspace address that is allowed to send through Google’s SMTP submission service.
- Two-Step Verification enabled on that Google account if you will use an app password.
- Outbound DNS access and a firewall policy that permits the selected SMTP port, normally TCP 587.
Package names can vary slightly between Ubuntu releases. Record the Ubuntu and Postfix versions with lsb_release -a and postconf mail_version if you later need to diagnose a package or default-setting difference.
Install Postfix and the SMTP client modules
Refresh the package index and install Postfix, SASL client support, trusted CA certificates, and a local submission utility:
sudo apt update
sudo apt install postfix libsasl2-modules ca-certificates mailutilsDuring the Postfix package dialog, choose the system role that matches the machine. Choose Internet Site when the host should accept local submissions and you will define the upstream relay yourself. A satellite or system-relay style is appropriate when the host must always hand mail to another server and never attempt direct delivery. The exact dialog wording depends on the Ubuntu release.
After installation, inspect the generated configuration rather than assuming the installer selected the values you need:
sudo postconf -n
sudo systemctl status postfixThe active configuration is in /etc/postfix/main.cf. The package also creates a master service definition in /etc/postfix/master.cf; this relay setup normally does not require changing it.
Configure Gmail submission on port 587
Port 587 is Google’s message-submission path using STARTTLS. Add or edit these parameters in /etc/postfix/main.cf:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_sasl_tls_security_options = noanonymous
smtp_tls_security_level = encryptThe square brackets in relayhost suppress MX lookups for the hostname and force Postfix to connect to the specified server. Keep the same bracketed hostname and port in the password map; Postfix uses that exact key when looking up credentials.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
smtp_sasl_auth_enable = yes enables SMTP client authentication. The two noanonymous settings prevent anonymous SASL mechanisms. smtp_tls_security_level = encrypt requires TLS for the outbound SMTP session, so Postfix will not silently send the account credential or message over an unencrypted connection.
If your existing main.cf contains another relayhost or conflicting SASL/TLS value, keep one authoritative setting for each parameter. Use sudo postconf relayhost smtp_sasl_auth_enable smtp_sasl_password_maps smtp_tls_security_level to see the values Postfix will actually use.
Using port 465 instead
Port 465 uses implicit SSL: TLS starts immediately when the TCP connection opens. If your network or policy requires 465, use a separate configuration variant:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →relayhost = [smtp.gmail.com]:465
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_sasl_tls_security_options = noanonymous
smtp_tls_wrappermode = yes
smtp_tls_security_level = encryptDo not enable wrapper mode for a port-587 STARTTLS connection. Choose one mode, verify that the firewall allows that port, and test it before putting the host into production.
Create a Google app password
Postfix normally cannot display an interactive Google OAuth consent screen. Google therefore recommends OAuth where a client supports it; for a traditional SMTP client such as this, an app password is the practical mailbox credential.
- Sign in to the Google account that will send the messages and turn on Two-Step Verification.
- Open the account’s security settings and create an app password for this Postfix host or application. Give each host its own credential so it can be revoked independently.
- Copy the generated app password. It is separate from the normal account password and is usually displayed only when it is created.
App passwords can only be used with accounts that have Two-Step Verification enabled. A Workspace administrator can restrict app-password use, and Google’s Advanced Protection program may make it unavailable. Workspace no longer permits the old less-secure third-party username-and-password sign-in method, so a normal account password will generally produce an authentication failure.
Google revokes app passwords after the account’s primary password is changed. If mail stops immediately after a password change, create a replacement app password and update the Postfix map.
Recommended Free Tools
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Store the credential in Postfix’s password map
Create /etc/postfix/sasl_passwd with the exact destination key followed by the complete Gmail or Workspace address and app password:
sudoedit /etc/postfix/sasl_passwd[smtp.gmail.com]:587 [email protected]:APP_PASSWORDFor a Workspace mailbox, replace [email protected] with the full address, such as [email protected]. Do not omit the domain, and do not use an unbracketed key or a key with a different port.
Protect the source file, then build Postfix’s indexed database:
sudo chown root:root /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd
sudo postmap /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd.dbPostfix reads the map before dropping privileges, which is why the file belongs in /etc/postfix and should be readable and writable only by root. The generated sasl_passwd.db contains the same secret. Re-run sudo postmap /etc/postfix/sasl_passwd after every edit; changing the text file alone does not update the database Postfix reads.
Keep both files out of source control and backups that are accessible to ordinary users. If the app password is exposed, revoke it in Google account security and create a new one.
Restart Postfix and send a controlled test
Validate the configuration syntax, restart the service, and check that it is active:
sudo postfix check
sudo systemctl restart postfix
sudo systemctl --no-pager --full status postfixSubmit a plain-text message through the local sendmail-compatible interface:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
printf 'Subject: Postfix testnnThis is a test.n' | sendmail -v [email protected]Use an address you control or are authorized to contact. The -v option prints the SMTP conversation summary, but the system log is the authoritative place to inspect connection, TLS, authentication, queueing, and final delivery status.
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo journalctl -u postfix -fFor a successful delivery, the log should show a connection to Google on the configured port, TLS negotiation, SASL authentication, a queued message, and a remote SMTP status indicating acceptance. A queued message is not proof of final delivery; inspect later log entries for a deferred or bounced result.
Sender addresses and Google policy
Use the authenticated mailbox as the envelope sender unless your Google Workspace policy explicitly permits another sender domain. Google can reject or rewrite a sender that the account is not authorized to use. A 550 response can therefore indicate a sender-policy problem even when the password is correct.
For application mail, set a stable envelope sender so bounces return to an address that is monitored. Test both the visible From: header and the SMTP envelope sender, because they are separate values and Workspace policy may evaluate the envelope address.
When to use Google Workspace SMTP relay instead
Google documents smtp-relay.gmail.com as a separate service for devices and applications administered by a Workspace organization. Google recommends the SMTP relay service for sending mail from devices or apps when centralized policy is desired.
| Decision point | smtp.gmail.com |
smtp-relay.gmail.com |
|---|---|---|
| Account model | One Gmail or Workspace mailbox | Workspace organization and administrator-managed relay rule |
| Credential | Mailbox authentication; an app password is used when OAuth is not available | Administrator-configured IP, policy, or permitted authentication method |
| Encryption | 587 with STARTTLS or 465 with implicit SSL | Ports 25, 465, and 587 are documented, with TLS/SSL options selected by policy |
| Sender restrictions | Bound to the authenticated account and Google account policy | Controlled by approved domains, users, IP addresses, and Workspace relay settings |
| Best fit | A server sending as one mailbox | Multiple applications or servers under one organization’s control |
An administrator must configure the Workspace relay rule before a Postfix host can use it. Depending on that rule, the server may authenticate, present a registered source IP, or satisfy both requirements. Do not point a personal Gmail account at this hostname and expect mailbox authentication to work.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Sending limits and operational expectations
Google applies anti-abuse limits and filtering to both services. Current Google administrator guidance lists a limit of 2,000 messages per day for the Gmail SMTP option. The Workspace SMTP relay guidance lists 10,000 recipients per user per day. These are service limits, not a throughput guarantee; Google can also defer or filter suspicious traffic.
For alerts or transactional mail, queue messages locally, monitor deferred mail, and implement backoff rather than repeatedly retrying a rejected connection. Keep the sending volume appropriate for the account’s normal use, and use a dedicated mailbox or an administrator-managed relay policy for production applications.
Troubleshooting common failures
535 authentication failure
- Confirm that the username is the complete Gmail or Workspace address, not only the part before the at-sign.
- Generate a new app password and replace the old value. A normal account password will not work for this non-interactive client.
- Verify that Two-Step Verification is enabled and that Workspace policy or Advanced Protection has not disabled app passwords.
- Check that
/etc/postfix/sasl_passwdcontains[smtp.gmail.com]:587exactly, including brackets and port, then rebuild the map withsudo postmap /etc/postfix/sasl_passwd. - Confirm that the active value of
smtp_sasl_password_mapspoints tohash:/etc/postfix/sasl_passwd.
530 5.7.0 Must issue STARTTLS first
Postfix attempted authentication or delivery before negotiating TLS. Use port 587 with smtp_tls_security_level = encrypt, ensure the client is not configured for a plaintext fallback, and check that you did not accidentally enable implicit-SSL wrapper mode on port 587.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
550 relay or sender-policy error
Check the envelope sender and recipient policy. For a Workspace relay service, verify that the Ubuntu host’s public IP is registered in the administrator’s relay rule and that the sender domain is allowed. For smtp.gmail.com, verify that the authenticated mailbox is permitted to send as the address you supplied.
No worthy mechs found
This means Postfix cannot find a SASL mechanism that satisfies the configured security policy. Confirm that libsasl2-modules is installed, that the SASL client modules are available for your Ubuntu architecture, and that smtp_sasl_security_options = noanonymous is not blocking every mechanism before TLS is active. Keep TLS required; do not solve the error by allowing an unencrypted credential exchange.
No connection or repeated timeouts
- Resolve the destination with
getent hosts smtp.gmail.com. - Check outbound firewall rules and cloud-provider egress controls for TCP 587 or 465.
- Confirm that the selected port is not blocked by the local network.
- Review the Postfix and Ubuntu versions because package defaults, service names, and available SASL modules vary between releases.
Messages remain deferred
Follow the queue and log together:
sudo postqueue -p
sudo journalctl -u postfix --since '30 minutes ago'Look for the first Google response that caused the defer. Correct the underlying TLS, authentication, DNS, sender-policy, or rate-limit problem before forcing repeated retries.
Security checklist before production use
- Require encryption with
smtp_tls_security_level = encrypt; never permit a plaintext fallback for the credential. - Use a unique app password per host and revoke it when the host is retired.
- Keep
/etc/postfix/sasl_passwdand its database owned by root with mode600. - Rebuild the indexed map after every credential or destination change.
- Restrict local submission access so untrusted users cannot turn the machine into an open relay.
- Monitor the Postfix queue and journal for authentication failures, deferrals, bounces, and unexpected volume.
- Document whether the host uses mailbox submission at
smtp.gmail.comor an administrator-managed Workspace relay atsmtp-relay.gmail.com.
Configuration reference
For a single Gmail or Workspace mailbox using STARTTLS on port 587, the essential files and commands are:
# /etc/postfix/main.cf
relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_sasl_tls_security_options = noanonymous
smtp_tls_security_level = encrypt
# /etc/postfix/sasl_passwd
[smtp.gmail.com]:587 [email protected]:APP_PASSWORD
sudo chmod 600 /etc/postfix/sasl_passwd
sudo postmap /etc/postfix/sasl_passwd
sudo postfix check
sudo systemctl restart postfixThis configuration keeps the Ubuntu host as a local Postfix submission point while Google handles the external SMTP delivery. The critical details are the exact bracketed destination key, an app password rather than the account password, mandatory TLS, and root-only protection of the credential map.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
