Install Postfix with sudo apt install postfix, choose the setup role that matches your mail flow, then explicitly configure the hostname, trust boundaries, TLS and authentication before accepting Internet traffic. A reliable deployment also requires DNS A/AAAA, MX and reverse-DNS records, a provider that permits outbound SMTP, and layered testing of the queue and logs. The procedure below covers a send-only server, direct Internet delivery, upstream relaying and optional local mailboxes.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Plan the mail role before installing Postfix
Postfix can deliver mail directly to recipient servers or hand all outbound mail to an upstream SMTP service. Decide this first because it changes the installer choice, DNS, credentials, firewall rules and the amount of deliverability work you must own.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Deployment | Installer choice | How mail leaves the VPS | Operational implications |
|---|---|---|---|
| Direct Internet delivery | Internet Site | Postfix connects to recipient MX servers over TCP 25 | Your VPS needs a stable public address, matching PTR and hostname, valid sending-domain DNS, and a provider policy that allows server-to-server SMTP. You are responsible for reputation, retries and remote-server policy responses. |
| Upstream relay | Relay-oriented configuration | Postfix submits to a smarthost supplied by another SMTP service | The upstream service handles final delivery. You need its hostname, port, TLS policy and authentication details; the VPS still needs correct identity and secure client submission if applications connect to it. |
Required prerequisites
- A fully qualified hostname such as
mail.example.comthat resolves to the VPS public address. - Control of the sending domain, for example
example.com, so you can publish SPF, DKIM and DMARC records and choose the MX design. - Provider-managed reverse DNS (PTR) for the public address. Arrange this before testing direct delivery and make the PTR name resolve forward to the same address.
- Root or sudo access to a Debian or Ubuntu VPS, with a supported package repository and a working system clock.
- A firewall you can control. Plan for TCP 25 for server-to-server SMTP and TCP 587 for authenticated submission. Open TCP 465 only if you intentionally configure implicit TLS on that port.
- A Linux VPS hosting plan whose acceptable-use policy permits outbound SMTP. Some providers block or rate-limit port 25 by default.
Use a dedicated mail hostname rather than the bare domain when possible. Clients should connect to the same name that appears in the certificate and in the server’s greeting. If you use IPv6, publish an AAAA record only when the VPS has working IPv6 routing, firewall rules and reverse DNS; a broken AAAA record can make some remote servers fail before trying IPv4.
Install Postfix and answer the Debian/Ubuntu dialog
- Update package metadata and install the package:
sudo apt update sudo apt install postfix - When the package configuration screen appears, select Internet Site for direct delivery. Select a relay-oriented option when an upstream SMTP service will deliver your messages.
- Enter the system mail name. For a direct setup this is normally the fully qualified host name, such as
mail.example.com, unless your relay provider specifies another identity. - Review the remaining prompts. Ubuntu’s setup decisions include the host name, mail domain, local network range, local usernames and mailbox format. Do not add broad networks merely to make testing convenient.
- Finish the installation, then verify that the service started:
systemctl status postfix
The dialog writes an initial configuration, but it is not a substitute for auditing the resulting values. A package upgrade can also preserve old settings, so record deliberate changes in your deployment notes.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Know the two Postfix configuration files
The two central files are /etc/postfix/main.cf and /etc/postfix/master.cf. main.cf contains site-wide parameters such as identity, delivery and restrictions. master.cf defines the daemons and service entries that listen on ports or process special transports.
Edit parameters safely
Use postconf for controlled changes so syntax stays consistent and the active value is easy to inspect:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11sudo postconf -n
sudo postconf myhostname mydomain myorigin mydestination inet_interfaces mynetworks
sudo postconf -e 'myhostname = mail.example.com'
sudo postconf -e 'mydomain = example.com'
Keep ownership and permissions intact. Configuration files should be owned by root and not writable by unprivileged users; the TLS private key deserves especially strict protection. After edits, validate and apply them with:
sudo postfix check
sudo systemctl reload postfixReload applies configuration without needlessly dropping existing processes. Use sudo systemctl restart postfix when a component or package change specifically requires a full restart, and check the service status afterward.
Set identity, local domains and trust boundaries
These parameters determine what name Postfix presents, which addresses it listens on, which destinations are local and which clients may relay.
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
inet_interfaces = all
inet_protocols = all
mydestination = $myhostname, localhost.$mydomain, localhost
mynetworks = 127.0.0.0/8, [::1]/128, 203.0.113.10/32
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
Choose the local-domain behavior
myorigin supplies the domain for mail submitted by local processes. mydestination lists domains for which this host accepts local delivery. A send-only VPS should not list a domain as local unless it really stores mail for that domain; otherwise messages intended for that domain can be delivered locally instead of sent to its MX records. Add the domain only when you have deliberately chosen local mailbox delivery.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Bind only the interfaces you intend to expose
inet_interfaces = all is appropriate when the VPS must accept connections on its public addresses. A host that only sends through an upstream relay can bind more narrowly, reducing exposure. If you publish both IPv4 and IPv6, verify that both stacks are correctly filtered and routable before leaving inet_protocols = all.
Make mynetworks narrow
List only loopback and explicitly trusted application addresses, such as a private subnet or one fixed application IP. Inspect the generated value with postconf mynetworks; package defaults can include networks you did not intend to trust. Never use a broad public range, and never use an unrestricted relay rule on an Internet-facing VPS.
permit_mynetworks and permit_sasl_authenticated should be followed by reject_unauth_destination (or an equivalent recipient restriction) so an unauthenticated Internet client cannot relay to arbitrary domains. Test this boundary from outside your trusted networks.
Configure TLS for server connections and client submission
TLS protects SMTP content in transit when the peer negotiates encryption and protects the credentials used by SMTP AUTH. Obtain a certificate whose name matches the hostname clients use, such as mail.example.com. Keep the private key readable only by the account and service processes that require it; do not place it in a world-readable directory.
Outbound TLS
For direct Internet delivery, remote servers have different TLS capabilities. A typical starting point is opportunistic encryption:
smtp_tls_security_level = mayThis asks Postfix to use TLS when the destination offers it but still permits delivery when a remote server does not. Do not make TLS mandatory for all general Internet delivery unless you have confirmed that every destination supports it; a mandatory policy can turn otherwise deliverable mail into repeated deferrals.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
When using an upstream relay, follow that provider’s requirement instead. The relay may require encryption and authentication on a particular port, and may provide a CA or hostname policy you must configure.
Inbound TLS and submission
Set the certificate and key in main.cf (use the paths issued by your certificate process):
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemssmtpd_tls_cert_file = /etc/ssl/mail/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/ssl/mail/mail.example.com/privkey.pem
smtpd_tls_security_level = may
Port 587 is the standard authenticated submission endpoint and normally requires STARTTLS before authentication. Port 465 uses implicit TLS and should be opened only when you explicitly enable an implicit-TLS service in master.cf and need compatibility with clients that expect it. Do not advertise a port that is not actually configured.
For submission, override the service so authentication and encryption are mandatory even if the general SMTP service remains opportunistic:
submission inet n - y - - smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
The exact spacing in master.cf is flexible, but each continuation line must begin with whitespace. Reload Postfix after changing it and confirm that the service is listening on 587.
Enable SMTP authentication with SASL
SMTP-AUTH lets a client identify itself through a SASL mechanism, with TLS used to protect the authentication exchange. Postfix supports Dovecot SASL and Cyrus SASL. Choose the backend that matches the rest of your mail stack rather than installing both without a reason.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Dovecot SASL integration
Configure Dovecot to expose an authentication socket that Postfix can reach, then point Postfix at that socket. A common Postfix-side configuration is:
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sasl_path must match the actual socket path in the Dovecot configuration and the Postfix chroot layout. Confirm that the Postfix process can access the socket and that the authentication service is running before diagnosing client failures as password problems.
Cyrus SASL integration
With Cyrus SASL, install and configure the Cyrus mechanisms and point Postfix to the mechanism provider and password database selected for your system. The Postfix-side requirements remain the same: enable SASL, disallow anonymous mechanisms, require TLS before credentials are sent, and permit relay only for authenticated clients or explicitly trusted networks.
Recommended Free Tools
Keep authentication off the public port unless intended
Internet-facing port 25 is primarily for server-to-server traffic. Offer user authentication on 587 (and on 465 only when explicitly configured), then apply a submission-specific restriction that accepts authenticated recipients and rejects everyone else. Never solve a failed login by adding the client’s entire ISP or cloud-provider network to mynetworks.
Decide whether the VPS stores mailboxes
A send-only installation can submit messages from local applications and relay them outward without hosting user inboxes. If you need local delivery, choose a mailbox format and add a delivery and retrieval stack.
Maildir delivery
Ubuntu documents this alternative setting:
home_mailbox = Maildir/Postfix then delivers each user’s mail into a Maildir under the user’s home directory. That creates files, not a complete mail service: you still need a mail delivery agent arrangement and an IMAP or POP3 server for users to read messages. Those components are outside a Postfix-only send-and-relay setup.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Keep send-only hosts simple
For a notification server, avoid accepting local domains you do not intend to host. Define the application source addresses in mynetworks, use submission authentication for remote applications, and test that messages addressed to your own domain follow the intended route rather than disappearing into a local mailbox.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Coordinate DNS, reverse DNS and firewall policy
| Item | Purpose | What to verify |
|---|---|---|
| A record | Maps mail.example.com to the VPS IPv4 address |
Forward lookup returns the address actually used by Postfix. |
| AAAA record | Maps the host to IPv6 | Publish only when IPv6 routing, firewalling and PTR are operational. |
| MX record | Names the receiving host for a domain | The target has an A/AAAA record and is the host you intend to operate. |
| PTR (reverse DNS) | Gives the sending address a mail hostname | Your VPS provider sets it; forward and reverse names should agree. |
| SPF | Authorizes sending addresses or an upstream relay | Include the actual direct-sending address or the relay’s documented mechanism, and avoid multiple SPF records. |
| DKIM | Adds a cryptographic signature to outgoing mail | Publish the selector’s public key and ensure the signing service is actually connected to Postfix. |
| DMARC | Defines recipient-side policy for SPF/DKIM alignment | Start with a policy appropriate to your verification data and monitor reports before tightening enforcement. |
Open only the ports required by your role. Direct delivery normally needs inbound and outbound TCP 25. Authenticated applications need TCP 587. TCP 465 is optional and means implicit TLS, not STARTTLS. Keep administrative ports separate from mail rules, and confirm that provider-level firewalls do not silently block the traffic your local firewall permits.
Verify the installation in layers
1. Inspect effective configuration and syntax
sudo postconf -n
sudo postfix check
sudo systemctl status postfixpostconf -n shows non-default parameters, which is useful for reviewing exactly what you changed. postfix check catches ownership, directory and syntax problems before they become delivery failures.
2. Watch the service log while testing
On Ubuntu, follow the mail log while submitting a controlled message:
sudo tail -f /var/log/mail.logOn systems using the journal, the equivalent is:
sudo journalctl -u postfix -fSubmit to an external address you control, not a random recipient. Record the queue ID, remote response and whether the message was delivered, deferred or rejected.
3. Check the queue
postqueue -pAn empty queue after successful delivery is expected. A queue full of deferred messages means Postfix is still retrying; inspect the reason beside each queue ID and correlate it with the log. Do not repeatedly flush a queue until you understand the error.
4. Inspect STARTTLS
openssl s_client -starttls smtp -connect mail.example.com:587 -servername mail.example.com -crlfAfter the TLS handshake, issue EHLO client.example and confirm that the server advertises authentication only after TLS where your policy requires it. Check that the certificate name matches the host clients use and that the chain is trusted by the client.
5. Test authentication and delivery
Use an SMTP client configured for the submission hostname, port 587, STARTTLS and a real SASL account. Verify that unauthenticated relay attempts are rejected, authenticated submissions are accepted, and a message reaches a controlled external recipient. For direct delivery, confirm that the receiving server sees the expected hostname, source address and authentication records.
Interpret SMTP responses correctly: a 4xx response is a temporary deferral and should remain in the queue for retry; a 5xx response is a permanent rejection until its cause is corrected. The log normally identifies whether the problem is DNS, TLS negotiation, authentication, policy, recipient validity or a provider block.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Troubleshoot common failures
| Symptom | Likely cause | Checks and fix |
|---|---|---|
| Postfix will not start after an edit | Invalid parameter, malformed master.cf continuation or bad file permissions |
Run postfix check, inspect systemctl status postfix and the journal, correct the reported line, then reload or restart. |
| Remote servers reject the connection or message immediately | Missing or mismatched PTR, hostname DNS, provider port-25 block, or poor domain authentication | Check A/AAAA and PTR alignment, ask the VPS provider about SMTP policy, verify MX/SPF/DKIM/DMARC and read the remote 5xx text. |
| Mail remains deferred with 4xx responses | Temporary remote throttling, DNS failure, connection timeout or TLS negotiation issue | Inspect the queue ID and log, test DNS and STARTTLS, correct the network or certificate problem, then allow Postfix to retry. |
| Clients receive an authentication error | SASL socket path or permissions, inactive Dovecot/Cyrus service, wrong port, or TLS required before AUTH | Confirm the backend service and socket, match smtpd_sasl_path, test port 587 with STARTTLS, and ensure the account is valid. |
| Client can submit but cannot relay to an external domain | Submission service lacks the authenticated relay restriction | Check the service-specific smtpd_recipient_restrictions and global smtpd_relay_restrictions; permit authenticated clients and reject unauthenticated destinations. |
| Messages to the site’s own domain never leave the VPS | The domain is listed in mydestination although no local mailbox service was intended |
Remove that domain from local destinations for a send-only role, reload, and retest the route. |
| STARTTLS works on one port but not another | 587 STARTTLS and 465 implicit TLS were confused, or only one service was defined in master.cf |
Use a STARTTLS-aware client on 587; configure and firewall an explicit implicit-TLS service before offering 465. |
Operational checklist before going live
- The VPS hostname, A/AAAA records and provider PTR are consistent.
- The selected direct-delivery or upstream-relay role matches the installer configuration and Postfix parameters.
myhostname,myorigin,mydestination,inet_interfacesandmynetworkshave been reviewed explicitly.- Relay restrictions reject unauthenticated destinations; no public network is trusted accidentally.
- The certificate covers the client-facing name, the private key is protected, and submission requires TLS before authentication.
- Dovecot SASL or Cyrus SASL is reachable through the configured socket or service, anonymous mechanisms are disabled, and authenticated relay works.
- SPF, DKIM and DMARC records match the actual sending path.
- Only the required firewall ports are open and the VPS provider permits the intended SMTP traffic.
postfix check, service status, queue inspection, log monitoring, STARTTLS testing and an external delivery test all succeed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
