1 1.1 tron <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 1.1.1.7 christos "https://www.w3.org/TR/html4/loose.dtd"> 3 1.1 tron 4 1.1 tron <html> 5 1.1 tron 6 1.1 tron <head> 7 1.1 tron 8 1.1 tron <title>Postfix Standard Configuration Examples</title> 9 1.1 tron 10 1.1.1.5 christos <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 11 1.1.1.6 christos <link rel='stylesheet' type='text/css' href='postfix-doc.css'> 12 1.1 tron 13 1.1 tron </head> 14 1.1 tron 15 1.1 tron <body> 16 1.1 tron 17 1.1 tron <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Standard Configuration Examples</h1> 18 1.1 tron 19 1.1 tron <hr> 20 1.1 tron 21 1.1 tron <h2>Purpose of this document</h2> 22 1.1 tron 23 1.1 tron <p> This document presents a number of typical Postfix configurations. 24 1.1 tron This document should be reviewed after you have followed the basic 25 1.1 tron configuration steps as described in the BASIC_CONFIGURATION_README 26 1.1 tron document. In particular, do not proceed here if you don't already 27 1.1 tron have Postfix working for local mail submission and for local mail 28 1.1 tron delivery. </p> 29 1.1 tron 30 1.1 tron <p> The first part of this document presents standard configurations 31 1.1 tron that each solve one specific problem. </p> 32 1.1 tron 33 1.1 tron <ul> 34 1.1 tron 35 1.1 tron <li><a href="#stand_alone">Postfix on a stand-alone Internet host</a> 36 1.1 tron 37 1.1 tron <li><a href="#null_client">Postfix on a null client</a> 38 1.1 tron 39 1.1 tron <li><a href="#local_network">Postfix on a local network</a> 40 1.1 tron 41 1.1 tron <li><a href="#firewall">Postfix email firewall/gateway</a> 42 1.1 tron 43 1.1 tron </ul> 44 1.1 tron 45 1.1 tron <p> The second part of this document presents additional configurations 46 1.1 tron for hosts in specific environments. </p> 47 1.1 tron 48 1.1 tron <ul> 49 1.1 tron 50 1.1 tron <li><a href="#some_local">Delivering some but not all accounts locally</a> 51 1.1 tron 52 1.1 tron <li><a href="#intranet">Running Postfix behind a firewall</a> 53 1.1 tron 54 1.1 tron <li><a href="#backup">Configuring Postfix as primary or backup MX host for a remote 55 1.1 tron site</a> 56 1.1 tron 57 1.1 tron <li><a href="#dialup">Postfix on a dialup machine</a> 58 1.1 tron 59 1.1 tron <li><a href="#fantasy">Postfix on hosts without a real 60 1.1 tron Internet hostname</a> 61 1.1 tron 62 1.1 tron </ul> 63 1.1 tron 64 1.1 tron <h2><a name="stand_alone">Postfix on a stand-alone Internet host</a></h2> 65 1.1 tron 66 1.1 tron <p> Postfix should work out of the box without change on a stand-alone 67 1.1 tron machine that has direct Internet access. At least, that is how 68 1.1 tron Postfix installs when you download the Postfix source code via 69 1.1.1.7 christos https://www.postfix.org/. </p> 70 1.1 tron 71 1.1 tron <p> You can use the command "<b>postconf -n</b>" to find out what 72 1.1 tron settings are overruled by your main.cf. Besides a few pathname 73 1.1 tron settings, few parameters should be set on a stand-alone box, beyond 74 1.1 tron what is covered in the BASIC_CONFIGURATION_README document: </p> 75 1.1 tron 76 1.1 tron <blockquote> 77 1.1 tron <pre> 78 1.1 tron /etc/postfix/main.cf: 79 1.1 tron # Optional: send mail as user@domainname instead of user@hostname. 80 1.1 tron #myorigin = $mydomain 81 1.1 tron 82 1.1 tron # Optional: specify NAT/proxy external address. 83 1.1 tron #proxy_interfaces = 1.2.3.4 84 1.1 tron 85 1.1 tron # Alternative 1: don't relay mail from other hosts. 86 1.1 tron mynetworks_style = host 87 1.1 tron relay_domains = 88 1.1 tron 89 1.1 tron # Alternative 2: relay mail from local clients only. 90 1.1 tron # mynetworks = 192.168.1.0/28 91 1.1 tron # relay_domains = 92 1.1 tron </pre> 93 1.1 tron </blockquote> 94 1.1 tron 95 1.1 tron <p> See also the section "<a href="#fantasy">Postfix on hosts without 96 1.1 tron a real Internet hostname</a>" if this is applicable to your configuration. 97 1.1 tron </p> 98 1.1 tron 99 1.1 tron <h2><a name="null_client">Postfix on a null client</a></h2> 100 1.1 tron 101 1.1 tron <p> A null client is a machine that can only send mail. It receives no 102 1.1 tron mail from the network, and it does not deliver any mail locally. A 103 1.1 tron null client typically uses POP, IMAP or NFS for mailbox access. </p> 104 1.1 tron 105 1.1 tron <p> In this example we assume that the Internet domain name is 106 1.1.1.4 tron "example.com" and that the machine is named "hostname.example.com". 107 1.1 tron As usual, the examples show only parameters that are not left at 108 1.1 tron their default settings. </p> 109 1.1 tron 110 1.1 tron <blockquote> 111 1.1 tron <pre> 112 1.1 tron 1 /etc/postfix/main.cf: 113 1.1.1.4 tron 2 myhostname = hostname.example.com 114 1.1.1.4 tron 3 myorigin = $mydomain 115 1.1.1.4 tron 4 relayhost = $mydomain 116 1.1.1.4 tron 5 inet_interfaces = loopback-only 117 1.1.1.4 tron 6 mydestination = 118 1.1 tron </pre> 119 1.1 tron </blockquote> 120 1.1 tron 121 1.1 tron <p> Translation: </p> 122 1.1 tron 123 1.1 tron <ul> 124 1.1 tron 125 1.1.1.4 tron <li> <p> Line 2: Set myhostname to hostname.example.com, in case 126 1.1.1.4 tron the machine name isn't set to a fully-qualified domain name (use 127 1.1.1.4 tron the command "postconf -d myhostname" to find out what the machine 128 1.1.1.4 tron name is). </p> 129 1.1.1.4 tron 130 1.1.1.4 tron <li> <p> Line 2: The myhostname value also provides the default 131 1.1.1.4 tron value for the mydomain parameter (here, "mydomain = example.com"). 132 1.1.1.4 tron </p> 133 1.1 tron 134 1.1.1.4 tron <li> <p> Line 3: Send mail as "user (a] example.com" (instead of 135 1.1.1.4 tron "user (a] hostname.example.com"), so that nothing ever has a reason 136 1.1.1.4 tron to send mail to "user (a] hostname.example.com". </p> 137 1.1.1.4 tron 138 1.1.1.4 tron <li> <p> Line 4: Forward all mail to the mail server that is 139 1.1 tron responsible for the "example.com" domain. This prevents mail from 140 1.1 tron getting stuck on the null client if it is turned off while some 141 1.1.1.4 tron remote destination is unreachable. Specify a real hostname 142 1.1.1.4 tron here if your "example.com" domain has no MX record. </p> 143 1.1 tron 144 1.1.1.4 tron <li> <p> Line 5: Do not accept mail from the network. </p> 145 1.1 tron 146 1.1.1.4 tron <li> <p> Line 6: Disable local mail delivery. All mail goes to 147 1.1.1.4 tron the mail server as specified in line 4. </p> 148 1.1 tron 149 1.1 tron </ul> 150 1.1 tron 151 1.1 tron <h2><a name="local_network">Postfix on a local network</a></h2> 152 1.1 tron 153 1.1 tron <p> This section describes a local area network environment of one 154 1.1 tron main server and multiple other systems that send and receive email. 155 1.1 tron As usual we assume that the Internet domain name is "example.com". 156 1.1 tron All systems are configured to send mail as "user (a] example.com", and 157 1.1 tron all systems receive mail for "user (a] hostname.example.com". The main 158 1.1 tron server also receives mail for "user (a] example.com". We call this 159 1.1 tron machine by the name of mailhost.example.com. </p> 160 1.1 tron 161 1.1 tron <p> A drawback of sending mail as "user (a] example.com" is that mail 162 1.1 tron for "root" and other system accounts is also sent to the central 163 1.1 tron mailhost. See the section "<a href="#some_local">Delivering some 164 1.1 tron but not all accounts locally</a>" below for possible solutions. 165 1.1 tron </p> 166 1.1 tron 167 1.1 tron <p> As usual, the examples show only parameters that are not left 168 1.1 tron at their default settings. </p> 169 1.1 tron 170 1.1 tron <p> First we present the non-mailhost configuration, because it is 171 1.1 tron the simpler one. This machine sends mail as "user (a] example.com" and 172 1.1.1.5 christos is the final destination for "user (a] hostname.example.com". </p> 173 1.1 tron 174 1.1 tron <blockquote> 175 1.1 tron <pre> 176 1.1 tron 1 /etc/postfix/main.cf: 177 1.1 tron 2 myorigin = $mydomain 178 1.1 tron 3 mynetworks = 127.0.0.0/8 10.0.0.0/24 179 1.1 tron 4 relay_domains = 180 1.1 tron 5 # Optional: forward all non-local mail to mailhost 181 1.1 tron 6 #relayhost = $mydomain 182 1.1 tron </pre> 183 1.1 tron </blockquote> 184 1.1 tron 185 1.1 tron <p> Translation: </p> 186 1.1 tron 187 1.1 tron <ul> 188 1.1 tron 189 1.1 tron <li> <p> Line 2: Send mail as "user (a] example.com". </p> 190 1.1 tron 191 1.1 tron <li> <p> Line 3: Specify the trusted networks. </p> 192 1.1 tron 193 1.1 tron <li> <p> Line 4: This host does not relay mail from untrusted networks. </p> 194 1.1 tron 195 1.1 tron <li> <p> Line 6: This is needed if no direct Internet access is 196 1.1 tron available. See also below, "<a href="#firewall">Postfix behind 197 1.1 tron a firewall</a>". </p> 198 1.1 tron 199 1.1 tron </ul> 200 1.1 tron 201 1.1 tron <p> Next we present the mailhost configuration. This machine sends 202 1.1.1.5 christos mail as "user (a] example.com" and is the final destination for 203 1.1 tron "user (a] hostname.example.com" as well as "user (a] example.com". </p> 204 1.1 tron 205 1.1 tron <blockquote> 206 1.1 tron <pre> 207 1.1 tron 1 DNS: 208 1.1 tron 2 example.com IN MX 10 mailhost.example.com. 209 1.1 tron 3 210 1.1 tron 4 /etc/postfix/main.cf: 211 1.1 tron 5 myorigin = $mydomain 212 1.1 tron 6 mydestination = $myhostname localhost.$mydomain localhost $mydomain 213 1.1 tron 7 mynetworks = 127.0.0.0/8 10.0.0.0/24 214 1.1 tron 8 relay_domains = 215 1.1 tron 9 # Optional: forward all non-local mail to firewall 216 1.1 tron 10 #relayhost = [firewall.example.com] 217 1.1 tron </pre> 218 1.1 tron </blockquote> 219 1.1 tron 220 1.1 tron <p> Translation: </p> 221 1.1 tron 222 1.1 tron <ul> 223 1.1 tron 224 1.1 tron <li> <p> Line 2: Send mail for the domain "example.com" to the 225 1.1 tron machine mailhost.example.com. Remember to specify the "." at the 226 1.1 tron end of the line. </p> 227 1.1 tron 228 1.1 tron <li> <p> Line 5: Send mail as "user (a] example.com". </p> 229 1.1 tron 230 1.1 tron <li> <p> Line 6: This host is the final mail destination for the 231 1.1 tron "example.com" domain, in addition to the names of the machine 232 1.1 tron itself. </p> 233 1.1 tron 234 1.1 tron <li> <p> Line 7: Specify the trusted networks. </p> 235 1.1 tron 236 1.1 tron <li> <p> Line 8: This host does not relay mail from untrusted networks. </p> 237 1.1 tron 238 1.1 tron <li> <p> Line 10: This is needed only when the mailhost has to 239 1.1 tron forward non-local mail via a mail server on a firewall. The 240 1.1 tron <tt>[]</tt> forces Postfix to do no MX record lookups. </p> 241 1.1 tron 242 1.1 tron </ul> 243 1.1 tron 244 1.1 tron <p> In an environment like this, users access their mailbox in one 245 1.1 tron or more of the following ways: 246 1.1 tron 247 1.1 tron <ul> 248 1.1 tron 249 1.1 tron <li> <p> Mailbox access via NFS or equivalent. </p> 250 1.1 tron 251 1.1 tron <li> <p> Mailbox access via POP or IMAP. </p> 252 1.1 tron 253 1.1 tron <li> <p> Mailbox on the user's preferred machine. </p> 254 1.1 tron 255 1.1 tron </ul> 256 1.1 tron 257 1.1 tron <p> In the latter case, each user has an alias on the mailhost that 258 1.1 tron forwards mail to her preferred machine: </p> 259 1.1 tron 260 1.1 tron <blockquote> 261 1.1 tron <pre> 262 1.1 tron /etc/aliases: 263 1.1 tron joe: joe (a] joes.preferred.machine 264 1.1 tron jane: jane (a] janes.preferred.machine 265 1.1 tron </pre> 266 1.1 tron </blockquote> 267 1.1 tron 268 1.1 tron <p> On some systems the alias database is not in /etc/aliases. To 269 1.1 tron find out the location for your system, execute the command "<b>postconf 270 1.1 tron alias_maps</b>". </p> 271 1.1 tron 272 1.1 tron <p> Execute the command "<b>newaliases</b>" whenever you change 273 1.1 tron the aliases file. </p> 274 1.1 tron 275 1.1 tron <h2><a name="firewall">Postfix email firewall/gateway</a></h2> 276 1.1 tron 277 1.1 tron <p> The idea is to set up a Postfix email firewall/gateway that 278 1.1 tron forwards mail for "example.com" to an inside gateway machine but 279 1.1 tron rejects mail for "anything.example.com". There is only one problem: 280 1.1 tron with "relay_domains = example.com", the firewall normally also 281 1.1 tron accepts mail for "anything.example.com". That would not be right. 282 1.1 tron </p> 283 1.1 tron 284 1.1 tron <p> Note: this example requires Postfix version 2.0 and later. To find 285 1.1 tron out what Postfix version you have, execute the command "<b>postconf 286 1.1 tron mail_version</b>". </p> 287 1.1 tron 288 1.1 tron <p> The solution is presented in multiple parts. This first part 289 1.1 tron gets rid of local mail delivery on the firewall, making the firewall 290 1.1 tron harder to break. </p> 291 1.1 tron 292 1.1 tron <blockquote> 293 1.1 tron <pre> 294 1.1 tron 1 /etc/postfix/main.cf: 295 1.1 tron 2 myorigin = example.com 296 1.1 tron 3 mydestination = 297 1.1 tron 4 local_recipient_maps = 298 1.1 tron 5 local_transport = error:local mail delivery is disabled 299 1.1 tron 6 300 1.1 tron 7 /etc/postfix/master.cf: 301 1.1 tron 8 Comment out the local delivery agent 302 1.1 tron </pre> 303 1.1 tron </blockquote> 304 1.1 tron 305 1.1 tron <p> Translation: </p> 306 1.1 tron 307 1.1 tron <ul> 308 1.1 tron 309 1.1 tron <li> <p> Line 2: Send mail from this machine as "user (a] example.com", 310 1.1 tron so that no reason exists to send mail to "user (a] firewall.example.com". 311 1.1 tron </p> 312 1.1 tron 313 1.1 tron <li> <p> Lines 3-8: Disable local mail delivery on the firewall 314 1.1 tron machine. </p> 315 1.1 tron 316 1.1 tron </ul> 317 1.1 tron 318 1.1 tron <p> For the sake of technical correctness the firewall must be able 319 1.1 tron to receive mail for postmaster@[firewall ip address]. Reportedly, 320 1.1 tron some things actually expect this ability to exist. The second part 321 1.1 tron of the solution therefore adds support for postmaster@[firewall ip 322 1.1 tron address], and as a bonus we do abuse@[firewall ip address] as well. 323 1.1 tron All the mail to these two accounts is forwarded to an inside address. 324 1.1 tron </p> 325 1.1 tron 326 1.1 tron <blockquote> 327 1.1 tron <pre> 328 1.1 tron 1 /etc/postfix/main.cf: 329 1.1.1.8 christos 2 virtual_alias_maps = lmdb:/etc/postfix/virtual 330 1.1 tron 3 331 1.1 tron 4 /etc/postfix/virtual: 332 1.1 tron 5 postmaster postmaster (a] example.com 333 1.1 tron 6 abuse abuse (a] example.com 334 1.1 tron </pre> 335 1.1 tron </blockquote> 336 1.1 tron 337 1.1 tron <p> Translation: </p> 338 1.1 tron 339 1.1 tron <ul> 340 1.1 tron 341 1.1 tron <li> <p> Because mydestination is empty (see the previous example), 342 1.1 tron only address literals matching $inet_interfaces or $proxy_interfaces 343 1.1 tron are deemed local. So "localpart@[a.d.d.r]" can be matched as simply 344 1.1 tron "localpart" in canonical(5) and virtual(5). This avoids the need to 345 1.1.1.5 christos specify firewall IP addresses in Postfix configuration files. </p> 346 1.1 tron 347 1.1 tron </ul> 348 1.1 tron 349 1.1 tron <p> The last part of the solution does the email forwarding, which 350 1.1 tron is the real purpose of the firewall email function. </p> 351 1.1 tron 352 1.1 tron <blockquote> 353 1.1 tron <pre> 354 1.1 tron 1 /etc/postfix/main.cf: 355 1.1 tron 2 mynetworks = 127.0.0.0/8 12.34.56.0/24 356 1.1 tron 3 relay_domains = example.com 357 1.1 tron 4 parent_domain_matches_subdomains = 358 1.1 tron 5 debug_peer_list smtpd_access_maps 359 1.1.1.4 tron <br> 360 1.1.1.4 tron 6a # Postfix 2.10 and later support separate relay control and 361 1.1.1.4 tron 7a # spam control. 362 1.1.1.4 tron 8a smtpd_relay_restrictions = 363 1.1.1.4 tron 9a permit_mynetworks reject_unauth_destination 364 1.1.1.4 tron 10a smtpd_recipient_restrictions = ...spam blocking rules.... 365 1.1.1.4 tron <br> 366 1.1.1.4 tron 6b # Older configurations combine relay control and spam control. To 367 1.1.1.4 tron 7b # use this with Postfix ≥ 2.10 specify "smtpd_relay_restrictions=". 368 1.1.1.4 tron 8b smtpd_recipient_restrictions = 369 1.1.1.4 tron 9b permit_mynetworks reject_unauth_destination 370 1.1.1.4 tron 10b ...spam blocking rules.... 371 1.1.1.4 tron <br> 372 1.1.1.8 christos 11 relay_recipient_maps = lmdb:/etc/postfix/relay_recipients 373 1.1.1.8 christos 12 transport_maps = lmdb:/etc/postfix/transport 374 1.1.1.4 tron 13 375 1.1.1.4 tron 14 /etc/postfix/relay_recipients: 376 1.1.1.4 tron 15 user1 (a] example.com x 377 1.1.1.4 tron 16 user2 (a] example.com x 378 1.1.1.4 tron 17 . . . 379 1.1.1.4 tron 18 380 1.1.1.4 tron 19 /etc/postfix/transport: 381 1.1.1.6 christos 20 example.com relay:[inside-gateway.example.com] 382 1.1 tron </pre> 383 1.1 tron </blockquote> 384 1.1 tron 385 1.1 tron <p> Translation: </p> 386 1.1 tron 387 1.1 tron <ul> 388 1.1.1.4 tron 389 1.1.1.4 tron <li><p> Lines 1-10: Accept mail from local systems in $mynetworks, 390 1.1 tron and accept mail from outside for "user (a] example.com" but not for 391 1.1 tron "user (a] anything.example.com". The magic is in lines 4-5. </p> 392 1.1 tron 393 1.1.1.4 tron <li> <p> Lines 11, 13-16: Define the list of valid addresses in the 394 1.1 tron "example.com" domain that can receive mail from the Internet. This 395 1.1 tron prevents the mail queue from filling up with undeliverable 396 1.1 tron MAILER-DAEMON messages. If you can't maintain a list of valid 397 1.1 tron recipients then you must specify "relay_recipient_maps =" (that 398 1.1 tron is, an empty value), or you must specify an "@example.com x" 399 1.1 tron wild-card in the relay_recipients table. </p> 400 1.1 tron 401 1.1.1.4 tron <li> <p> Lines 12, 19-20: Route mail for "example.com" to the inside 402 1.1 tron gateway machine. The <tt>[]</tt> forces Postfix to do no MX lookup. 403 1.1.1.6 christos This uses the "relay" delivery transport (a copy of the default 404 1.1.1.6 christos "smtp" delivery transport) to forward inbound mail. This can improve 405 1.1.1.6 christos performance of deliveries to internal domains because they will 406 1.1.1.6 christos compete for SMTP clients from the "relay" delivery transport, instead 407 1.1.1.6 christos of competing with other SMTP deliveries for SMTP clients from the 408 1.1.1.6 christos default "smtp" delivery transport. </p> 409 1.1 tron 410 1.1 tron </ul> 411 1.1 tron 412 1.1.1.8 christos <p> Instead of lmdb:, some systems use cdb:, hash:, or dbm:. </p> 413 1.1.1.8 christos 414 1.1.1.8 christos <p> Execute the command "<b>postmap /etc/postfix/virtual</b>" 415 1.1.1.8 christos whenever you change the virtual file, to (re)build a default-type 416 1.1.1.8 christos indexed file. Execute "<b>postmap <i>type</i>:/etc/postfix/virtual</b>" 417 1.1.1.8 christos to specify an explicit type. </p> 418 1.1.1.8 christos 419 1.1.1.8 christos <p> The default indexed file type is configured with the 420 1.1.1.8 christos default_database_type parameter. To list available explicit types, 421 1.1.1.8 christos execute the command "<b>postconf -m</b>".</p> 422 1.1 tron 423 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/relay_recipients</b>" 424 1.1.1.8 christos whenever you change the relay_recipients file, to (re)build a 425 1.1.1.8 christos default-type indexed file. Execute "<b>postmap 426 1.1.1.8 christos <i>type</i>:/etc/postfix/relay_recipients</b>" to specify an explicit 427 1.1.1.8 christos type.</p> 428 1.1 tron 429 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/transport</b>" 430 1.1.1.8 christos whenever you change the transport file, to (re)build a default-type 431 1.1.1.8 christos indexed file. Execute "<b>postmap <i>type</i>:/etc/postfix/transport</b>" 432 1.1.1.8 christos to specify an explicit type. </p> 433 1.1 tron 434 1.1 tron <p> In some installations, there may be separate instances of Postfix 435 1.1 tron processing inbound and outbound mail on a multi-homed firewall. The 436 1.1 tron inbound Postfix instance has an SMTP server listening on the external 437 1.1 tron firewall interface, and the outbound Postfix instance has an SMTP server 438 1.1.1.7 christos listening on the internal interface. In such a configuration it is 439 1.1 tron tempting to configure $inet_interfaces in each instance with just the 440 1.1 tron corresponding interface address. </p> 441 1.1 tron 442 1.1 tron <p> In most cases, using inet_interfaces in this way will not work, 443 1.1 tron because as documented in the $inet_interfaces reference manual, the 444 1.1 tron smtp(8) delivery agent will also use the specified interface address 445 1.1 tron as the source address for outbound connections and will be unable to 446 1.1 tron reach hosts on "the other side" of the firewall. The symptoms are that 447 1.1 tron the firewall is unable to connect to hosts that are in fact up. See the 448 1.1 tron inet_interfaces parameter documentation for suggested work-arounds.</p> 449 1.1 tron 450 1.1 tron <h2><a name="some_local">Delivering some but not all accounts 451 1.1 tron locally</a></h2> 452 1.1 tron 453 1.1 tron <p> A drawback of sending mail as "user (a] example.com" (instead of 454 1.1 tron "user (a] hostname.example.com") is that mail for "root" and other 455 1.1 tron system accounts is also sent to the central mailhost. In order to 456 1.1 tron deliver such accounts locally, you can set up virtual aliases as 457 1.1 tron follows: </p> 458 1.1 tron 459 1.1 tron <blockquote> 460 1.1 tron <pre> 461 1.1 tron 1 /etc/postfix/main.cf: 462 1.1.1.8 christos 2 virtual_alias_maps = lmdb:/etc/postfix/virtual 463 1.1 tron 3 464 1.1 tron 4 /etc/postfix/virtual: 465 1.1 tron 5 root root@localhost 466 1.1 tron 6 . . . 467 1.1 tron </pre> 468 1.1 tron </blockquote> 469 1.1 tron 470 1.1 tron <p> Translation: </p> 471 1.1 tron 472 1.1 tron <ul> 473 1.1 tron 474 1.1 tron <li> <p> Line 5: As described in the virtual(5) manual page, the 475 1.1 tron bare name "root" matches "root@site" when "site" is equal to 476 1.1 tron $myorigin, when "site" is listed in $mydestination, or when it 477 1.1 tron matches $inet_interfaces or $proxy_interfaces. </p> 478 1.1 tron 479 1.1 tron </ul> 480 1.1 tron 481 1.1.1.8 christos <p> Instead of lmdb:, some systems use cdb:, hash:, or dbm:. </p> 482 1.1.1.8 christos 483 1.1.1.2 tron <p> Execute the command "<b>postmap /etc/postfix/virtual</b>" after 484 1.1.1.8 christos editing the virtual file, to (re)build a default-type indexed file. 485 1.1.1.8 christos Execute "<b>postmap <i>type</i>:/etc/postfix/virtual</b>" to specify 486 1.1.1.8 christos an explicit type. </p> 487 1.1.1.8 christos 488 1.1.1.8 christos <p> The default indexed file type is configured with the 489 1.1.1.8 christos default_database_type parameter. To list available explicit types, 490 1.1.1.8 christos execute the command "<b>postconf -m</b>".</p> 491 1.1.1.2 tron 492 1.1 tron <h2><a name="intranet">Running Postfix behind a firewall</a></h2> 493 1.1 tron 494 1.1 tron <p> The simplest way to set up Postfix on a host behind a firewalled 495 1.1 tron network is to send all mail to a gateway host, and to let that mail 496 1.1 tron host take care of internal and external forwarding. Examples of that 497 1.1 tron are shown in the <a href="#local_network">local area network</a> 498 1.1 tron section above. A more sophisticated approach is to send only external 499 1.1.1.3 tron mail to the gateway host, and to send intranet mail directly. </p> 500 1.1 tron 501 1.1 tron <p> Note: this example requires Postfix version 2.0 and later. To find 502 1.1 tron out what Postfix version you have, execute the command "<b>postconf 503 1.1 tron mail_version</b>". </p> 504 1.1 tron 505 1.1 tron <p> The following example presents additional configuration. You 506 1.1 tron need to combine this with basic configuration information as 507 1.1.1.5 christos discussed in the first half of this document. </p> 508 1.1 tron 509 1.1 tron <blockquote> 510 1.1 tron <pre> 511 1.1 tron 1 /etc/postfix/main.cf: 512 1.1.1.8 christos 2 transport_maps = lmdb:/etc/postfix/transport 513 1.1 tron 3 relayhost = 514 1.1 tron 4 # Optional for a machine that isn't "always on" 515 1.1 tron 5 #fallback_relay = [gateway.example.com] 516 1.1 tron 6 517 1.1 tron 7 /etc/postfix/transport: 518 1.1 tron 8 # Internal delivery. 519 1.1 tron 9 example.com : 520 1.1 tron 10 .example.com : 521 1.1 tron 11 # External delivery. 522 1.1 tron 12 * smtp:[gateway.example.com] 523 1.1 tron </pre> 524 1.1 tron </blockquote> 525 1.1 tron 526 1.1 tron <p> Translation: </p> 527 1.1 tron 528 1.1 tron <ul> 529 1.1 tron 530 1.1 tron <li> <p> Lines 2, 7-12: Request that intranet mail is delivered 531 1.1 tron directly, and that external mail is given to a gateway. Obviously, 532 1.1 tron this example assumes that the organization uses DNS MX records 533 1.1 tron internally. The <tt>[]</tt> forces Postfix to do no MX lookup. 534 1.1 tron </p> 535 1.1 tron 536 1.1 tron <li> <p> Line 3: IMPORTANT: do not specify a relayhost in main.cf. 537 1.1 tron </p> 538 1.1 tron 539 1.1 tron <li> <p> Line 5: This prevents mail from being stuck in the queue 540 1.1 tron when the machine is turned off. Postfix tries to deliver mail 541 1.1 tron directly, and gives undeliverable mail to a gateway. </p> 542 1.1 tron 543 1.1 tron </ul> 544 1.1 tron 545 1.1.1.8 christos <p> Instead of lmdb:, some systems use cdb:, hash:, or dbm:. </p> 546 1.1.1.8 christos 547 1.1.1.8 christos <p> Execute the command "<b>postmap /etc/postfix/transport</b>" 548 1.1.1.8 christos whenever you edit the transport file, to (re)build a default-type 549 1.1.1.8 christos indexed file. Execute "<b>postmap <i>type</i>:/etc/postfix/transport</b>" 550 1.1.1.8 christos to specify an explicit type. </p> 551 1.1.1.8 christos 552 1.1.1.8 christos <p> The default indexed file type is configured with the 553 1.1.1.8 christos default_database_type parameter. To list available explicit types, 554 1.1.1.8 christos execute the command "<b>postconf -m</b>".</p> 555 1.1 tron 556 1.1 tron 557 1.1 tron <h2><a name="backup">Configuring Postfix as primary or backup MX host for a remote site</a></h2> 558 1.1 tron 559 1.1 tron <p> This section presents additional configuration. You need to 560 1.1.1.5 christos combine this with basic configuration information as discussed in the 561 1.1 tron first half of this document. </p> 562 1.1 tron 563 1.1 tron <p> When your system is SECONDARY MX host for a remote site this 564 1.1 tron is all you need: </p> 565 1.1 tron 566 1.1 tron <blockquote> 567 1.1 tron <pre> 568 1.1 tron 1 DNS: 569 1.1 tron 2 the.backed-up.domain.tld IN MX 100 your.machine.tld. 570 1.1 tron 3 571 1.1 tron 4 /etc/postfix/main.cf: 572 1.1 tron 5 relay_domains = . . . the.backed-up.domain.tld 573 1.1.1.4 tron <br> 574 1.1.1.4 tron 6a # Postfix 2.10 and later support separate relay control and 575 1.1.1.4 tron 7a # spam control. 576 1.1.1.4 tron 8a smtpd_relay_restrictions = 577 1.1.1.4 tron 9a permit_mynetworks reject_unauth_destination 578 1.1.1.4 tron 10a smtpd_recipient_restrictions = ...spam blocking rules.... 579 1.1.1.4 tron <br> 580 1.1.1.4 tron 6b # Older configurations combine relay control and spam control. To 581 1.1.1.4 tron 7b # use this with Postfix ≥ 2.10 specify "smtpd_relay_restrictions=". 582 1.1.1.4 tron 8b smtpd_recipient_restrictions = 583 1.1.1.4 tron 9b permit_mynetworks reject_unauth_destination 584 1.1.1.4 tron 10b ...spam blocking rules.... 585 1.1.1.4 tron <br> 586 1.1.1.4 tron 11 # You must specify your NAT/proxy external address. 587 1.1.1.4 tron 12 #proxy_interfaces = 1.2.3.4 588 1.1 tron 13 589 1.1.1.8 christos 14 relay_recipient_maps = lmdb:/etc/postfix/relay_recipients 590 1.1.1.4 tron 15 591 1.1.1.4 tron 16 /etc/postfix/relay_recipients: 592 1.1.1.4 tron 17 user1 (a] the.backed-up.domain.tld x 593 1.1.1.4 tron 18 user2 (a] the.backed-up.domain.tld x 594 1.1.1.4 tron 19 . . . 595 1.1 tron </pre> 596 1.1 tron </blockquote> 597 1.1 tron 598 1.1 tron <p> When your system is PRIMARY MX host for a remote site you 599 1.1 tron need the above, plus: </p> 600 1.1 tron 601 1.1 tron <blockquote> 602 1.1 tron <pre> 603 1.1.1.4 tron 20 /etc/postfix/main.cf: 604 1.1.1.8 christos 21 transport_maps = lmdb:/etc/postfix/transport 605 1.1.1.4 tron 22 606 1.1.1.4 tron 23 /etc/postfix/transport: 607 1.1.1.4 tron 24 the.backed-up.domain.tld relay:[their.mail.host.tld] 608 1.1 tron </pre> 609 1.1 tron </blockquote> 610 1.1 tron 611 1.1 tron <p> Important notes: 612 1.1 tron 613 1.1 tron <ul> 614 1.1 tron 615 1.1 tron <li><p>Do not list the.backed-up.domain.tld in mydestination.</p> 616 1.1 tron 617 1.1 tron <li><p>Do not list the.backed-up.domain.tld in virtual_alias_domains.</p> 618 1.1 tron 619 1.1 tron <li><p>Do not list the.backed-up.domain.tld in virtual_mailbox_domains.</p> 620 1.1 tron 621 1.1.1.4 tron <li> <p> Lines 1-9: Forward mail from the Internet for 622 1.1 tron "the.backed-up.domain.tld" to the primary MX host for that domain. 623 1.1 tron </p> 624 1.1 tron 625 1.1.1.4 tron <li> <p> Line 12: This is a must if Postfix receives mail via a 626 1.1 tron NAT relay or proxy that presents a different IP address to the 627 1.1 tron world than the local machine. </p> 628 1.1 tron 629 1.1.1.4 tron <li> <p> Lines 14-18: Define the list of valid addresses in the 630 1.1 tron "the.backed-up.domain.tld" domain. This prevents your mail queue 631 1.1 tron from filling up with undeliverable MAILER-DAEMON messages. If you 632 1.1 tron can't maintain a list of valid recipients then you must specify 633 1.1 tron "relay_recipient_maps =" (that is, an empty value), or you must 634 1.1 tron specify an "@the.backed-up.domain.tld x" wild-card in the 635 1.1 tron relay_recipients table. </p> 636 1.1 tron 637 1.1.1.4 tron <li> <p> Line 24: The <tt>[]</tt> forces Postfix to do no MX lookup. </p> 638 1.1 tron 639 1.1 tron </ul> 640 1.1 tron 641 1.1.1.8 christos <p> Instead of lmdb:, some systems use cdb:, hash:, or dbm:. </p> 642 1.1.1.8 christos 643 1.1.1.8 christos <p> Execute the command "<b>postmap /etc/postfix/relay_recipients</b>" 644 1.1.1.8 christos whenever you change the relay_recipients file, to (re)build a 645 1.1.1.8 christos default-type indexed file. Execute "<b>postmap 646 1.1.1.8 christos <i>type</i>:/etc/postfix/relay_recipients</b>" to specify an explicit 647 1.1.1.8 christos type. </p> 648 1.1.1.8 christos 649 1.1.1.8 christos <p> The default indexed file type is configured with the 650 1.1.1.8 christos default_database_type parameter. To list available explicit types, 651 1.1.1.8 christos execute the command "<b>postconf -m</b>".</p> 652 1.1 tron 653 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/transport</b>" 654 1.1.1.8 christos whenever you change the transport file, to (re)build a default-type 655 1.1.1.8 christos indexed file. Execute "<b>postmap <i>type</i>:/etc/postfix/transport</b>" 656 1.1.1.8 christos to specify an explicit type. </p> 657 1.1 tron 658 1.1 tron <p> NOTE for Postfix < 2.2: Do not use the fallback_relay feature 659 1.1 tron when relaying mail 660 1.1 tron for a backup or primary MX domain. Mail would loop between the 661 1.1 tron Postfix MX host and the fallback_relay host when the final destination 662 1.1 tron is unavailable. </p> 663 1.1 tron 664 1.1 tron <ul> 665 1.1 tron 666 1.1 tron <li> In main.cf specify "<tt>relay_transport = relay</tt>", 667 1.1 tron 668 1.1 tron <li> In master.cf specify "<tt>-o fallback_relay =</tt>" at the 669 1.1 tron end of the <tt>relay</tt> entry. 670 1.1 tron 671 1.1 tron <li> In transport maps, specify "<tt>relay:<i>nexthop...</i></tt>" 672 1.1 tron as the right-hand side for backup or primary MX domain entries. 673 1.1 tron 674 1.1 tron </ul> 675 1.1 tron 676 1.1 tron <p> These are default settings in Postfix version 2.2 and later. 677 1.1 tron </p> 678 1.1 tron 679 1.1 tron <h2><a name="dialup">Postfix on a dialup machine</a></h2> 680 1.1 tron 681 1.1 tron <p> This section applies to dialup connections that are down most 682 1.1 tron of the time. For dialup connections that are up 24x7, see the <a 683 1.1 tron href="#local_network">local area network</a> section above. </p> 684 1.1 tron 685 1.1 tron <p> This section presents additional configuration. You need to 686 1.1.1.5 christos combine this with basic configuration information as discussed in the 687 1.1 tron first half of this document. </p> 688 1.1 tron 689 1.1 tron <p> If you do not have your own hostname and IP address (usually 690 1.1 tron with dialup, cable TV or DSL connections) then you should also 691 1.1 tron study the section on "<a href="#fantasy">Postfix on hosts without 692 1.1 tron a real Internet hostname</a>". </p> 693 1.1 tron 694 1.1 tron <ul> 695 1.1 tron 696 1.1 tron <li> Route all outgoing mail to your network provider. 697 1.1 tron 698 1.1 tron <p> If your machine is disconnected most of the time, there isn't 699 1.1 tron a lot of opportunity for Postfix to deliver mail to hard-to-reach 700 1.1 tron corners of the Internet. It's better to give the mail to a machine 701 1.1 tron that is connected all the time. In the example below, the <tt>[]</tt> 702 1.1 tron prevents Postfix from trying to look up DNS MX records. </p> 703 1.1 tron 704 1.1 tron <pre> 705 1.1 tron /etc/postfix/main.cf: 706 1.1 tron relayhost = [smtprelay.someprovider.com] 707 1.1 tron </pre> 708 1.1 tron 709 1.1 tron <li> <p><a name="spontaneous_smtp">Disable spontaneous SMTP mail 710 1.1 tron delivery (if using on-demand dialup IP only).</a> </p> 711 1.1 tron 712 1.1 tron <p> Normally, Postfix attempts to deliver outbound mail at its convenience. 713 1.1 tron If your machine uses on-demand dialup IP, this causes your system 714 1.1 tron to place a telephone call whenever you submit new mail, and whenever 715 1.1 tron Postfix retries to deliver delayed mail. To prevent such telephone 716 1.1 tron calls from being placed, disable spontaneous SMTP mail deliveries. </p> 717 1.1 tron 718 1.1 tron <pre> 719 1.1 tron /etc/postfix/main.cf: 720 1.1 tron defer_transports = smtp (Only for on-demand dialup IP hosts) 721 1.1 tron </pre> 722 1.1 tron 723 1.1 tron <li> <p>Disable SMTP client DNS lookups (dialup LAN only).</p> 724 1.1 tron 725 1.1 tron <pre> 726 1.1 tron /etc/postfix/main.cf: 727 1.1 tron disable_dns_lookups = yes (Only for on-demand dialup IP hosts) 728 1.1 tron </pre> 729 1.1 tron 730 1.1 tron <li> Flush the mail queue whenever the Internet link is established. 731 1.1 tron 732 1.1 tron <p> Put the following command into your PPP or SLIP dialup scripts: </p> 733 1.1 tron 734 1.1 tron <pre> 735 1.1 tron /usr/sbin/sendmail -q (whenever the Internet link is up) 736 1.1 tron </pre> 737 1.1 tron 738 1.1 tron <p> The exact location of the Postfix sendmail command is system-specific. 739 1.1 tron Use the command "<b>postconf sendmail_path</b>" to find out where the 740 1.1 tron Postfix sendmail command is located on your machine. </p> 741 1.1 tron 742 1.1 tron <p> In order to find out if the mail queue is flushed, use something 743 1.1 tron like: </p> 744 1.1 tron 745 1.1 tron <pre> 746 1.1 tron #!/bin/sh 747 1.1 tron 748 1.1 tron # Start mail deliveries. 749 1.1 tron /usr/sbin/sendmail -q 750 1.1 tron 751 1.1 tron # Allow deliveries to start. 752 1.1 tron sleep 10 753 1.1 tron 754 1.1 tron # Loop until all messages have been tried at least once. 755 1.1 tron while mailq | grep '^[^ ]*\*' >/dev/null 756 1.1 tron do 757 1.1 tron sleep 10 758 1.1 tron done 759 1.1 tron </pre> 760 1.1 tron 761 1.1 tron <p> If you have disabled <a href="#spontaneous_smtp">spontaneous 762 1.1 tron SMTP mail delivery</a>, you also need to run the "<b>sendmail -q</b>" 763 1.1 tron command every now and then while the dialup link is up, so that 764 1.1 tron newly-posted mail is flushed from the queue. </p> 765 1.1 tron 766 1.1 tron </ul> 767 1.1 tron 768 1.1 tron <h2><a name="fantasy">Postfix on hosts without a real Internet 769 1.1 tron hostname</a></h2> 770 1.1 tron 771 1.1 tron <p> This section is for hosts that don't have their own Internet 772 1.1 tron hostname. Typically these are systems that get a dynamic IP address 773 1.1 tron via DHCP or via dialup. Postfix will let you send and receive mail 774 1.1 tron just fine between accounts on a machine with a fantasy name. However, 775 1.1 tron you cannot use a fantasy hostname in your email address when sending 776 1.1 tron mail into the Internet, because no-one would be able to reply to 777 1.1 tron your mail. In fact, more and more sites refuse mail addresses with 778 1.1 tron non-existent domain names. </p> 779 1.1 tron 780 1.1 tron <p> Note: the following information is Postfix version dependent. 781 1.1 tron To find out what Postfix version you have, execute the command 782 1.1 tron "<b>postconf mail_version</b>". </p> 783 1.1 tron 784 1.1 tron <h3>Solution 1: Postfix version 2.2 and later </h3> 785 1.1 tron 786 1.1 tron <p> Postfix 2.2 uses the generic(5) address mapping to replace 787 1.1 tron local fantasy email addresses by valid Internet addresses. This 788 1.1 tron mapping happens ONLY when mail leaves the machine; not when you 789 1.1 tron send mail between users on the same machine. </p> 790 1.1 tron 791 1.1 tron <p> The following example presents additional configuration. You 792 1.1 tron need to combine this with basic configuration information as 793 1.1.1.5 christos discussed in the first half of this document. </p> 794 1.1 tron 795 1.1 tron <blockquote> 796 1.1 tron <pre> 797 1.1 tron 1 /etc/postfix/main.cf: 798 1.1.1.8 christos 2 smtp_generic_maps = lmdb:/etc/postfix/generic 799 1.1 tron 3 800 1.1 tron 4 /etc/postfix/generic: 801 1.1 tron 5 his (a] localdomain.local hisaccount (a] hisisp.example 802 1.1 tron 6 her (a] localdomain.local heraccount (a] herisp.example 803 1.1 tron 7 @localdomain.local hisaccount+local (a] hisisp.example 804 1.1 tron </pre> 805 1.1 tron </blockquote> 806 1.1 tron 807 1.1 tron <p> When mail is sent to a remote host via SMTP: </p> 808 1.1 tron 809 1.1 tron <ul> 810 1.1 tron 811 1.1 tron <li> <p> Line 5 replaces <i>his (a] localdomain.local</i> by his ISP 812 1.1 tron mail address, </p> 813 1.1 tron 814 1.1 tron <li> <p> Line 6 replaces <i>her (a] localdomain.local</i> by her ISP 815 1.1 tron mail address, and </p> 816 1.1 tron 817 1.1 tron <li> <p> Line 7 replaces other local addresses by his ISP account, 818 1.1 tron with an address extension of +<i>local</i> (this example assumes 819 1.1 tron that the ISP supports "+" style address extensions). </p> 820 1.1 tron 821 1.1 tron </ul> 822 1.1 tron 823 1.1.1.8 christos <p> Instead of lmdb:, some systems use cdb:, hash:, or dbm:. </p> 824 1.1 tron 825 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/generic</b>" 826 1.1.1.8 christos whenever you change the generic file, to (re)build a default-type 827 1.1.1.8 christos indexed file. Execute "<b>postmap <i>type</i>:/etc/postfix/generic</b>" 828 1.1.1.8 christos to specify an explicit type.</p> 829 1.1.1.8 christos 830 1.1.1.8 christos <p> The default indexed file type is configured with the 831 1.1.1.8 christos default_database_type parameter. To list available explicit types, 832 1.1.1.8 christos execute the command "<b>postconf -m</b>".</p> 833 1.1 tron 834 1.1 tron <h3>Solution 2: Postfix version 2.1 and earlier </h3> 835 1.1 tron 836 1.1 tron <p> The solution with older Postfix systems is to use valid 837 1.1 tron Internet addresses where possible, and to let Postfix map valid 838 1.1 tron Internet addresses to local fantasy addresses. With this, you can 839 1.1 tron send mail to the Internet and to local fantasy addresses, including 840 1.1 tron mail to local fantasy addresses that don't have a valid Internet 841 1.1 tron address of their own.</p> 842 1.1 tron 843 1.1 tron <p> The following example presents additional configuration. You 844 1.1 tron need to combine this with basic configuration information as 845 1.1.1.5 christos discussed in the first half of this document. </p> 846 1.1 tron 847 1.1 tron <blockquote> 848 1.1 tron <pre> 849 1.1 tron 1 /etc/postfix/main.cf: 850 1.1 tron 2 myhostname = hostname.localdomain 851 1.1 tron 3 mydomain = localdomain 852 1.1 tron 4 853 1.1.1.8 christos 5 canonical_maps = lmdb:/etc/postfix/canonical 854 1.1 tron 6 855 1.1.1.8 christos 7 virtual_alias_maps = lmdb:/etc/postfix/virtual 856 1.1 tron 8 857 1.1 tron 9 /etc/postfix/canonical: 858 1.1 tron 10 your-login-name your-account (a] your-isp.com 859 1.1 tron 11 860 1.1 tron 12 /etc/postfix/virtual: 861 1.1 tron 13 your-account (a] your-isp.com your-login-name 862 1.1 tron </pre> 863 1.1 tron </blockquote> 864 1.1 tron 865 1.1 tron <p> Translation: </p> 866 1.1 tron 867 1.1 tron <ul> 868 1.1 tron 869 1.1 tron <li> <p> Lines 2-3: Substitute your fantasy hostname here. Do not 870 1.1 tron use a domain name that is already in use by real organizations 871 1.1 tron on the Internet. See RFC 2606 for examples of domain 872 1.1 tron names that are guaranteed not to be owned by anyone. </p> 873 1.1 tron 874 1.1 tron <li> <p> Lines 5, 9, 10: This provides the mapping from 875 1.1 tron "your-login-name (a] hostname.localdomain" to "your-account (a] your-isp.com". 876 1.1 tron This part is required. </p> 877 1.1 tron 878 1.1 tron <li> <p> Lines 7, 12, 13: Deliver mail for "your-account (a] your-isp.com" 879 1.1 tron locally, instead of sending it to the ISP. This part is not required 880 1.1 tron but is convenient. 881 1.1 tron 882 1.1 tron </ul> 883 1.1 tron 884 1.1.1.8 christos <p> Instead of lmdb:, some systems use cdb:, hash:, or dbm:. </p> 885 1.1 tron 886 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/canonical</b>" 887 1.1.1.8 christos whenever you change the canonical file, to (re)build a default-type 888 1.1.1.8 christos indexed file. Execute "<b>postmap <i>type</i>:/etc/postfix/canonical</b>" 889 1.1.1.8 christos to specify an explicit type. </p> 890 1.1.1.8 christos 891 1.1.1.8 christos <p> The default indexed file type is configured with the 892 1.1.1.8 christos default_database_type parameter. To list available explicit types, 893 1.1.1.8 christos execute the command "<b>postconf -m</b>".</p> 894 1.1 tron 895 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/virtual</b>" 896 1.1.1.8 christos whenever you change the virtual file, to (re)build a default-type 897 1.1.1.8 christos indexed file. Execute "<b>postmap <i>type</i>:/etc/postfix/virtual</b>" 898 1.1.1.8 christos to specify an explicit type. </p> 899 1.1 tron 900 1.1 tron </body> 901 1.1 tron 902 1.1 tron </html> 903
Indexes created Fri Jun 26 00:24:39 UTC 2026