Arch Linux

gattu_marrudu

Member

Registered: 2008-03-29

Posts: 116

Configuring Postfix as a relay only

Hi there,
I have a local Arch Linux server with a fully configured mail server with Postfix, Dovecot, Spamassassin, etc. This is where I want to dispatch and store all my mail.

I am unable to send mail to external addresses from that server because the ISP blocks SMTP ports. So, I got a lightweight cloud server on a reputable provider that I want to use only as a mail relay.

I see many posts online about how to set up one's Postfix instance to forward mail to a relay, but not how to configure the relay itself.  So I started by installing Postfix, opendkim, opendmarc, etc., copying my local Postfix configuration to the relay server, and starting to edit the configuration with the help of the Postfix reference guide.

I configured the relay to trust only mynetworks and SASL authenticated clients. Now, things are getting a bit dicey because in my local server SASL is handled by Dovecot, but I believe I don't need Dovecot for a pure relay. Do I?

I'm sure I'll have many more questions as I keep configuring,  so I wanted to ask first, is Postfix the best tool for a relay-only server? If it is, does it need anything else (other than DKIM and DMARC daemons)? Does anyone have pointers to step-by-step instructions to set up this scenario on Arch?

Thanks,
gm

gattu_marrudu

Member

Registered: 2008-03-29

Posts: 116

Re: Configuring Postfix as a relay only

My main.cf:

alias_database = $alias_maps
alias_maps = lmdb:/etc/postfix/aliases
command_directory = /usr/bin
compatibility_level = 3.11
daemon_directory = /usr/lib/postfix/bin
data_directory = /var/lib/postfix
debug_peer_level = 3
debug_peer_list = $mynetworks
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
home_mailbox = Maildir/
html_directory = no
inet_protocols = ipv4
local_recipient_maps =
mail_owner = postfix
mail_spool_directory = /var/spool/mail
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
meta_directory = /etc/postfix
milter_default_action = accept
mydestination = $myhostname, localhost.$mydomain, localhost
myhostname = <REDACTED>
mynetworks_style = host
newaliases_path = /usr/bin/newaliases
non_smtpd_milters = $smtpd_milters
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix
sendmail_path = /usr/bin/sendmail
setgid_group = postdrop
shlib_directory = /usr/lib/postfix
smtp_header_checks = regexp:/etc/postfix/smtp_header_checks
smtp_tls_security_level = may
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_helo_restrictions = reject_unknown_helo_hostname
smtpd_milters = unix:/run/opendkim/opendkim.sock, unix:/run/opendmarc/opendmarc.sock
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_invalid_hostname, reject_unknown_recipient_domain, reject_unauth_destination, reject_rbl_client zen.spamhaus.org, reject_rhsbl_reverse_client dbl.spamhaus.org, reject_rhsbl_helo dbl.spamhaus.org, reject_rhsbl_sender dbl.spamhaus.org, permit
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/${myhostname}/fullchain.pem
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, KRB5-DES, CBC3-SHA
smtpd_tls_key_file = /etc/letsencrypt/live/${myhostname}/privkey.pem
smtpd_tls_security_level = may
tls_config_file = ${config_directory}/openssl.cnf
tls_config_name = postfix
tls_eecdh_auto_curves =
tls_ffdhe_auto_groups =
unknown_local_recipient_reject_code = 550
virtual_alias_domains = <REDACTED>
virtual_alias_maps = lmdb:/etc/postfix/virtual
virtual_transport = dovecot

And my master.cf:

submissions     inet  n       -       n       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_security_level=encrypt
  -o smtpd_tls_wrappermode=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_relay_restrictions=
  -o smtpd_sender_login_maps=lmdb:/etc/postfix/virtual
  -o smtpd_sender_restrictions=reject_sender_login_mismatch
  -o smtpd_relay_restrictions=
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  # SASL authentication with dovecot
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_sasl_security_options=noanonymous
  -o smtpd_sasl_local_domain=$myhostname
  -o smtpd_recipient_restrictions=

pickup    unix  n       -       n       60      1       pickup
cleanup   unix  n       -       n       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
#qmgr     unix  n       -       n       300     1       oqmgr
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
rewrite   unix  -       -       n       -       -       trivial-rewrite
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce
verify    unix  -       -       n       -       1       verify
flush     unix  n       -       n       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       n       -       -       smtp
relay     unix  -       -       n       -       -       smtp
        -o syslog_name=${multi_instance_name?{$multi_instance_name}:{postfix}}/$service_name
showq     unix  n       -       n       -       -       showq
error     unix  -       -       n       -       -       error
retry     unix  -       -       n       -       -       error
discard   unix  -       -       n       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
scache    unix  -       -       n       -       1       scache
postlog   unix-dgram n  -       n       -       1       postlogd

As you can see, I still have dovecot set as the default transport and SASL authentication mechanism.

Last edited by gattu_marrudu (Yesterday 02:20:09)

-thc

Member

Registered: 2017-03-15

Posts: 1,220

Re: Configuring Postfix as a relay only

So, I got a lightweight cloud server on a reputable provider that I want to use only as a mail relay.

That's a little hasty for me. Postfix can relay emails via port 587 (submission) - does your ISP block that port as well?

Last edited by -thc (Yesterday 06:34:45)

gattu_marrudu

Member

Registered: 2008-03-29

Posts: 116

Re: Configuring Postfix as a relay only

I think I have had problems with 587, even though I use 465 normally (I think there is a non-TLS handshake at some point?). I will double check.

The other reason for moving to a cloud server was that my ISP is Verizon, and there may be a chance  that my IP block may get blacklisted. I am having the same problem with another mail server I have on Digitalocean (OK, that is even worse than Verizon). Even though my IP on that cloud server is only blacklisted in UCEPROTECT L3, I am having some problems with my mails going into my recipients' spam. So I found a Swiss-based provider that seems to have a good reputation for curbing spammers, and that's where I'd like to run the relay.

But if you think that I can run safely SMTP locally, that would definitely be most desirable.

-thc

Member

Registered: 2017-03-15

Posts: 1,220

Re: Configuring Postfix as a relay only

Submission (587) is somewhat like smtp (25) - TLS is not expected but can be initiated via "STARTTLS". You can configure postfix to only use TLS via submission.

The alternative to rely on the reputation of the IP range (like you do) is to relay all your mail to a "regular" mail provider (via a regular account on that server and feeding this account into postfix). The only issue here is that very picky mail server admins may not like the first mail hop (your private server).

Last edited by -thc (Today 07:33:14)

Acor

Member

Registered: 2026-10-02

Posts: 12

Re: Configuring Postfix as a relay only

... but I believe I don't need Dovecot for a pure relay. Do I?
...
is Postfix the best tool for a relay-only server?

Many years ago, I worked with mail servers. As I recall, Postfix is used for sending messages, while Dovecot is used for receiving them. Postfix can be configured as SMTP server to use an external relay server. If the mailboxes for receiving messages are also located on an external server, you would, in my view, need a tool like Fetchmail to retrieve the messages from there and deliver them (potentially with Postfix acting as an intermediary) to local mailboxes - such as those provided by Dovecot.

stronnag

Member

Registered: 2011-01-25

Posts: 88

Re: Configuring Postfix as a relay only

I had a similar requirement, satisfied using `migadu.com` (Swiss email provider). Works really well, local LAN postfix relays mail using postfix's`relayhost = ` and `transport` such that LAN email is delivered to LAN mailboxes and external goes via `migadu.com`. Inbound is retrieved from `migadu` by `getmail` `IDLE` (or `fetchmail` if you wish) and delivered to local mailboxes. LAN clients then retrieve email via the LAN `dovecot` and send via the LAN `postfix` which has the above `relayhost` / 'transport' settings.  `migadu` provides the necessary DKIM and DMARC settings, no need for local.

Just a very contented customer of a very affordable email provider with excellent documentation and setup instructions. Requires (IIRC) that you have your own domain, as much of setting is at the DNS level.