Introduction
Relaying your email through an external SMTP provider (such as Gmail, SendGrid, or Amazon SES) can improve your email deliverability and reliability. This guide walks you through installing (if needed) and configuring Postfix to send email via an external SMTP server with secure authentication and TLS encryption.
Prerequisites
Before you begin, ensure you have the following details from your email provider:
- SMTP server address (e.g.,
smtp.example.com) - SMTP port (
587for STARTTLS or465for implicit TLS) - A valid username and password for the SMTP account
- (Optional) A CA certificate or chain file if required
Installation of Postfix
If Postfix is not already installed on your system, follow the instructions below based on your distribution:
Debian/Ubuntu
sudo apt-get update
sudo apt-get install -y mailutils postfixDuring installation, select Internet Site when prompted and enter your system mail name (e.g., example.com).
CentOS / Fedora
sudo dnf install -y postfix mailx
# or
sudo yum install -y postfix mailxEnsure Postfix is enabled and started using your system’s service manager.
1. Configure Postfix
1.1 Edit the Main Configuration File
Open the Postfix main configuration file (/etc/postfix/main.cf):
sudo nano /etc/postfix/main.cfAdd or update the following settings at the bottom of the file. Replace smtp.example.com and 587 with your provider’s settings:
# Define the external SMTP relay (square brackets prevent MX lookups)
relayhost = [smtp.example.com]:587
# Enable SMTP authentication and specify the password file
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_sasl_tls_security_options = noanonymous
# Enable TLS encryption
smtp_use_tls = yes
smtp_tls_security_level = encrypt
smtp_tls_note_starttls_offer = yes
# (Optional) Specify the CA certificate file if required
# smtp_tls_CAfile = /etc/postfix/cacert.pemSave and exit (press CTRL + X, press Y, then press ENTER)
1.2 Configure Optional CA Certificate
If your SMTP provider requires a specific CA certificate, copy it to /etc/postfix/cacert.pem:
sudo cp /path/to/your/provider-ca.pem /etc/postfix/cacert.pem2. Create and Secure the SASL Password File
2.1 Create the Credentials File
Create the file /etc/postfix/sasl_passwd:
sudo nano /etc/postfix/sasl_passwdAdd the following line (replace with your SMTP details):
[smtp.example.com]:587 username:passwordSave and exit (press CTRL + X, press Y, then press ENTER)
2.2 Secure the File and Generate the Hash Map
Set the correct file permissions to protect your credentials:
sudo chmod 600 /etc/postfix/sasl_passwdGenerate the Postfix lookup table:
sudo postmap /etc/postfix/sasl_passwd3. Reload Postfix and Verify the Configuration
Reload Postfix to apply the changes:
sudo systemctl reload postfixAlternatively, on older systems use:
sudo service postfix reloadCheck the configuration syntax:
sudo postfix check4. Test Your Setup
Send a test email from the command line:
echo "This is a test email body." | mail -s "Test Email Subject" [email protected]If the email does not arrive, check your mail logs. For example, on Debian/Ubuntu:
sudo tail -n 50 /var/log/mail.logOr if your logs appear in syslog:
sudo tail -n 50 /var/log/syslog | grep postfixAdditional Considerations
- Gmail Users: If using Gmail, you may need to create an App Password and enable two-factor authentication. Ensure SMTP relay is permitted in your account settings.
- Missing CA Certificates: If you encounter errors such as
cat: /etc/ssl/certs/thawte_Primary_Root_CA.pem: No such file or directory, verify the certificate path or download the certificate usingwget. - Sender Address Verification: Errors like
Sender verify failedindicate that the sender address (e.g.,root@your_domain.comor[email protected]) is rejected. Use canonical mapping to rewrite the sender address to the valid email configured in your SASL settings. - Routing Local Domain Mail: If sending mail to addresses on your own domain, review the
mydestinationparameter in/etc/postfix/main.cfor set up virtual aliases to force external delivery. See this article for guidance. - IPv6 Connectivity Issues: Errors like
Network is unreachablewhen connecting to an IPv6 address suggest your system may not have proper IPv6 connectivity. Consider disabling IPv6 in Postfix or configuring your network accordingly. - Security Modules: Consider SELinux (RHEL/CentOS/Fedora) or AppArmor (Ubuntu) which might require extra configuration adjustments.
Conclusion
You have now configured Postfix to relay email through an external SMTP server with secure authentication and TLS encryption. Test your configuration thoroughly and consult the logs for any issues. Happy emailing!
Let me know if this helped. Follow me on Twitter, Facebook and YouTube, or 🍊 buy me a smoothie.
[root@mailserver postfix]# cat /etc/ssl/certs/thawte_Primary_Root_CA.pem | sudo tee -a /etc/postfix/cacert.pem
cat: /etc/ssl/certs/thawte_Primary_Root_CA.pem: No such file or directory
Was this issue resolved? I am facing the same problem.
Mar 25 12:47:27 ubuntu postfix/smtp[5794]: E0DADC51F5: to=, relay=none, delay=2.1, delays=0.01/0.01/2.1/0, dsn=4.4.1, status=deferred (connect to smtp.gmail.com[2404:6800:4003:c03::6c]:587: Network is unreachable)
WOW, it works perfectly!
Thanks heaps!
Worked like a charm. Thank You!
[root@mantisbt ssl]# cat /etc/ssl/certs/thawte_Primary_Root_CA.pem | sudo tee -a /etc/postfix/cacert.pem
cat: /etc/ssl/certs/thawte_Primary_Root_CA.pem: No such file or directory
What is your distribution of Linux?
Also see if you can locate the cert
locate thawte_Primary_Root_CA.pemI have the same issue, i.e. 257 certs in /etc/ssl/certs but no thawte_Primary_Root_CA.pem:
“cat: /etc/ssl/certs/thawte_Primary_Root_CA.pem: No such file or directory.”
I’m on Raspbian Buster, deritive of Debian 10. Locate drew a blank on “thawte_Primary_Root_CA.pem” as did find.
Can I substitute another cert?
sudo wget https://www.thawte.com/roots/thawte_Primary_Root_CA.pem
thank you doctor.
Awesome! Thank you so much for this. I’ve been trying to find a simple solution to allow my home server to email me via SMTP and this worked on the initial try.
Great! 🙂
Cannot send email, the following error occur:
(Host or domain name not found. Name service error for name=mail.khmerdeliveryservices.comtype=AAAA: Host found)
I did set up A record and AAAA record for mail.khmerdeliveryservices.com correctly from my domain registrar.
What have you got for
relayhostin/etc/postfix/main.cf?According to a DNS scan for you domain, you are using Namecheap for mail, is that right?
I’ve set this up with Mailgun so that WordPress comments will be emailed to my Gmail, however, I get this error in the log when I post a reply to someone.
What is the email address in Mailgun? I assume it’s not
root@your_domain.comand that’s why Mailgun is rejecting it. In that case, you will need to add a canonical map for postfix.For example, if your Mailgun email address is
info@your_domain.com, your canonical map would be:Please see below comment on how to set up a canonical map.
The syslog shows this error when trying to send a test. Using mailgun.
When I do a test email, nothing comes in. The syslog says this:
The problem is the from email address
myname@linuxserveris invalid and the SMTP server is rejecting it.You will need to use a valid email address here, the same one you set up in
sasl_passwd.To do this, we must do Postfix Address Rewriting.
Paste this to the bottom, save and exit.
Edit this file
Add in this file:
Where
myname@linuxserveris what’s showing in the error log, and[email protected]is the email address of the account you’re trying to send email through.Save file and close.
Now create the db file.
Restart postfix service
Now try send another test email
This works, I can send that test message. But when I try to send via PHP, nothing is received. Here is a new error.
It’s because you are trying to send mail to your own domain so the mail never leaves your server – it never reaches the external SMTP server at all. It’s telling you that it can’t find the account [email protected] on your server.
You need to make some changes to
/etc/postfix/main.cf.Please see Can’t send mail to own domain. Postfix: status=bounced (unknown user: “user”)
OK I did that, now I have a different error when trying to send PHP mail.
This address:
[email protected]is being rejected by the SMTP server because it doesn’t exist. Remember, this SMTP server will only except mail if the From email matches the account you are trying to send mail through.You will need to add another canonical map for
[email protected].Add
Where [email protected] is what’s showing in the error log, and [email protected] is the email address of the account you’re trying to send email through.
Save file and close.
Now create the db file.
Restart postfix service
Now try send another test email
My host Namecheap says to use mail server
server81.web-hosting.comand port465, will this work?There’s no reason to use port
465. That mail server servers responds to port587so I recommend using that.