STANDARD_CONFIGURATION_README.html revision 1.1.1.2
1 1.1 tron <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 1.1 tron "http://www.w3.org/TR/html4/loose.dtd"> 3 1.1 tron 4 1.1 tron <html> 5 1.1 tron 6 1.1 tron <head> 7 1.1 tron 8 1.1 tron <title>Postfix Standard Configuration Examples</title> 9 1.1 tron 10 1.1 tron <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> 11 1.1 tron 12 1.1 tron </head> 13 1.1 tron 14 1.1 tron <body> 15 1.1 tron 16 1.1 tron <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Standard Configuration Examples</h1> 17 1.1 tron 18 1.1 tron <hr> 19 1.1 tron 20 1.1 tron <h2>Purpose of this document</h2> 21 1.1 tron 22 1.1 tron <p> This document presents a number of typical Postfix configurations. 23 1.1 tron This document should be reviewed after you have followed the basic 24 1.1 tron configuration steps as described in the BASIC_CONFIGURATION_README 25 1.1 tron document. In particular, do not proceed here if you don't already 26 1.1 tron have Postfix working for local mail submission and for local mail 27 1.1 tron delivery. </p> 28 1.1 tron 29 1.1 tron <p> The first part of this document presents standard configurations 30 1.1 tron that each solve one specific problem. </p> 31 1.1 tron 32 1.1 tron <ul> 33 1.1 tron 34 1.1 tron <li><a href="#stand_alone">Postfix on a stand-alone Internet host</a> 35 1.1 tron 36 1.1 tron <li><a href="#null_client">Postfix on a null client</a> 37 1.1 tron 38 1.1 tron <li><a href="#local_network">Postfix on a local network</a> 39 1.1 tron 40 1.1 tron <li><a href="#firewall">Postfix email firewall/gateway</a> 41 1.1 tron 42 1.1 tron </ul> 43 1.1 tron 44 1.1 tron <p> The second part of this document presents additional configurations 45 1.1 tron for hosts in specific environments. </p> 46 1.1 tron 47 1.1 tron <ul> 48 1.1 tron 49 1.1 tron <li><a href="#some_local">Delivering some but not all accounts locally</a> 50 1.1 tron 51 1.1 tron <li><a href="#intranet">Running Postfix behind a firewall</a> 52 1.1 tron 53 1.1 tron <li><a href="#backup">Configuring Postfix as primary or backup MX host for a remote 54 1.1 tron site</a> 55 1.1 tron 56 1.1 tron <li><a href="#dialup">Postfix on a dialup machine</a> 57 1.1 tron 58 1.1 tron <li><a href="#fantasy">Postfix on hosts without a real 59 1.1 tron Internet hostname</a> 60 1.1 tron 61 1.1 tron </ul> 62 1.1 tron 63 1.1 tron <h2><a name="stand_alone">Postfix on a stand-alone Internet host</a></h2> 64 1.1 tron 65 1.1 tron <p> Postfix should work out of the box without change on a stand-alone 66 1.1 tron machine that has direct Internet access. At least, that is how 67 1.1 tron Postfix installs when you download the Postfix source code via 68 1.1 tron http://www.postfix.org/. </p> 69 1.1 tron 70 1.1 tron <p> You can use the command "<b>postconf -n</b>" to find out what 71 1.1 tron settings are overruled by your main.cf. Besides a few pathname 72 1.1 tron settings, few parameters should be set on a stand-alone box, beyond 73 1.1 tron what is covered in the BASIC_CONFIGURATION_README document: </p> 74 1.1 tron 75 1.1 tron <blockquote> 76 1.1 tron <pre> 77 1.1 tron /etc/postfix/main.cf: 78 1.1 tron # Optional: send mail as user@domainname instead of user@hostname. 79 1.1 tron #myorigin = $mydomain 80 1.1 tron 81 1.1 tron # Optional: specify NAT/proxy external address. 82 1.1 tron #proxy_interfaces = 1.2.3.4 83 1.1 tron 84 1.1 tron # Alternative 1: don't relay mail from other hosts. 85 1.1 tron mynetworks_style = host 86 1.1 tron relay_domains = 87 1.1 tron 88 1.1 tron # Alternative 2: relay mail from local clients only. 89 1.1 tron # mynetworks = 192.168.1.0/28 90 1.1 tron # relay_domains = 91 1.1 tron </pre> 92 1.1 tron </blockquote> 93 1.1 tron 94 1.1 tron <p> See also the section "<a href="#fantasy">Postfix on hosts without 95 1.1 tron a real Internet hostname</a>" if this is applicable to your configuration. 96 1.1 tron </p> 97 1.1 tron 98 1.1 tron <h2><a name="null_client">Postfix on a null client</a></h2> 99 1.1 tron 100 1.1 tron <p> A null client is a machine that can only send mail. It receives no 101 1.1 tron mail from the network, and it does not deliver any mail locally. A 102 1.1 tron null client typically uses POP, IMAP or NFS for mailbox access. </p> 103 1.1 tron 104 1.1 tron <p> In this example we assume that the Internet domain name is 105 1.1 tron "example.com" and that the machine is named "nullclient.example.com". 106 1.1 tron As usual, the examples show only parameters that are not left at 107 1.1 tron their default settings. </p> 108 1.1 tron 109 1.1 tron <blockquote> 110 1.1 tron <pre> 111 1.1 tron 1 /etc/postfix/main.cf: 112 1.1 tron 2 myorigin = $mydomain 113 1.1 tron 3 relayhost = $mydomain 114 1.1 tron 4 inet_interfaces = loopback-only 115 1.1 tron 5 local_transport = error:local delivery is disabled 116 1.1 tron 6 117 1.1 tron 7 /etc/postfix/master.cf: 118 1.1 tron 8 Comment out the local delivery agent entry 119 1.1 tron </pre> 120 1.1 tron </blockquote> 121 1.1 tron 122 1.1 tron <p> Translation: </p> 123 1.1 tron 124 1.1 tron <ul> 125 1.1 tron 126 1.1 tron <li> <p> Line 2: Send mail as "user (a] example.com" (instead of 127 1.1 tron "user (a] nullclient.example.com"), so that nothing ever has a reason 128 1.1 tron to send mail to "user (a] nullclient.example.com". </p> 129 1.1 tron 130 1.1 tron <li> <p> Line 3: Forward all mail to the mail server that is 131 1.1 tron responsible for the "example.com" domain. This prevents mail from 132 1.1 tron getting stuck on the null client if it is turned off while some 133 1.1 tron remote destination is unreachable. </p> 134 1.1 tron 135 1.1 tron <li> <p> Line 4: Do not accept mail from the network. </p> 136 1.1 tron 137 1.1 tron <li> <p> Lines 5-8: Disable local mail delivery. All mail goes to 138 1.1 tron the mail server as specified in line 3. </p> 139 1.1 tron 140 1.1 tron </ul> 141 1.1 tron 142 1.1 tron <h2><a name="local_network">Postfix on a local network</a></h2> 143 1.1 tron 144 1.1 tron <p> This section describes a local area network environment of one 145 1.1 tron main server and multiple other systems that send and receive email. 146 1.1 tron As usual we assume that the Internet domain name is "example.com". 147 1.1 tron All systems are configured to send mail as "user (a] example.com", and 148 1.1 tron all systems receive mail for "user (a] hostname.example.com". The main 149 1.1 tron server also receives mail for "user (a] example.com". We call this 150 1.1 tron machine by the name of mailhost.example.com. </p> 151 1.1 tron 152 1.1 tron <p> A drawback of sending mail as "user (a] example.com" is that mail 153 1.1 tron for "root" and other system accounts is also sent to the central 154 1.1 tron mailhost. See the section "<a href="#some_local">Delivering some 155 1.1 tron but not all accounts locally</a>" below for possible solutions. 156 1.1 tron </p> 157 1.1 tron 158 1.1 tron <p> As usual, the examples show only parameters that are not left 159 1.1 tron at their default settings. </p> 160 1.1 tron 161 1.1 tron <p> First we present the non-mailhost configuration, because it is 162 1.1 tron the simpler one. This machine sends mail as "user (a] example.com" and 163 1.1 tron is final destination for "user (a] hostname.example.com". </p> 164 1.1 tron 165 1.1 tron <blockquote> 166 1.1 tron <pre> 167 1.1 tron 1 /etc/postfix/main.cf: 168 1.1 tron 2 myorigin = $mydomain 169 1.1 tron 3 mynetworks = 127.0.0.0/8 10.0.0.0/24 170 1.1 tron 4 relay_domains = 171 1.1 tron 5 # Optional: forward all non-local mail to mailhost 172 1.1 tron 6 #relayhost = $mydomain 173 1.1 tron </pre> 174 1.1 tron </blockquote> 175 1.1 tron 176 1.1 tron <p> Translation: </p> 177 1.1 tron 178 1.1 tron <ul> 179 1.1 tron 180 1.1 tron <li> <p> Line 2: Send mail as "user (a] example.com". </p> 181 1.1 tron 182 1.1 tron <li> <p> Line 3: Specify the trusted networks. </p> 183 1.1 tron 184 1.1 tron <li> <p> Line 4: This host does not relay mail from untrusted networks. </p> 185 1.1 tron 186 1.1 tron <li> <p> Line 6: This is needed if no direct Internet access is 187 1.1 tron available. See also below, "<a href="#firewall">Postfix behind 188 1.1 tron a firewall</a>". </p> 189 1.1 tron 190 1.1 tron </ul> 191 1.1 tron 192 1.1 tron <p> Next we present the mailhost configuration. This machine sends 193 1.1 tron mail as "user (a] example.com" and is final destination for 194 1.1 tron "user (a] hostname.example.com" as well as "user (a] example.com". </p> 195 1.1 tron 196 1.1 tron <blockquote> 197 1.1 tron <pre> 198 1.1 tron 1 DNS: 199 1.1 tron 2 example.com IN MX 10 mailhost.example.com. 200 1.1 tron 3 201 1.1 tron 4 /etc/postfix/main.cf: 202 1.1 tron 5 myorigin = $mydomain 203 1.1 tron 6 mydestination = $myhostname localhost.$mydomain localhost $mydomain 204 1.1 tron 7 mynetworks = 127.0.0.0/8 10.0.0.0/24 205 1.1 tron 8 relay_domains = 206 1.1 tron 9 # Optional: forward all non-local mail to firewall 207 1.1 tron 10 #relayhost = [firewall.example.com] 208 1.1 tron </pre> 209 1.1 tron </blockquote> 210 1.1 tron 211 1.1 tron <p> Translation: </p> 212 1.1 tron 213 1.1 tron <ul> 214 1.1 tron 215 1.1 tron <li> <p> Line 2: Send mail for the domain "example.com" to the 216 1.1 tron machine mailhost.example.com. Remember to specify the "." at the 217 1.1 tron end of the line. </p> 218 1.1 tron 219 1.1 tron <li> <p> Line 5: Send mail as "user (a] example.com". </p> 220 1.1 tron 221 1.1 tron <li> <p> Line 6: This host is the final mail destination for the 222 1.1 tron "example.com" domain, in addition to the names of the machine 223 1.1 tron itself. </p> 224 1.1 tron 225 1.1 tron <li> <p> Line 7: Specify the trusted networks. </p> 226 1.1 tron 227 1.1 tron <li> <p> Line 8: This host does not relay mail from untrusted networks. </p> 228 1.1 tron 229 1.1 tron <li> <p> Line 10: This is needed only when the mailhost has to 230 1.1 tron forward non-local mail via a mail server on a firewall. The 231 1.1 tron <tt>[]</tt> forces Postfix to do no MX record lookups. </p> 232 1.1 tron 233 1.1 tron </ul> 234 1.1 tron 235 1.1 tron <p> In an environment like this, users access their mailbox in one 236 1.1 tron or more of the following ways: 237 1.1 tron 238 1.1 tron <ul> 239 1.1 tron 240 1.1 tron <li> <p> Mailbox access via NFS or equivalent. </p> 241 1.1 tron 242 1.1 tron <li> <p> Mailbox access via POP or IMAP. </p> 243 1.1 tron 244 1.1 tron <li> <p> Mailbox on the user's preferred machine. </p> 245 1.1 tron 246 1.1 tron </ul> 247 1.1 tron 248 1.1 tron <p> In the latter case, each user has an alias on the mailhost that 249 1.1 tron forwards mail to her preferred machine: </p> 250 1.1 tron 251 1.1 tron <blockquote> 252 1.1 tron <pre> 253 1.1 tron /etc/aliases: 254 1.1 tron joe: joe (a] joes.preferred.machine 255 1.1 tron jane: jane (a] janes.preferred.machine 256 1.1 tron </pre> 257 1.1 tron </blockquote> 258 1.1 tron 259 1.1 tron <p> On some systems the alias database is not in /etc/aliases. To 260 1.1 tron find out the location for your system, execute the command "<b>postconf 261 1.1 tron alias_maps</b>". </p> 262 1.1 tron 263 1.1 tron <p> Execute the command "<b>newaliases</b>" whenever you change 264 1.1 tron the aliases file. </p> 265 1.1 tron 266 1.1 tron <h2><a name="firewall">Postfix email firewall/gateway</a></h2> 267 1.1 tron 268 1.1 tron <p> The idea is to set up a Postfix email firewall/gateway that 269 1.1 tron forwards mail for "example.com" to an inside gateway machine but 270 1.1 tron rejects mail for "anything.example.com". There is only one problem: 271 1.1 tron with "relay_domains = example.com", the firewall normally also 272 1.1 tron accepts mail for "anything.example.com". That would not be right. 273 1.1 tron </p> 274 1.1 tron 275 1.1 tron <p> Note: this example requires Postfix version 2.0 and later. To find 276 1.1 tron out what Postfix version you have, execute the command "<b>postconf 277 1.1 tron mail_version</b>". </p> 278 1.1 tron 279 1.1 tron <p> The solution is presented in multiple parts. This first part 280 1.1 tron gets rid of local mail delivery on the firewall, making the firewall 281 1.1 tron harder to break. </p> 282 1.1 tron 283 1.1 tron <blockquote> 284 1.1 tron <pre> 285 1.1 tron 1 /etc/postfix/main.cf: 286 1.1 tron 2 myorigin = example.com 287 1.1 tron 3 mydestination = 288 1.1 tron 4 local_recipient_maps = 289 1.1 tron 5 local_transport = error:local mail delivery is disabled 290 1.1 tron 6 291 1.1 tron 7 /etc/postfix/master.cf: 292 1.1 tron 8 Comment out the local delivery agent 293 1.1 tron </pre> 294 1.1 tron </blockquote> 295 1.1 tron 296 1.1 tron <p> Translation: </p> 297 1.1 tron 298 1.1 tron <ul> 299 1.1 tron 300 1.1 tron <li> <p> Line 2: Send mail from this machine as "user (a] example.com", 301 1.1 tron so that no reason exists to send mail to "user (a] firewall.example.com". 302 1.1 tron </p> 303 1.1 tron 304 1.1 tron <li> <p> Lines 3-8: Disable local mail delivery on the firewall 305 1.1 tron machine. </p> 306 1.1 tron 307 1.1 tron </ul> 308 1.1 tron 309 1.1 tron <p> For the sake of technical correctness the firewall must be able 310 1.1 tron to receive mail for postmaster@[firewall ip address]. Reportedly, 311 1.1 tron some things actually expect this ability to exist. The second part 312 1.1 tron of the solution therefore adds support for postmaster@[firewall ip 313 1.1 tron address], and as a bonus we do abuse@[firewall ip address] as well. 314 1.1 tron All the mail to these two accounts is forwarded to an inside address. 315 1.1 tron </p> 316 1.1 tron 317 1.1 tron <blockquote> 318 1.1 tron <pre> 319 1.1 tron 1 /etc/postfix/main.cf: 320 1.1 tron 2 virtual_alias_maps = hash:/etc/postfix/virtual 321 1.1 tron 3 322 1.1 tron 4 /etc/postfix/virtual: 323 1.1 tron 5 postmaster postmaster (a] example.com 324 1.1 tron 6 abuse abuse (a] example.com 325 1.1 tron </pre> 326 1.1 tron </blockquote> 327 1.1 tron 328 1.1 tron <p> Translation: </p> 329 1.1 tron 330 1.1 tron <ul> 331 1.1 tron 332 1.1 tron <li> <p> Because mydestination is empty (see the previous example), 333 1.1 tron only address literals matching $inet_interfaces or $proxy_interfaces 334 1.1 tron are deemed local. So "localpart@[a.d.d.r]" can be matched as simply 335 1.1 tron "localpart" in canonical(5) and virtual(5). This avoids the need to 336 1.1 tron specify firewall IP addresses into Postfix configuration files. </p> 337 1.1 tron 338 1.1 tron </ul> 339 1.1 tron 340 1.1 tron <p> The last part of the solution does the email forwarding, which 341 1.1 tron is the real purpose of the firewall email function. </p> 342 1.1 tron 343 1.1 tron <blockquote> 344 1.1 tron <pre> 345 1.1 tron 1 /etc/postfix/main.cf: 346 1.1 tron 2 mynetworks = 127.0.0.0/8 12.34.56.0/24 347 1.1 tron 3 relay_domains = example.com 348 1.1 tron 4 parent_domain_matches_subdomains = 349 1.1 tron 5 debug_peer_list smtpd_access_maps 350 1.1 tron 6 smtpd_recipient_restrictions = 351 1.1 tron 7 permit_mynetworks reject_unauth_destination 352 1.1 tron 8 353 1.1 tron 9 relay_recipient_maps = hash:/etc/postfix/relay_recipients 354 1.1 tron 10 transport_maps = hash:/etc/postfix/transport 355 1.1 tron 11 356 1.1 tron 12 /etc/postfix/relay_recipients: 357 1.1 tron 13 user1 (a] example.com x 358 1.1 tron 14 user2 (a] example.com x 359 1.1 tron 15 . . . 360 1.1 tron 16 361 1.1 tron 17 /etc/postfix/transport: 362 1.1 tron 18 example.com smtp:[inside-gateway.example.com] 363 1.1 tron </pre> 364 1.1 tron </blockquote> 365 1.1 tron 366 1.1 tron <p> Translation: </p> 367 1.1 tron 368 1.1 tron <ul> 369 1.1 tron 370 1.1 tron <li><p> Lines 1-7: Accept mail from local systems in $mynetworks, 371 1.1 tron and accept mail from outside for "user (a] example.com" but not for 372 1.1 tron "user (a] anything.example.com". The magic is in lines 4-5. </p> 373 1.1 tron 374 1.1 tron <li> <p> Lines 9, 12-14: Define the list of valid addresses in the 375 1.1 tron "example.com" domain that can receive mail from the Internet. This 376 1.1 tron prevents the mail queue from filling up with undeliverable 377 1.1 tron MAILER-DAEMON messages. If you can't maintain a list of valid 378 1.1 tron recipients then you must specify "relay_recipient_maps =" (that 379 1.1 tron is, an empty value), or you must specify an "@example.com x" 380 1.1 tron wild-card in the relay_recipients table. </p> 381 1.1 tron 382 1.1 tron <li> <p> Lines 10, 17-18: Route mail for "example.com" to the inside 383 1.1 tron gateway machine. The <tt>[]</tt> forces Postfix to do no MX lookup. 384 1.1 tron </p> 385 1.1 tron 386 1.1 tron </ul> 387 1.1 tron 388 1.1 tron <p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses 389 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 390 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 391 1.1 tron 392 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/relay_recipients</b>" 393 1.1 tron whenever you change the relay_recipients table. </p> 394 1.1 tron 395 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/transport</b>" 396 1.1 tron whenever you change the transport table. </p> 397 1.1 tron 398 1.1 tron <p> In some installations, there may be separate instances of Postfix 399 1.1 tron processing inbound and outbound mail on a multi-homed firewall. The 400 1.1 tron inbound Postfix instance has an SMTP server listening on the external 401 1.1 tron firewall interface, and the outbound Postfix instance has an SMTP server 402 1.1 tron listening on the internal interface. In such a configuration is it is 403 1.1 tron tempting to configure $inet_interfaces in each instance with just the 404 1.1 tron corresponding interface address. </p> 405 1.1 tron 406 1.1 tron <p> In most cases, using inet_interfaces in this way will not work, 407 1.1 tron because as documented in the $inet_interfaces reference manual, the 408 1.1 tron smtp(8) delivery agent will also use the specified interface address 409 1.1 tron as the source address for outbound connections and will be unable to 410 1.1 tron reach hosts on "the other side" of the firewall. The symptoms are that 411 1.1 tron the firewall is unable to connect to hosts that are in fact up. See the 412 1.1 tron inet_interfaces parameter documentation for suggested work-arounds.</p> 413 1.1 tron 414 1.1 tron <h2><a name="some_local">Delivering some but not all accounts 415 1.1 tron locally</a></h2> 416 1.1 tron 417 1.1 tron <p> A drawback of sending mail as "user (a] example.com" (instead of 418 1.1 tron "user (a] hostname.example.com") is that mail for "root" and other 419 1.1 tron system accounts is also sent to the central mailhost. In order to 420 1.1 tron deliver such accounts locally, you can set up virtual aliases as 421 1.1 tron follows: </p> 422 1.1 tron 423 1.1 tron <blockquote> 424 1.1 tron <pre> 425 1.1 tron 1 /etc/postfix/main.cf: 426 1.1 tron 2 virtual_alias_maps = hash:/etc/postfix/virtual 427 1.1 tron 3 428 1.1 tron 4 /etc/postfix/virtual: 429 1.1 tron 5 root root@localhost 430 1.1 tron 6 . . . 431 1.1 tron </pre> 432 1.1 tron </blockquote> 433 1.1 tron 434 1.1 tron <p> Translation: </p> 435 1.1 tron 436 1.1 tron <ul> 437 1.1 tron 438 1.1 tron <li> <p> Line 5: As described in the virtual(5) manual page, the 439 1.1 tron bare name "root" matches "root@site" when "site" is equal to 440 1.1 tron $myorigin, when "site" is listed in $mydestination, or when it 441 1.1 tron matches $inet_interfaces or $proxy_interfaces. </p> 442 1.1 tron 443 1.1 tron </ul> 444 1.1 tron 445 1.1.1.2 tron <p> Execute the command "<b>postmap /etc/postfix/virtual</b>" after 446 1.1.1.2 tron editing the file. </p>. 447 1.1.1.2 tron 448 1.1 tron <h2><a name="intranet">Running Postfix behind a firewall</a></h2> 449 1.1 tron 450 1.1 tron <p> The simplest way to set up Postfix on a host behind a firewalled 451 1.1 tron network is to send all mail to a gateway host, and to let that mail 452 1.1 tron host take care of internal and external forwarding. Examples of that 453 1.1 tron are shown in the <a href="#local_network">local area network</a> 454 1.1 tron section above. A more sophisticated approach is to send only external 455 1.1 tron mail to the gateway host, and to send intranet mail directly. 456 1.1 tron That's what Wietse does at work. </p> 457 1.1 tron 458 1.1 tron <p> Note: this example requires Postfix version 2.0 and later. To find 459 1.1 tron out what Postfix version you have, execute the command "<b>postconf 460 1.1 tron mail_version</b>". </p> 461 1.1 tron 462 1.1 tron <p> The following example presents additional configuration. You 463 1.1 tron need to combine this with basic configuration information as 464 1.1 tron discussed the first half of this document. </p> 465 1.1 tron 466 1.1 tron <blockquote> 467 1.1 tron <pre> 468 1.1 tron 1 /etc/postfix/main.cf: 469 1.1 tron 2 transport_maps = hash:/etc/postfix/transport 470 1.1 tron 3 relayhost = 471 1.1 tron 4 # Optional for a machine that isn't "always on" 472 1.1 tron 5 #fallback_relay = [gateway.example.com] 473 1.1 tron 6 474 1.1 tron 7 /etc/postfix/transport: 475 1.1 tron 8 # Internal delivery. 476 1.1 tron 9 example.com : 477 1.1 tron 10 .example.com : 478 1.1 tron 11 # External delivery. 479 1.1 tron 12 * smtp:[gateway.example.com] 480 1.1 tron </pre> 481 1.1 tron </blockquote> 482 1.1 tron 483 1.1 tron <p> Translation: </p> 484 1.1 tron 485 1.1 tron <ul> 486 1.1 tron 487 1.1 tron <li> <p> Lines 2, 7-12: Request that intranet mail is delivered 488 1.1 tron directly, and that external mail is given to a gateway. Obviously, 489 1.1 tron this example assumes that the organization uses DNS MX records 490 1.1 tron internally. The <tt>[]</tt> forces Postfix to do no MX lookup. 491 1.1 tron </p> 492 1.1 tron 493 1.1 tron <li> <p> Line 3: IMPORTANT: do not specify a relayhost in main.cf. 494 1.1 tron </p> 495 1.1 tron 496 1.1 tron <li> <p> Line 5: This prevents mail from being stuck in the queue 497 1.1 tron when the machine is turned off. Postfix tries to deliver mail 498 1.1 tron directly, and gives undeliverable mail to a gateway. </p> 499 1.1 tron 500 1.1 tron </ul> 501 1.1 tron 502 1.1 tron <p> Specify <b>dbm</b> instead of <b>hash</b> if your system uses 503 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 504 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 505 1.1 tron 506 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/transport</b>" whenever 507 1.1 tron you edit the transport table. </p> 508 1.1 tron 509 1.1 tron <h2><a name="backup">Configuring Postfix as primary or backup MX host for a remote site</a></h2> 510 1.1 tron 511 1.1 tron <p> This section presents additional configuration. You need to 512 1.1 tron combine this with basic configuration information as discussed the 513 1.1 tron first half of this document. </p> 514 1.1 tron 515 1.1 tron <p> When your system is SECONDARY MX host for a remote site this 516 1.1 tron is all you need: </p> 517 1.1 tron 518 1.1 tron <blockquote> 519 1.1 tron <pre> 520 1.1 tron 1 DNS: 521 1.1 tron 2 the.backed-up.domain.tld IN MX 100 your.machine.tld. 522 1.1 tron 3 523 1.1 tron 4 /etc/postfix/main.cf: 524 1.1 tron 5 relay_domains = . . . the.backed-up.domain.tld 525 1.1 tron 6 smtpd_recipient_restrictions = 526 1.1 tron 7 permit_mynetworks reject_unauth_destination 527 1.1 tron 8 528 1.1 tron 9 # You must specify your NAT/proxy external address. 529 1.1 tron 10 #proxy_interfaces = 1.2.3.4 530 1.1 tron 11 531 1.1 tron 12 relay_recipient_maps = hash:/etc/postfix/relay_recipients 532 1.1 tron 13 533 1.1 tron 14 /etc/postfix/relay_recipients: 534 1.1 tron 15 user1 (a] the.backed-up.domain.tld x 535 1.1 tron 16 user2 (a] the.backed-up.domain.tld x 536 1.1 tron 17 . . . 537 1.1 tron </pre> 538 1.1 tron </blockquote> 539 1.1 tron 540 1.1 tron <p> When your system is PRIMARY MX host for a remote site you 541 1.1 tron need the above, plus: </p> 542 1.1 tron 543 1.1 tron <blockquote> 544 1.1 tron <pre> 545 1.1 tron 18 /etc/postfix/main.cf: 546 1.1 tron 19 transport_maps = hash:/etc/postfix/transport 547 1.1 tron 20 548 1.1 tron 21 /etc/postfix/transport: 549 1.1 tron 22 the.backed-up.domain.tld relay:[their.mail.host.tld] 550 1.1 tron </pre> 551 1.1 tron </blockquote> 552 1.1 tron 553 1.1 tron <p> Important notes: 554 1.1 tron 555 1.1 tron <ul> 556 1.1 tron 557 1.1 tron <li><p>Do not list the.backed-up.domain.tld in mydestination.</p> 558 1.1 tron 559 1.1 tron <li><p>Do not list the.backed-up.domain.tld in virtual_alias_domains.</p> 560 1.1 tron 561 1.1 tron <li><p>Do not list the.backed-up.domain.tld in virtual_mailbox_domains.</p> 562 1.1 tron 563 1.1 tron <li> <p> Lines 1-7: Forward mail from the Internet for 564 1.1 tron "the.backed-up.domain.tld" to the primary MX host for that domain. 565 1.1 tron </p> 566 1.1 tron 567 1.1 tron <li> <p> Line 10: This is a must if Postfix receives mail via a 568 1.1 tron NAT relay or proxy that presents a different IP address to the 569 1.1 tron world than the local machine. </p> 570 1.1 tron 571 1.1 tron <li> <p> Lines 12-16: Define the list of valid addresses in the 572 1.1 tron "the.backed-up.domain.tld" domain. This prevents your mail queue 573 1.1 tron from filling up with undeliverable MAILER-DAEMON messages. If you 574 1.1 tron can't maintain a list of valid recipients then you must specify 575 1.1 tron "relay_recipient_maps =" (that is, an empty value), or you must 576 1.1 tron specify an "@the.backed-up.domain.tld x" wild-card in the 577 1.1 tron relay_recipients table. </p> 578 1.1 tron 579 1.1 tron <li> <p> Line 22: The <tt>[]</tt> forces Postfix to do no MX lookup. </p> 580 1.1 tron 581 1.1 tron </ul> 582 1.1 tron 583 1.1 tron <p> Specify <b>dbm</b> instead of <b>hash</b> if your system uses 584 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 585 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 586 1.1 tron 587 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/transport</b>" 588 1.1 tron whenever you change the transport table. </p> 589 1.1 tron 590 1.1 tron <p> NOTE for Postfix < 2.2: Do not use the fallback_relay feature 591 1.1 tron when relaying mail 592 1.1 tron for a backup or primary MX domain. Mail would loop between the 593 1.1 tron Postfix MX host and the fallback_relay host when the final destination 594 1.1 tron is unavailable. </p> 595 1.1 tron 596 1.1 tron <ul> 597 1.1 tron 598 1.1 tron <li> In main.cf specify "<tt>relay_transport = relay</tt>", 599 1.1 tron 600 1.1 tron <li> In master.cf specify "<tt>-o fallback_relay =</tt>" at the 601 1.1 tron end of the <tt>relay</tt> entry. 602 1.1 tron 603 1.1 tron <li> In transport maps, specify "<tt>relay:<i>nexthop...</i></tt>" 604 1.1 tron as the right-hand side for backup or primary MX domain entries. 605 1.1 tron 606 1.1 tron </ul> 607 1.1 tron 608 1.1 tron <p> These are default settings in Postfix version 2.2 and later. 609 1.1 tron </p> 610 1.1 tron 611 1.1 tron <h2><a name="dialup">Postfix on a dialup machine</a></h2> 612 1.1 tron 613 1.1 tron <p> This section applies to dialup connections that are down most 614 1.1 tron of the time. For dialup connections that are up 24x7, see the <a 615 1.1 tron href="#local_network">local area network</a> section above. </p> 616 1.1 tron 617 1.1 tron <p> This section presents additional configuration. You need to 618 1.1 tron combine this with basic configuration information as discussed the 619 1.1 tron first half of this document. </p> 620 1.1 tron 621 1.1 tron <p> If you do not have your own hostname and IP address (usually 622 1.1 tron with dialup, cable TV or DSL connections) then you should also 623 1.1 tron study the section on "<a href="#fantasy">Postfix on hosts without 624 1.1 tron a real Internet hostname</a>". </p> 625 1.1 tron 626 1.1 tron <ul> 627 1.1 tron 628 1.1 tron <li> Route all outgoing mail to your network provider. 629 1.1 tron 630 1.1 tron <p> If your machine is disconnected most of the time, there isn't 631 1.1 tron a lot of opportunity for Postfix to deliver mail to hard-to-reach 632 1.1 tron corners of the Internet. It's better to give the mail to a machine 633 1.1 tron that is connected all the time. In the example below, the <tt>[]</tt> 634 1.1 tron prevents Postfix from trying to look up DNS MX records. </p> 635 1.1 tron 636 1.1 tron <pre> 637 1.1 tron /etc/postfix/main.cf: 638 1.1 tron relayhost = [smtprelay.someprovider.com] 639 1.1 tron </pre> 640 1.1 tron 641 1.1 tron <li> <p><a name="spontaneous_smtp">Disable spontaneous SMTP mail 642 1.1 tron delivery (if using on-demand dialup IP only).</a> </p> 643 1.1 tron 644 1.1 tron <p> Normally, Postfix attempts to deliver outbound mail at its convenience. 645 1.1 tron If your machine uses on-demand dialup IP, this causes your system 646 1.1 tron to place a telephone call whenever you submit new mail, and whenever 647 1.1 tron Postfix retries to deliver delayed mail. To prevent such telephone 648 1.1 tron calls from being placed, disable spontaneous SMTP mail deliveries. </p> 649 1.1 tron 650 1.1 tron <pre> 651 1.1 tron /etc/postfix/main.cf: 652 1.1 tron defer_transports = smtp (Only for on-demand dialup IP hosts) 653 1.1 tron </pre> 654 1.1 tron 655 1.1 tron <li> <p>Disable SMTP client DNS lookups (dialup LAN only).</p> 656 1.1 tron 657 1.1 tron <pre> 658 1.1 tron /etc/postfix/main.cf: 659 1.1 tron disable_dns_lookups = yes (Only for on-demand dialup IP hosts) 660 1.1 tron </pre> 661 1.1 tron 662 1.1 tron <li> Flush the mail queue whenever the Internet link is established. 663 1.1 tron 664 1.1 tron <p> Put the following command into your PPP or SLIP dialup scripts: </p> 665 1.1 tron 666 1.1 tron <pre> 667 1.1 tron /usr/sbin/sendmail -q (whenever the Internet link is up) 668 1.1 tron </pre> 669 1.1 tron 670 1.1 tron <p> The exact location of the Postfix sendmail command is system-specific. 671 1.1 tron Use the command "<b>postconf sendmail_path</b>" to find out where the 672 1.1 tron Postfix sendmail command is located on your machine. </p> 673 1.1 tron 674 1.1 tron <p> In order to find out if the mail queue is flushed, use something 675 1.1 tron like: </p> 676 1.1 tron 677 1.1 tron <pre> 678 1.1 tron #!/bin/sh 679 1.1 tron 680 1.1 tron # Start mail deliveries. 681 1.1 tron /usr/sbin/sendmail -q 682 1.1 tron 683 1.1 tron # Allow deliveries to start. 684 1.1 tron sleep 10 685 1.1 tron 686 1.1 tron # Loop until all messages have been tried at least once. 687 1.1 tron while mailq | grep '^[^ ]*\*' >/dev/null 688 1.1 tron do 689 1.1 tron sleep 10 690 1.1 tron done 691 1.1 tron </pre> 692 1.1 tron 693 1.1 tron <p> If you have disabled <a href="#spontaneous_smtp">spontaneous 694 1.1 tron SMTP mail delivery</a>, you also need to run the "<b>sendmail -q</b>" 695 1.1 tron command every now and then while the dialup link is up, so that 696 1.1 tron newly-posted mail is flushed from the queue. </p> 697 1.1 tron 698 1.1 tron </ul> 699 1.1 tron 700 1.1 tron <h2><a name="fantasy">Postfix on hosts without a real Internet 701 1.1 tron hostname</a></h2> 702 1.1 tron 703 1.1 tron <p> This section is for hosts that don't have their own Internet 704 1.1 tron hostname. Typically these are systems that get a dynamic IP address 705 1.1 tron via DHCP or via dialup. Postfix will let you send and receive mail 706 1.1 tron just fine between accounts on a machine with a fantasy name. However, 707 1.1 tron you cannot use a fantasy hostname in your email address when sending 708 1.1 tron mail into the Internet, because no-one would be able to reply to 709 1.1 tron your mail. In fact, more and more sites refuse mail addresses with 710 1.1 tron non-existent domain names. </p> 711 1.1 tron 712 1.1 tron <p> Note: the following information is Postfix version dependent. 713 1.1 tron To find out what Postfix version you have, execute the command 714 1.1 tron "<b>postconf mail_version</b>". </p> 715 1.1 tron 716 1.1 tron <h3>Solution 1: Postfix version 2.2 and later </h3> 717 1.1 tron 718 1.1 tron <p> Postfix 2.2 uses the generic(5) address mapping to replace 719 1.1 tron local fantasy email addresses by valid Internet addresses. This 720 1.1 tron mapping happens ONLY when mail leaves the machine; not when you 721 1.1 tron send mail between users on the same machine. </p> 722 1.1 tron 723 1.1 tron <p> The following example presents additional configuration. You 724 1.1 tron need to combine this with basic configuration information as 725 1.1 tron discussed the first half of this document. </p> 726 1.1 tron 727 1.1 tron <blockquote> 728 1.1 tron <pre> 729 1.1 tron 1 /etc/postfix/main.cf: 730 1.1 tron 2 smtp_generic_maps = hash:/etc/postfix/generic 731 1.1 tron 3 732 1.1 tron 4 /etc/postfix/generic: 733 1.1 tron 5 his (a] localdomain.local hisaccount (a] hisisp.example 734 1.1 tron 6 her (a] localdomain.local heraccount (a] herisp.example 735 1.1 tron 7 @localdomain.local hisaccount+local (a] hisisp.example 736 1.1 tron </pre> 737 1.1 tron </blockquote> 738 1.1 tron 739 1.1 tron <p> When mail is sent to a remote host via SMTP: </p> 740 1.1 tron 741 1.1 tron <ul> 742 1.1 tron 743 1.1 tron <li> <p> Line 5 replaces <i>his (a] localdomain.local</i> by his ISP 744 1.1 tron mail address, </p> 745 1.1 tron 746 1.1 tron <li> <p> Line 6 replaces <i>her (a] localdomain.local</i> by her ISP 747 1.1 tron mail address, and </p> 748 1.1 tron 749 1.1 tron <li> <p> Line 7 replaces other local addresses by his ISP account, 750 1.1 tron with an address extension of +<i>local</i> (this example assumes 751 1.1 tron that the ISP supports "+" style address extensions). </p> 752 1.1 tron 753 1.1 tron </ul> 754 1.1 tron 755 1.1 tron <p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses 756 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 757 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 758 1.1 tron 759 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/generic</b>" 760 1.1 tron whenever you change the generic table. </p> 761 1.1 tron 762 1.1 tron <h3>Solution 2: Postfix version 2.1 and earlier </h3> 763 1.1 tron 764 1.1 tron <p> The solution with older Postfix systems is to use valid 765 1.1 tron Internet addresses where possible, and to let Postfix map valid 766 1.1 tron Internet addresses to local fantasy addresses. With this, you can 767 1.1 tron send mail to the Internet and to local fantasy addresses, including 768 1.1 tron mail to local fantasy addresses that don't have a valid Internet 769 1.1 tron address of their own.</p> 770 1.1 tron 771 1.1 tron <p> The following example presents additional configuration. You 772 1.1 tron need to combine this with basic configuration information as 773 1.1 tron discussed the first half of this document. </p> 774 1.1 tron 775 1.1 tron <blockquote> 776 1.1 tron <pre> 777 1.1 tron 1 /etc/postfix/main.cf: 778 1.1 tron 2 myhostname = hostname.localdomain 779 1.1 tron 3 mydomain = localdomain 780 1.1 tron 4 781 1.1 tron 5 canonical_maps = hash:/etc/postfix/canonical 782 1.1 tron 6 783 1.1 tron 7 virtual_alias_maps = hash:/etc/postfix/virtual 784 1.1 tron 8 785 1.1 tron 9 /etc/postfix/canonical: 786 1.1 tron 10 your-login-name your-account (a] your-isp.com 787 1.1 tron 11 788 1.1 tron 12 /etc/postfix/virtual: 789 1.1 tron 13 your-account (a] your-isp.com your-login-name 790 1.1 tron </pre> 791 1.1 tron </blockquote> 792 1.1 tron 793 1.1 tron <p> Translation: </p> 794 1.1 tron 795 1.1 tron <ul> 796 1.1 tron 797 1.1 tron <li> <p> Lines 2-3: Substitute your fantasy hostname here. Do not 798 1.1 tron use a domain name that is already in use by real organizations 799 1.1 tron on the Internet. See RFC 2606 for examples of domain 800 1.1 tron names that are guaranteed not to be owned by anyone. </p> 801 1.1 tron 802 1.1 tron <li> <p> Lines 5, 9, 10: This provides the mapping from 803 1.1 tron "your-login-name (a] hostname.localdomain" to "your-account (a] your-isp.com". 804 1.1 tron This part is required. </p> 805 1.1 tron 806 1.1 tron <li> <p> Lines 7, 12, 13: Deliver mail for "your-account (a] your-isp.com" 807 1.1 tron locally, instead of sending it to the ISP. This part is not required 808 1.1 tron but is convenient. 809 1.1 tron 810 1.1 tron </ul> 811 1.1 tron 812 1.1 tron <p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses 813 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 814 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 815 1.1 tron 816 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/canonical</b>" 817 1.1 tron whenever you change the canonical table. </p> 818 1.1 tron 819 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/virtual</b>" 820 1.1 tron whenever you change the virtual table. </p> 821 1.1 tron 822 1.1 tron </body> 823 1.1 tron 824 1.1 tron </html> 825
Indexes created Sun Jun 28 00:24:58 UTC 2026