Configure Postfix main.cf | LightServe Docs

Postfix is the program that sends and receives mail for your server. Most of its settings live in one file, main.cf. This article covers the few settings a new mail server needs, and how to keep the server from becoming an open relay that strangers can abuse to send spam.

Before you begin

An Ubuntu 24.04 LTS VPS that you can reach over SSH, with a sudo user (this guide uses alex) or root.
A hostname for your mail server, such as mail.example.com, with a DNS A record pointing at your server. The examples use the documentation address 203.0.113.10.
Access to your domain's DNS settings, for example in Lantern DNS, LightServe's DNS editor.
Comfort with a terminal text editor. This article uses nano.

Step 1: Install Postfix

Ubuntu's Postfix package normally opens a setup screen and asks questions. You can answer them ahead of time so the install runs without stopping. The answer "Internet Site" means mail is sent and received directly over the internet, which is what a mail server does.

sudo apt update
echo "postfix postfix/main_mailer_type select Internet Site" | sudo debconf-set-selections
echo "postfix postfix/mailname string example.com" | sudo debconf-set-selections
sudo DEBIAN_FRONTEND=noninteractive apt install -y postfix

apt update refreshes the package list. The two debconf-set-selections lines pre-fill the answers, and the last command installs Postfix quietly.

Step 2: Set your server's identity

Postfix needs to know the full name of this server and the domain it is responsible for. myhostname is the server's own name, mydomain is your domain, and mydestination lists the addresses Postfix accepts as local mail. The single quotes stop the shell from trying to expand the $ names. Postfix reads them itself.

sudo postconf -e 'myhostname = mail.example.com'
sudo postconf -e 'mydomain = example.com'
sudo postconf -e 'myorigin = $mydomain'
sudo postconf -e 'mydestination = $myhostname, localhost.$mydomain, localhost'

postconf -e edits one setting in /etc/postfix/main.cf and leaves the rest of the file alone. myorigin is the domain that appears on mail sent from this server.

Step 3: Decide who may send mail through the server

Postfix handles two kinds of mail: mail arriving for your domain, and mail your own users send to other servers. The second kind is the one you must control. The defaults allow sending for your own machine and for users who log in with a password. Anyone else gets a "Relay access denied" error, which is exactly what you want.

sudo postconf -e 'inet_interfaces = all'
sudo postconf -e 'inet_protocols = all'
sudo postconf mynetworks smtpd_relay_restrictions

The first two lines let Postfix listen on all network interfaces over IPv4 and IPv6. If your VPS has no IPv6 address, use ipv4 instead of all for inet_protocols. The last command only prints the current values. Expected output:

mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination

In plain terms: the server accepts relayed mail from itself (mynetworks) and from logged-in users (permit_sasl_authenticated). Everyone else is refused.

Careful: never set mynetworks to 0.0.0.0/0 or add a rule that permits all senders. That creates an open relay. Spam bots scan for these within hours, and your server's IP address can end up on public blocklists, which causes other providers to reject your mail.

Step 4: Check the configuration and reload

Before you apply changes, ask Postfix to check the file for errors. If the check prints nothing, the configuration is valid. Then reload the service so it reads the new settings.

sudo postfix check
sudo systemctl reload postfix
sudo postconf -n

postconf -n lists every setting that differs from the Postfix defaults. It is a useful snapshot to copy into your notes. Expected output includes lines like these:

myhostname = mail.example.com
mydestination = $myhostname, localhost.$mydomain, localhost
mydomain = example.com
myorigin = $mydomain

Step 5: Send a local test message

A quick test confirms that Postfix accepts and delivers mail. Sending to a local user (here, alex, who must exist on the server) keeps the test inside your own machine, so it does not depend on outgoing network rules.

sudo apt install -y mailutils
echo "Hello from the new mail server" | mail -s "Postfix test" alex
sudo tail -n 5 /var/log/mail.log

mailutils provides the mail command. The log file records what Postfix did. Look for a line ending in status=sent, which means the message was delivered.

Tip: Watch the log live while you test by running sudo tail -f /var/log/mail.log. Press Ctrl+C to stop following it.

Troubleshooting

"unknown parameter name" warning: there is a typo in a setting name. Run sudo postconf -n and compare the spelling with the commands above.
"Relay access denied" when your own app sends mail: the sending machine is not in mynetworks. Authenticated sending is covered in the TLS article.
Changes seem ignored: postconf -e only edits the file. Run sudo systemctl reload postfix to apply it.
Quoting errors in postconf: keep each setting inside single quotes, with spaces around the equals sign.

Next steps

Postfix can now accept and deliver mail, but users still need a way to read it. Continue with the Dovecot article to set up IMAP access, then secure connections with TLS so passwords and messages are encrypted in transit.