Postfix

Chapter 78: Postfix Mail Server

Comprehensive Postfix Configuration

Why This Matters in DevOps/SRE

Email infrastructure is critical for business communication and transactional emails. As a DevOps/SRE, you’ll configure Postfix for sending emails, set up relay hosts, manage spam filtering, implement DKIM/DMARC, and troubleshoot email delivery issues. Email is one of the hardest services to get right.

┌─────────────────────────────────────────────────────────────────────────────┐
│                    POSTFIX IN DEVOPS OPERATIONS                             │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │                    EMAIL DELIVERY FLOW                                 │    │
│  │                                                                       │    │
│  │   App → Postfix → Relay (AWS SES/SendGrid) → Internet → Recipient   │    │
│  │                                                                       │    │
│  └─────────────────────────────────────────────────────────────────────┘    │
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │                    DEV OPS TASKS                                        │    │
│  │                                                                       │    │
│  │   • Transactional emails: password resets, order confirmations     │    │
│  │   • Emailrelay: Forward through SES, SendGrid, Mailgun             │    │
│  │   • SPF/DKIM/DMARC: Authenticate emails                            │    │
│  │   • Monitoring: Queue depth, delivery rates, bounce rates         │    │
│  │                                                                       │    │
│  └─────────────────────────────────────────────────────────────────────┘    │
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │                    COMMON ISSUES                                       │    │
│  │                                                                       │    │
│  │   • Emails going to spam                                             │    │
│  │   • Blacklisting                                                     │    │
│  │   • SPF/DKIM failures                                               │    │
│  │   • Queue buildup                                                    │    │
│  │                                                                       │    │
│  └─────────────────────────────────────────────────────────────────────┘    │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

Real-world DevOps scenarios:

AWS SES relay: Forward all mail through SES for deliverability
Transactional email: Sending password resets from application
Email authentication: SPF, DKIM, DMARC setup for domain
Monitoring: Alerting on queue buildup

78.1 Postfix Architecture

                 Postfix Components
+------------------------------------------------------------------+
|                                                                   |
|    Postfix is modular:                                            |
|    +----------------------------------------------------------+  |
|    | smtpd     | SMTP server daemon                           |  |
|    | smtp      | SMTP client                                 |  |
|    | local     | Local delivery agent                        |  |
|    | virtual   | Virtual alias delivery                      |  |
|    | bounce   | Delivery status notifications                |  |
|    | cleanup  | Message canonicalization                    |  |
|    | qmgr     | Queue manager                               |  |
|    | pickup   | Mail pickup from queue                     |  |
|    | tlsmgr   | TLS management                             |  |
|    | anvil    | Connection tracking                        |  |
|    | spawn    | Spawn external commands                    |  |
|    +----------------------------------------------------------+  |
|                                                                   |
|    Mail Flow:                                                      |
|    +----------------------------------------------------------+  |
|    | Internet → smtpd → cleanup → qmgr → local/smtp        |  |
|    +----------------------------------------------------------+  |
|                                                                   |
+------------------------------------------------------------------+

78.2 Installation

# Install
sudo apt install postfix postfix-ldap postfix-pcre  # Debian/Ubuntu
sudo yum install postfix                           # RHEL/CentOS
sudo pacman -S postfix                            # Arch

# Start service
sudo systemctl enable --now postfix

78.3 Configuration

main.cf

# Identity
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
mydestination = $myhostname, localhost, localhost.$mydomain, $mydomain

# Network
inet_interfaces = all
inet_protocols = ipv4
mynetworks = 127.0.0.0/8, 10.0.0.0/8
mynetworks_style = subnet

# Mailbox
home_mailbox = Maildir/
mailbox_command =

# Security
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_recipient_restrictions = permit_sasl_authenticated, reject

# TLS
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_security_level = may

# Outbound TLS
smtp_tls_security_level = may

# Size limits
message_size_limit = 52428800  # 50MB
mailbox_size_limit = 1073741824  # 1GB

# Logging
maillog_file = /var/log/postfix.log

# Virtual domains
virtual_alias_domains = hash:/etc/postfix/virtual
virtual_alias_maps = hash:/etc/postfix/virtual

master.cf

smtp      inet  n       -       y       -       -       smtpd
submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes

smtps     inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes

pickup    unix  n       -       y       60      pickup
cleanup   unix  n       -       y       -       cleanup
qmgr      unix  n       -       n       300     qmgr
tlsmgr    unix  -       -       y       1000?   tlsmgr
rewrite   unix  -       -       y       -       trivial-rewrite
bounce    unix  -       -       y       0       bounce
defer     unix  -       -       y       0       bounce
trace     unix  -       -       y       -       bounce
verify    unix  -       -       y       1       verify
flush     unix  n       -       y       1000?   flush
proxymap  unix  -       -       n       -       proxymap
proxywrite unix -       -       n       -       proxymap
smtp      unix  -       -       y       -       smtp
relay     unix  -       -       y       -       smtp
showq     unix  n       -       y       -       showq
error     unix  -       -       y       -       error
retry     unix  -       -       y       -       error
discard   unix  -       -       y       -       discard
lmtp      unix  -       -       y       -       lmtp
anvil     unix  -       -       y       1       anvil
scache    unix  -       -       y       1       scache
postlog   unix  n       -       n       -       postlogd

78.4 Virtual Domains

# virtual alias domains must be listed in main.cf as virtual_alias_domains

# Format: address or @domain target
user@example.com    actualuser
@example.com       catchall@example.com

# Generate database
sudo postmap /etc/postfix/virtual
sudo postfix reload

78.5 Management Commands

# Test configuration
sudo postfix check

# Start/Stop/Reload
sudo systemctl start postfix
sudo systemctl stop postfix
sudo systemctl reload postfix
sudo postfix reload

# Queue management
mailq                          # List queue
postqueue -p                   # Same as mailq
postsuper -d ALL              # Delete all mail
postsuper -d <ID>             # Delete specific
postsuper -r ALL              # Requeue all
postsuper -r <ID>             # Requeue specific

# Flush queue
postfix flush

# View mail log
tail -f /var/log/mail.log
tail -f /var/log/postfix/postfix.log

78.6 Interview Questions

Basic Questions

What is Postfix?
- Mail transfer agent (MTA)
What are the main components?
- smtpd, smtp, local, qmgr
What is the difference between smtpd and smtp?
- smtpd: server, smtp: client
How do you check mail queue?
- mailq or postqueue -p

Common Mistakes & Anti-Patterns

1. Not Using Relay Host

❌ WRONG: Direct delivery to internet

# Sending directly
mydestination = $myhostname, localhost.$mydomain, localhost
# Emails might be rejected!

✅ CORRECT: Use relay host

# Use SES or email service
relayhost = [email-smtp.us-east-1.amazonaws.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
smtp_sasl_tls_security_options = noanonymous
smtp_tls_CAfile = /etc/ssl/certs/ca-bundle.crt
smtp_tls_security_level = encrypt
smtp_tls_wrappermode = no

2. Not Configuring SPF/DKIM

❌ WRONG: Emails go to spam

# No authentication
# SPF not configured
# DKIM not signed
# Emails marked as spam!

✅ CORRECT: Configure email authentication

# SPF: Add TXT record
v=spf1 include:_spf.aws.amazon.com ~all

# DKIM: Sign emails with DKIM selector
# (configure in relay service or OpenDKIM)

3. Open Relay

❌ WRONG: Server used for spam

# DON'T do this!
my networks = 0.0.0.0/0
# Anyone can relay!

✅ CORRECT: Restrict relay

# Only allow local/subnet
mynetworks = 127.0.0.0/8 10.0.0.0/8

# Or use authentication
smtpd_sasl_auth_enable = yes
smtpd_sasl_tls_security_options = noanonymous

4. Not Monitoring Queue

❌ WRONG: Queue buildup unnoticed

# Not checking queue
# Messages pile up
# Users complain about not receiving email

✅ CORRECT: Monitor queue

# Add to monitoring
postqueue -p | tail -n +2 | awk 'BEGIN {rs=""} /^[0-9A-F]/{if (rs) print rs; rs=$0} END{print rs}' | wc -l
# Alert if > 100 messages

5. Wrong Permissions

❌ WRONG: Security issues

# Wrong permissions
chmod 777 /var/spool/postfix
# Security vulnerability!

✅ CORRECT: Proper permissions

# Postfix runs as postfix user
chown -R postfix:postfix /var/spool/postfix
chmod -R 700 /var/spool/postfix

Summary

                 Quick Reference
+------------------------------------------------------------------+
|                                                                   |
|    Commands:                                                      |
|    +----------------------------------------------------------+  |
|    | sudo postfix check            | Test config              |  |
|    | sudo postfix reload          | Reload config           |  |
|    | mailq                       | View queue              |  |
|    | postsuper -d ALL            | Clear queue            |  |
|    +----------------------------------------------------------+  |
|                                                                   |
|    Main config: /etc/postfix/main.cf                            |
|    Daemon config: /etc/postfix/master.cf                        |
|                                                                   |
+------------------------------------------------------------------+