Configure Postfix as Send-Only SMTP Server

This guide walks you through setting up Postfix as a send-only SMTP server on a Linux system. You’ll end up with a lightweight mail relay that can send email from your applications or scripts, but doesn’t accept incoming mail or maintain mailboxes. This is ideal for notifications, alerts, or transactional emails from a single server.

What You’ll Need

• A Linux server (Debian/Ubuntu, CentOS/RHEL, or similar) with root or sudo access.
• A domain name (or at least a hostname) that resolves correctly – used in the email’s From address.
• If your server’s IP is on a blocklist or you want better deliverability, you’ll also need SMTP credentials from a relay service (like Amazon SES, SendGrid, or your ISP’s SMTP).

Step-by-Step

1. Update your system – Run sudo apt update && sudo apt upgrade (Debian/Ubuntu) or sudo yum update (CentOS/RHEL) to ensure you have the latest packages.
2. Install Postfix and mail utilities – Install Postfix along with mailutils (or mailx) so you can test sending. On Debian/Ubuntu: sudo apt install postfix mailutils. During installation, select “Internet Siteâ€� when prompted.
3. Set your hostname – Ensure your server’s hostname is a fully qualified domain name (FQDN) like mail.example.com. Check with hostname -f. If it’s not, edit /etc/hostname and /etc/hosts to set it correctly, then reboot or run sudo hostname -F /etc/hostname.
4. Edit the main Postfix configuration – Open /etc/postfix/main.cf with a text editor (e.g., sudo nano /etc/postfix/main.cf). Make sure the following lines are set (adjust paths if needed):

   myhostname = mail.example.com
   mydomain = example.com
   myorigin = $mydomain
   inet_interfaces = loopback-only
   mydestination = $myhostname, localhost.$mydomain, localhost
   relayhost =

   If you’re using a relay service, replace relayhost = with the relay’s address (e.g., relayhost = [email-smtp.us-east-1.amazonaws.com]:587).

5. Set restrictions to prevent relaying – Add or confirm these lines to only allow mail from localhost and to reject everything else:

   mynetworks = 127.0.0.0/8
   smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination

   This ensures your server won’t be an open relay.

6. Configure SASL authentication (if using a relay) – If you’re relaying through a service that requires authentication, install SASL support: sudo apt install libsasl2-modules (Debian/Ubuntu) or sudo yum install cyrus-sasl-plain (CentOS/RHEL). Then edit /etc/postfix/main.cf to add:

   smtp_sasl_auth_enable = yes
   smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
   smtp_sasl_security_options = noanonymous
   smtp_tls_security_level = encrypt

   Create /etc/postfix/sasl_passwd with the relay’s hostname and credentials, e.g.:

   [email-smtp.us-east-1.amazonaws.com]:587 username:password

   Then run sudo postmap /etc/postfix/sasl_passwd and secure the file: sudo chmod 600 /etc/postfix/sasl_passwd.

7. Restart Postfix – Apply the changes with sudo systemctl restart postfix (or sudo service postfix restart).
8. Test sending an email – Use the mail command to send a test message to your own address: echo "Test body" | mail -s "Test Subject" you@example.com. Check your inbox (and spam folder) for the message.

Common Mistakes

• Forgetting to set a proper hostname – If your hostname is just localhost, many mail servers will reject your emails.
• Using a relay without authentication – Most relay services require authentication; without it, you’ll get “relay access deniedâ€� errors.
• Leaving the server open as a relay – If mynetworks includes more than localhost, spammers could abuse your server.
• Not updating DNS records – For good deliverability, set SPF, DKIM, and PTR records for your domain. Without them, your emails may go to spam.

Tips

• Use a relay service for better deliverability – If you’re sending to Gmail or Outlook, direct sending from a residential IP often lands in spam. A relay service improves your chances.
• Enable TLS for encryption – The smtp_tls_security_level = encrypt line ensures your credentials are encrypted when talking to the relay.
• Test with a real address – Always test with an address you control, not just localhost, to verify external delivery.
• Monitor logs – Check /var/log/mail.log or /var/log/maillog to see why emails are bouncing.

Troubleshooting

• Email not sending at all – Check the mail queue with mailq. If there are messages, view the error with sudo postcat -q <queue-id>. Common causes: incorrect relayhost, authentication failure, or DNS issues.
• “Relay access deniedâ€� – This usually means your relay service rejected the credentials or the relayhost is misconfigured. Verify the password file and that you ran postmap.
• Emails go to spam – Set up SPF (TXT record allowing your server’s IP) and DKIM (if using a relay, they often provide DKIM). Also ensure your server’s IP has a reverse DNS (PTR) record that matches your hostname.
• Postfix fails to start – Run sudo postfix check to see configuration errors. Look for typos in main.cf.
• Connection timeouts to relay – Check that your firewall allows outbound port 587 (or 465). Also verify the relay’s hostname resolves correctly.

Frequently Asked Questions

Can I send email without a relay service?

Yes, you can send directly from your server. However, many ISPs and cloud providers block outbound port 25, and your emails may be flagged as spam. For reliable delivery, a relay is recommended.

How do I set up SPF and DKIM?

SPF: Add a TXT record in your DNS like v=spf1 ip4:YOUR_SERVER_IP ~all. DKIM: Install opendkim and generate a key pair, then add the public key as a TXT record. If using a relay, they often provide DKIM signing.

How do I send email from a PHP or Python script?

Use the mail() function in PHP or smtplib in Python, pointing to localhost as the SMTP server. Postfix will handle the delivery.

What is the difference between send-only and full mail server?

A send-only server doesn’t receive mail, so it doesn’t need POP3/IMAP services or mailboxes. It simply relays outbound messages.

How do I change the From address?

In your script or mail client, set the From header explicitly. Postfix will use myorigin as the default domain if not specified.

Is it safe to run Postfix on a public IP?

Yes, as long as you restrict relaying to localhost only. The configuration above ensures that only local processes can send mail, preventing abuse.

Related

• Best RPG Games: Top Picks for Every Player
• Flux Alternatives: More Devices Support
• Does iCUE Need to Stay Open? What Works Without It