STANDARD_CONFIGURATION_README.html revision 1.1.1.5
1 1.1 tron <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 1.1 tron "http://www.w3.org/TR/html4/loose.dtd"> 3 1.1 tron 4 1.1 tron <html> 5 1.1 tron 6 1.1 tron <head> 7 1.1 tron 8 1.1 tron <title>Postfix Standard Configuration Examples</title> 9 1.1 tron 10 1.1.1.5 christos <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 11 1.1 tron 12 1.1 tron </head> 13 1.1 tron 14 1.1 tron <body> 15 1.1 tron 16 1.1 tron <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Standard Configuration Examples</h1> 17 1.1 tron 18 1.1 tron <hr> 19 1.1 tron 20 1.1 tron <h2>Purpose of this document</h2> 21 1.1 tron 22 1.1 tron <p> This document presents a number of typical Postfix configurations. 23 1.1 tron This document should be reviewed after you have followed the basic 24 1.1 tron configuration steps as described in the BASIC_CONFIGURATION_README 25 1.1 tron document. In particular, do not proceed here if you don't already 26 1.1 tron have Postfix working for local mail submission and for local mail 27 1.1 tron delivery. </p> 28 1.1 tron 29 1.1 tron <p> The first part of this document presents standard configurations 30 1.1 tron that each solve one specific problem. </p> 31 1.1 tron 32 1.1 tron <ul> 33 1.1 tron 34 1.1 tron <li><a href="#stand_alone">Postfix on a stand-alone Internet host</a> 35 1.1 tron 36 1.1 tron <li><a href="#null_client">Postfix on a null client</a> 37 1.1 tron 38 1.1 tron <li><a href="#local_network">Postfix on a local network</a> 39 1.1 tron 40 1.1 tron <li><a href="#firewall">Postfix email firewall/gateway</a> 41 1.1 tron 42 1.1 tron </ul> 43 1.1 tron 44 1.1 tron <p> The second part of this document presents additional configurations 45 1.1 tron for hosts in specific environments. </p> 46 1.1 tron 47 1.1 tron <ul> 48 1.1 tron 49 1.1 tron <li><a href="#some_local">Delivering some but not all accounts locally</a> 50 1.1 tron 51 1.1 tron <li><a href="#intranet">Running Postfix behind a firewall</a> 52 1.1 tron 53 1.1 tron <li><a href="#backup">Configuring Postfix as primary or backup MX host for a remote 54 1.1 tron site</a> 55 1.1 tron 56 1.1 tron <li><a href="#dialup">Postfix on a dialup machine</a> 57 1.1 tron 58 1.1 tron <li><a href="#fantasy">Postfix on hosts without a real 59 1.1 tron Internet hostname</a> 60 1.1 tron 61 1.1 tron </ul> 62 1.1 tron 63 1.1 tron <h2><a name="stand_alone">Postfix on a stand-alone Internet host</a></h2> 64 1.1 tron 65 1.1 tron <p> Postfix should work out of the box without change on a stand-alone 66 1.1 tron machine that has direct Internet access. At least, that is how 67 1.1 tron Postfix installs when you download the Postfix source code via 68 1.1 tron http://www.postfix.org/. </p> 69 1.1 tron 70 1.1 tron <p> You can use the command "<b>postconf -n</b>" to find out what 71 1.1 tron settings are overruled by your main.cf. Besides a few pathname 72 1.1 tron settings, few parameters should be set on a stand-alone box, beyond 73 1.1 tron what is covered in the BASIC_CONFIGURATION_README document: </p> 74 1.1 tron 75 1.1 tron <blockquote> 76 1.1 tron <pre> 77 1.1 tron /etc/postfix/main.cf: 78 1.1 tron # Optional: send mail as user@domainname instead of user@hostname. 79 1.1 tron #myorigin = $mydomain 80 1.1 tron 81 1.1 tron # Optional: specify NAT/proxy external address. 82 1.1 tron #proxy_interfaces = 1.2.3.4 83 1.1 tron 84 1.1 tron # Alternative 1: don't relay mail from other hosts. 85 1.1 tron mynetworks_style = host 86 1.1 tron relay_domains = 87 1.1 tron 88 1.1 tron # Alternative 2: relay mail from local clients only. 89 1.1 tron # mynetworks = 192.168.1.0/28 90 1.1 tron # relay_domains = 91 1.1 tron </pre> 92 1.1 tron </blockquote> 93 1.1 tron 94 1.1 tron <p> See also the section "<a href="#fantasy">Postfix on hosts without 95 1.1 tron a real Internet hostname</a>" if this is applicable to your configuration. 96 1.1 tron </p> 97 1.1 tron 98 1.1 tron <h2><a name="null_client">Postfix on a null client</a></h2> 99 1.1 tron 100 1.1 tron <p> A null client is a machine that can only send mail. It receives no 101 1.1 tron mail from the network, and it does not deliver any mail locally. A 102 1.1 tron null client typically uses POP, IMAP or NFS for mailbox access. </p> 103 1.1 tron 104 1.1 tron <p> In this example we assume that the Internet domain name is 105 1.1.1.4 tron "example.com" and that the machine is named "hostname.example.com". 106 1.1 tron As usual, the examples show only parameters that are not left at 107 1.1 tron their default settings. </p> 108 1.1 tron 109 1.1 tron <blockquote> 110 1.1 tron <pre> 111 1.1 tron 1 /etc/postfix/main.cf: 112 1.1.1.4 tron 2 myhostname = hostname.example.com 113 1.1.1.4 tron 3 myorigin = $mydomain 114 1.1.1.4 tron 4 relayhost = $mydomain 115 1.1.1.4 tron 5 inet_interfaces = loopback-only 116 1.1.1.4 tron 6 mydestination = 117 1.1 tron </pre> 118 1.1 tron </blockquote> 119 1.1 tron 120 1.1 tron <p> Translation: </p> 121 1.1 tron 122 1.1 tron <ul> 123 1.1 tron 124 1.1.1.4 tron <li> <p> Line 2: Set myhostname to hostname.example.com, in case 125 1.1.1.4 tron the machine name isn't set to a fully-qualified domain name (use 126 1.1.1.4 tron the command "postconf -d myhostname" to find out what the machine 127 1.1.1.4 tron name is). </p> 128 1.1.1.4 tron 129 1.1.1.4 tron <li> <p> Line 2: The myhostname value also provides the default 130 1.1.1.4 tron value for the mydomain parameter (here, "mydomain = example.com"). 131 1.1.1.4 tron </p> 132 1.1 tron 133 1.1.1.4 tron <li> <p> Line 3: Send mail as "user (a] example.com" (instead of 134 1.1.1.4 tron "user (a] hostname.example.com"), so that nothing ever has a reason 135 1.1.1.4 tron to send mail to "user (a] hostname.example.com". </p> 136 1.1.1.4 tron 137 1.1.1.4 tron <li> <p> Line 4: Forward all mail to the mail server that is 138 1.1 tron responsible for the "example.com" domain. This prevents mail from 139 1.1 tron getting stuck on the null client if it is turned off while some 140 1.1.1.4 tron remote destination is unreachable. Specify a real hostname 141 1.1.1.4 tron here if your "example.com" domain has no MX record. </p> 142 1.1 tron 143 1.1.1.4 tron <li> <p> Line 5: Do not accept mail from the network. </p> 144 1.1 tron 145 1.1.1.4 tron <li> <p> Line 6: Disable local mail delivery. All mail goes to 146 1.1.1.4 tron the mail server as specified in line 4. </p> 147 1.1 tron 148 1.1 tron </ul> 149 1.1 tron 150 1.1 tron <h2><a name="local_network">Postfix on a local network</a></h2> 151 1.1 tron 152 1.1 tron <p> This section describes a local area network environment of one 153 1.1 tron main server and multiple other systems that send and receive email. 154 1.1 tron As usual we assume that the Internet domain name is "example.com". 155 1.1 tron All systems are configured to send mail as "user (a] example.com", and 156 1.1 tron all systems receive mail for "user (a] hostname.example.com". The main 157 1.1 tron server also receives mail for "user (a] example.com". We call this 158 1.1 tron machine by the name of mailhost.example.com. </p> 159 1.1 tron 160 1.1 tron <p> A drawback of sending mail as "user (a] example.com" is that mail 161 1.1 tron for "root" and other system accounts is also sent to the central 162 1.1 tron mailhost. See the section "<a href="#some_local">Delivering some 163 1.1 tron but not all accounts locally</a>" below for possible solutions. 164 1.1 tron </p> 165 1.1 tron 166 1.1 tron <p> As usual, the examples show only parameters that are not left 167 1.1 tron at their default settings. </p> 168 1.1 tron 169 1.1 tron <p> First we present the non-mailhost configuration, because it is 170 1.1 tron the simpler one. This machine sends mail as "user (a] example.com" and 171 1.1.1.5 christos is the final destination for "user (a] hostname.example.com". </p> 172 1.1 tron 173 1.1 tron <blockquote> 174 1.1 tron <pre> 175 1.1 tron 1 /etc/postfix/main.cf: 176 1.1 tron 2 myorigin = $mydomain 177 1.1 tron 3 mynetworks = 127.0.0.0/8 10.0.0.0/24 178 1.1 tron 4 relay_domains = 179 1.1 tron 5 # Optional: forward all non-local mail to mailhost 180 1.1 tron 6 #relayhost = $mydomain 181 1.1 tron </pre> 182 1.1 tron </blockquote> 183 1.1 tron 184 1.1 tron <p> Translation: </p> 185 1.1 tron 186 1.1 tron <ul> 187 1.1 tron 188 1.1 tron <li> <p> Line 2: Send mail as "user (a] example.com". </p> 189 1.1 tron 190 1.1 tron <li> <p> Line 3: Specify the trusted networks. </p> 191 1.1 tron 192 1.1 tron <li> <p> Line 4: This host does not relay mail from untrusted networks. </p> 193 1.1 tron 194 1.1 tron <li> <p> Line 6: This is needed if no direct Internet access is 195 1.1 tron available. See also below, "<a href="#firewall">Postfix behind 196 1.1 tron a firewall</a>". </p> 197 1.1 tron 198 1.1 tron </ul> 199 1.1 tron 200 1.1 tron <p> Next we present the mailhost configuration. This machine sends 201 1.1.1.5 christos mail as "user (a] example.com" and is the final destination for 202 1.1 tron "user (a] hostname.example.com" as well as "user (a] example.com". </p> 203 1.1 tron 204 1.1 tron <blockquote> 205 1.1 tron <pre> 206 1.1 tron 1 DNS: 207 1.1 tron 2 example.com IN MX 10 mailhost.example.com. 208 1.1 tron 3 209 1.1 tron 4 /etc/postfix/main.cf: 210 1.1 tron 5 myorigin = $mydomain 211 1.1 tron 6 mydestination = $myhostname localhost.$mydomain localhost $mydomain 212 1.1 tron 7 mynetworks = 127.0.0.0/8 10.0.0.0/24 213 1.1 tron 8 relay_domains = 214 1.1 tron 9 # Optional: forward all non-local mail to firewall 215 1.1 tron 10 #relayhost = [firewall.example.com] 216 1.1 tron </pre> 217 1.1 tron </blockquote> 218 1.1 tron 219 1.1 tron <p> Translation: </p> 220 1.1 tron 221 1.1 tron <ul> 222 1.1 tron 223 1.1 tron <li> <p> Line 2: Send mail for the domain "example.com" to the 224 1.1 tron machine mailhost.example.com. Remember to specify the "." at the 225 1.1 tron end of the line. </p> 226 1.1 tron 227 1.1 tron <li> <p> Line 5: Send mail as "user (a] example.com". </p> 228 1.1 tron 229 1.1 tron <li> <p> Line 6: This host is the final mail destination for the 230 1.1 tron "example.com" domain, in addition to the names of the machine 231 1.1 tron itself. </p> 232 1.1 tron 233 1.1 tron <li> <p> Line 7: Specify the trusted networks. </p> 234 1.1 tron 235 1.1 tron <li> <p> Line 8: This host does not relay mail from untrusted networks. </p> 236 1.1 tron 237 1.1 tron <li> <p> Line 10: This is needed only when the mailhost has to 238 1.1 tron forward non-local mail via a mail server on a firewall. The 239 1.1 tron <tt>[]</tt> forces Postfix to do no MX record lookups. </p> 240 1.1 tron 241 1.1 tron </ul> 242 1.1 tron 243 1.1 tron <p> In an environment like this, users access their mailbox in one 244 1.1 tron or more of the following ways: 245 1.1 tron 246 1.1 tron <ul> 247 1.1 tron 248 1.1 tron <li> <p> Mailbox access via NFS or equivalent. </p> 249 1.1 tron 250 1.1 tron <li> <p> Mailbox access via POP or IMAP. </p> 251 1.1 tron 252 1.1 tron <li> <p> Mailbox on the user's preferred machine. </p> 253 1.1 tron 254 1.1 tron </ul> 255 1.1 tron 256 1.1 tron <p> In the latter case, each user has an alias on the mailhost that 257 1.1 tron forwards mail to her preferred machine: </p> 258 1.1 tron 259 1.1 tron <blockquote> 260 1.1 tron <pre> 261 1.1 tron /etc/aliases: 262 1.1 tron joe: joe (a] joes.preferred.machine 263 1.1 tron jane: jane (a] janes.preferred.machine 264 1.1 tron </pre> 265 1.1 tron </blockquote> 266 1.1 tron 267 1.1 tron <p> On some systems the alias database is not in /etc/aliases. To 268 1.1 tron find out the location for your system, execute the command "<b>postconf 269 1.1 tron alias_maps</b>". </p> 270 1.1 tron 271 1.1 tron <p> Execute the command "<b>newaliases</b>" whenever you change 272 1.1 tron the aliases file. </p> 273 1.1 tron 274 1.1 tron <h2><a name="firewall">Postfix email firewall/gateway</a></h2> 275 1.1 tron 276 1.1 tron <p> The idea is to set up a Postfix email firewall/gateway that 277 1.1 tron forwards mail for "example.com" to an inside gateway machine but 278 1.1 tron rejects mail for "anything.example.com". There is only one problem: 279 1.1 tron with "relay_domains = example.com", the firewall normally also 280 1.1 tron accepts mail for "anything.example.com". That would not be right. 281 1.1 tron </p> 282 1.1 tron 283 1.1 tron <p> Note: this example requires Postfix version 2.0 and later. To find 284 1.1 tron out what Postfix version you have, execute the command "<b>postconf 285 1.1 tron mail_version</b>". </p> 286 1.1 tron 287 1.1 tron <p> The solution is presented in multiple parts. This first part 288 1.1 tron gets rid of local mail delivery on the firewall, making the firewall 289 1.1 tron harder to break. </p> 290 1.1 tron 291 1.1 tron <blockquote> 292 1.1 tron <pre> 293 1.1 tron 1 /etc/postfix/main.cf: 294 1.1 tron 2 myorigin = example.com 295 1.1 tron 3 mydestination = 296 1.1 tron 4 local_recipient_maps = 297 1.1 tron 5 local_transport = error:local mail delivery is disabled 298 1.1 tron 6 299 1.1 tron 7 /etc/postfix/master.cf: 300 1.1 tron 8 Comment out the local delivery agent 301 1.1 tron </pre> 302 1.1 tron </blockquote> 303 1.1 tron 304 1.1 tron <p> Translation: </p> 305 1.1 tron 306 1.1 tron <ul> 307 1.1 tron 308 1.1 tron <li> <p> Line 2: Send mail from this machine as "user (a] example.com", 309 1.1 tron so that no reason exists to send mail to "user (a] firewall.example.com". 310 1.1 tron </p> 311 1.1 tron 312 1.1 tron <li> <p> Lines 3-8: Disable local mail delivery on the firewall 313 1.1 tron machine. </p> 314 1.1 tron 315 1.1 tron </ul> 316 1.1 tron 317 1.1 tron <p> For the sake of technical correctness the firewall must be able 318 1.1 tron to receive mail for postmaster@[firewall ip address]. Reportedly, 319 1.1 tron some things actually expect this ability to exist. The second part 320 1.1 tron of the solution therefore adds support for postmaster@[firewall ip 321 1.1 tron address], and as a bonus we do abuse@[firewall ip address] as well. 322 1.1 tron All the mail to these two accounts is forwarded to an inside address. 323 1.1 tron </p> 324 1.1 tron 325 1.1 tron <blockquote> 326 1.1 tron <pre> 327 1.1 tron 1 /etc/postfix/main.cf: 328 1.1 tron 2 virtual_alias_maps = hash:/etc/postfix/virtual 329 1.1 tron 3 330 1.1 tron 4 /etc/postfix/virtual: 331 1.1 tron 5 postmaster postmaster (a] example.com 332 1.1 tron 6 abuse abuse (a] example.com 333 1.1 tron </pre> 334 1.1 tron </blockquote> 335 1.1 tron 336 1.1 tron <p> Translation: </p> 337 1.1 tron 338 1.1 tron <ul> 339 1.1 tron 340 1.1 tron <li> <p> Because mydestination is empty (see the previous example), 341 1.1 tron only address literals matching $inet_interfaces or $proxy_interfaces 342 1.1 tron are deemed local. So "localpart@[a.d.d.r]" can be matched as simply 343 1.1 tron "localpart" in canonical(5) and virtual(5). This avoids the need to 344 1.1.1.5 christos specify firewall IP addresses in Postfix configuration files. </p> 345 1.1 tron 346 1.1 tron </ul> 347 1.1 tron 348 1.1 tron <p> The last part of the solution does the email forwarding, which 349 1.1 tron is the real purpose of the firewall email function. </p> 350 1.1 tron 351 1.1 tron <blockquote> 352 1.1 tron <pre> 353 1.1 tron 1 /etc/postfix/main.cf: 354 1.1 tron 2 mynetworks = 127.0.0.0/8 12.34.56.0/24 355 1.1 tron 3 relay_domains = example.com 356 1.1 tron 4 parent_domain_matches_subdomains = 357 1.1 tron 5 debug_peer_list smtpd_access_maps 358 1.1.1.4 tron <br> 359 1.1.1.4 tron 6a # Postfix 2.10 and later support separate relay control and 360 1.1.1.4 tron 7a # spam control. 361 1.1.1.4 tron 8a smtpd_relay_restrictions = 362 1.1.1.4 tron 9a permit_mynetworks reject_unauth_destination 363 1.1.1.4 tron 10a smtpd_recipient_restrictions = ...spam blocking rules.... 364 1.1.1.4 tron <br> 365 1.1.1.4 tron 6b # Older configurations combine relay control and spam control. To 366 1.1.1.4 tron 7b # use this with Postfix ≥ 2.10 specify "smtpd_relay_restrictions=". 367 1.1.1.4 tron 8b smtpd_recipient_restrictions = 368 1.1.1.4 tron 9b permit_mynetworks reject_unauth_destination 369 1.1.1.4 tron 10b ...spam blocking rules.... 370 1.1.1.4 tron <br> 371 1.1.1.4 tron 11 relay_recipient_maps = hash:/etc/postfix/relay_recipients 372 1.1.1.4 tron 12 transport_maps = hash:/etc/postfix/transport 373 1.1.1.4 tron 13 374 1.1.1.4 tron 14 /etc/postfix/relay_recipients: 375 1.1.1.4 tron 15 user1 (a] example.com x 376 1.1.1.4 tron 16 user2 (a] example.com x 377 1.1.1.4 tron 17 . . . 378 1.1.1.4 tron 18 379 1.1.1.4 tron 19 /etc/postfix/transport: 380 1.1.1.4 tron 20 example.com smtp:[inside-gateway.example.com] 381 1.1 tron </pre> 382 1.1 tron </blockquote> 383 1.1 tron 384 1.1 tron <p> Translation: </p> 385 1.1 tron 386 1.1 tron <ul> 387 1.1.1.4 tron 388 1.1.1.4 tron <li><p> Lines 1-10: Accept mail from local systems in $mynetworks, 389 1.1 tron and accept mail from outside for "user (a] example.com" but not for 390 1.1 tron "user (a] anything.example.com". The magic is in lines 4-5. </p> 391 1.1 tron 392 1.1.1.4 tron <li> <p> Lines 11, 13-16: Define the list of valid addresses in the 393 1.1 tron "example.com" domain that can receive mail from the Internet. This 394 1.1 tron prevents the mail queue from filling up with undeliverable 395 1.1 tron MAILER-DAEMON messages. If you can't maintain a list of valid 396 1.1 tron recipients then you must specify "relay_recipient_maps =" (that 397 1.1 tron is, an empty value), or you must specify an "@example.com x" 398 1.1 tron wild-card in the relay_recipients table. </p> 399 1.1 tron 400 1.1.1.4 tron <li> <p> Lines 12, 19-20: Route mail for "example.com" to the inside 401 1.1 tron gateway machine. The <tt>[]</tt> forces Postfix to do no MX lookup. 402 1.1 tron </p> 403 1.1 tron 404 1.1 tron </ul> 405 1.1 tron 406 1.1 tron <p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses 407 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 408 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 409 1.1 tron 410 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/relay_recipients</b>" 411 1.1 tron whenever you change the relay_recipients table. </p> 412 1.1 tron 413 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/transport</b>" 414 1.1 tron whenever you change the transport table. </p> 415 1.1 tron 416 1.1 tron <p> In some installations, there may be separate instances of Postfix 417 1.1 tron processing inbound and outbound mail on a multi-homed firewall. The 418 1.1 tron inbound Postfix instance has an SMTP server listening on the external 419 1.1 tron firewall interface, and the outbound Postfix instance has an SMTP server 420 1.1 tron listening on the internal interface. In such a configuration is it is 421 1.1 tron tempting to configure $inet_interfaces in each instance with just the 422 1.1 tron corresponding interface address. </p> 423 1.1 tron 424 1.1 tron <p> In most cases, using inet_interfaces in this way will not work, 425 1.1 tron because as documented in the $inet_interfaces reference manual, the 426 1.1 tron smtp(8) delivery agent will also use the specified interface address 427 1.1 tron as the source address for outbound connections and will be unable to 428 1.1 tron reach hosts on "the other side" of the firewall. The symptoms are that 429 1.1 tron the firewall is unable to connect to hosts that are in fact up. See the 430 1.1 tron inet_interfaces parameter documentation for suggested work-arounds.</p> 431 1.1 tron 432 1.1 tron <h2><a name="some_local">Delivering some but not all accounts 433 1.1 tron locally</a></h2> 434 1.1 tron 435 1.1 tron <p> A drawback of sending mail as "user (a] example.com" (instead of 436 1.1 tron "user (a] hostname.example.com") is that mail for "root" and other 437 1.1 tron system accounts is also sent to the central mailhost. In order to 438 1.1 tron deliver such accounts locally, you can set up virtual aliases as 439 1.1 tron follows: </p> 440 1.1 tron 441 1.1 tron <blockquote> 442 1.1 tron <pre> 443 1.1 tron 1 /etc/postfix/main.cf: 444 1.1 tron 2 virtual_alias_maps = hash:/etc/postfix/virtual 445 1.1 tron 3 446 1.1 tron 4 /etc/postfix/virtual: 447 1.1 tron 5 root root@localhost 448 1.1 tron 6 . . . 449 1.1 tron </pre> 450 1.1 tron </blockquote> 451 1.1 tron 452 1.1 tron <p> Translation: </p> 453 1.1 tron 454 1.1 tron <ul> 455 1.1 tron 456 1.1 tron <li> <p> Line 5: As described in the virtual(5) manual page, the 457 1.1 tron bare name "root" matches "root@site" when "site" is equal to 458 1.1 tron $myorigin, when "site" is listed in $mydestination, or when it 459 1.1 tron matches $inet_interfaces or $proxy_interfaces. </p> 460 1.1 tron 461 1.1 tron </ul> 462 1.1 tron 463 1.1.1.2 tron <p> Execute the command "<b>postmap /etc/postfix/virtual</b>" after 464 1.1.1.3 tron editing the file. </p> 465 1.1.1.2 tron 466 1.1 tron <h2><a name="intranet">Running Postfix behind a firewall</a></h2> 467 1.1 tron 468 1.1 tron <p> The simplest way to set up Postfix on a host behind a firewalled 469 1.1 tron network is to send all mail to a gateway host, and to let that mail 470 1.1 tron host take care of internal and external forwarding. Examples of that 471 1.1 tron are shown in the <a href="#local_network">local area network</a> 472 1.1 tron section above. A more sophisticated approach is to send only external 473 1.1.1.3 tron mail to the gateway host, and to send intranet mail directly. </p> 474 1.1 tron 475 1.1 tron <p> Note: this example requires Postfix version 2.0 and later. To find 476 1.1 tron out what Postfix version you have, execute the command "<b>postconf 477 1.1 tron mail_version</b>". </p> 478 1.1 tron 479 1.1 tron <p> The following example presents additional configuration. You 480 1.1 tron need to combine this with basic configuration information as 481 1.1.1.5 christos discussed in the first half of this document. </p> 482 1.1 tron 483 1.1 tron <blockquote> 484 1.1 tron <pre> 485 1.1 tron 1 /etc/postfix/main.cf: 486 1.1 tron 2 transport_maps = hash:/etc/postfix/transport 487 1.1 tron 3 relayhost = 488 1.1 tron 4 # Optional for a machine that isn't "always on" 489 1.1 tron 5 #fallback_relay = [gateway.example.com] 490 1.1 tron 6 491 1.1 tron 7 /etc/postfix/transport: 492 1.1 tron 8 # Internal delivery. 493 1.1 tron 9 example.com : 494 1.1 tron 10 .example.com : 495 1.1 tron 11 # External delivery. 496 1.1 tron 12 * smtp:[gateway.example.com] 497 1.1 tron </pre> 498 1.1 tron </blockquote> 499 1.1 tron 500 1.1 tron <p> Translation: </p> 501 1.1 tron 502 1.1 tron <ul> 503 1.1 tron 504 1.1 tron <li> <p> Lines 2, 7-12: Request that intranet mail is delivered 505 1.1 tron directly, and that external mail is given to a gateway. Obviously, 506 1.1 tron this example assumes that the organization uses DNS MX records 507 1.1 tron internally. The <tt>[]</tt> forces Postfix to do no MX lookup. 508 1.1 tron </p> 509 1.1 tron 510 1.1 tron <li> <p> Line 3: IMPORTANT: do not specify a relayhost in main.cf. 511 1.1 tron </p> 512 1.1 tron 513 1.1 tron <li> <p> Line 5: This prevents mail from being stuck in the queue 514 1.1 tron when the machine is turned off. Postfix tries to deliver mail 515 1.1 tron directly, and gives undeliverable mail to a gateway. </p> 516 1.1 tron 517 1.1 tron </ul> 518 1.1 tron 519 1.1 tron <p> Specify <b>dbm</b> instead of <b>hash</b> if your system uses 520 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 521 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 522 1.1 tron 523 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/transport</b>" whenever 524 1.1 tron you edit the transport table. </p> 525 1.1 tron 526 1.1 tron <h2><a name="backup">Configuring Postfix as primary or backup MX host for a remote site</a></h2> 527 1.1 tron 528 1.1 tron <p> This section presents additional configuration. You need to 529 1.1.1.5 christos combine this with basic configuration information as discussed in the 530 1.1 tron first half of this document. </p> 531 1.1 tron 532 1.1 tron <p> When your system is SECONDARY MX host for a remote site this 533 1.1 tron is all you need: </p> 534 1.1 tron 535 1.1 tron <blockquote> 536 1.1 tron <pre> 537 1.1 tron 1 DNS: 538 1.1 tron 2 the.backed-up.domain.tld IN MX 100 your.machine.tld. 539 1.1 tron 3 540 1.1 tron 4 /etc/postfix/main.cf: 541 1.1 tron 5 relay_domains = . . . the.backed-up.domain.tld 542 1.1.1.4 tron <br> 543 1.1.1.4 tron 6a # Postfix 2.10 and later support separate relay control and 544 1.1.1.4 tron 7a # spam control. 545 1.1.1.4 tron 8a smtpd_relay_restrictions = 546 1.1.1.4 tron 9a permit_mynetworks reject_unauth_destination 547 1.1.1.4 tron 10a smtpd_recipient_restrictions = ...spam blocking rules.... 548 1.1.1.4 tron <br> 549 1.1.1.4 tron 6b # Older configurations combine relay control and spam control. To 550 1.1.1.4 tron 7b # use this with Postfix ≥ 2.10 specify "smtpd_relay_restrictions=". 551 1.1.1.4 tron 8b smtpd_recipient_restrictions = 552 1.1.1.4 tron 9b permit_mynetworks reject_unauth_destination 553 1.1.1.4 tron 10b ...spam blocking rules.... 554 1.1.1.4 tron <br> 555 1.1.1.4 tron 11 # You must specify your NAT/proxy external address. 556 1.1.1.4 tron 12 #proxy_interfaces = 1.2.3.4 557 1.1 tron 13 558 1.1.1.4 tron 14 relay_recipient_maps = hash:/etc/postfix/relay_recipients 559 1.1.1.4 tron 15 560 1.1.1.4 tron 16 /etc/postfix/relay_recipients: 561 1.1.1.4 tron 17 user1 (a] the.backed-up.domain.tld x 562 1.1.1.4 tron 18 user2 (a] the.backed-up.domain.tld x 563 1.1.1.4 tron 19 . . . 564 1.1 tron </pre> 565 1.1 tron </blockquote> 566 1.1 tron 567 1.1 tron <p> When your system is PRIMARY MX host for a remote site you 568 1.1 tron need the above, plus: </p> 569 1.1 tron 570 1.1 tron <blockquote> 571 1.1 tron <pre> 572 1.1.1.4 tron 20 /etc/postfix/main.cf: 573 1.1.1.4 tron 21 transport_maps = hash:/etc/postfix/transport 574 1.1.1.4 tron 22 575 1.1.1.4 tron 23 /etc/postfix/transport: 576 1.1.1.4 tron 24 the.backed-up.domain.tld relay:[their.mail.host.tld] 577 1.1 tron </pre> 578 1.1 tron </blockquote> 579 1.1 tron 580 1.1 tron <p> Important notes: 581 1.1 tron 582 1.1 tron <ul> 583 1.1 tron 584 1.1 tron <li><p>Do not list the.backed-up.domain.tld in mydestination.</p> 585 1.1 tron 586 1.1 tron <li><p>Do not list the.backed-up.domain.tld in virtual_alias_domains.</p> 587 1.1 tron 588 1.1 tron <li><p>Do not list the.backed-up.domain.tld in virtual_mailbox_domains.</p> 589 1.1 tron 590 1.1.1.4 tron <li> <p> Lines 1-9: Forward mail from the Internet for 591 1.1 tron "the.backed-up.domain.tld" to the primary MX host for that domain. 592 1.1 tron </p> 593 1.1 tron 594 1.1.1.4 tron <li> <p> Line 12: This is a must if Postfix receives mail via a 595 1.1 tron NAT relay or proxy that presents a different IP address to the 596 1.1 tron world than the local machine. </p> 597 1.1 tron 598 1.1.1.4 tron <li> <p> Lines 14-18: Define the list of valid addresses in the 599 1.1 tron "the.backed-up.domain.tld" domain. This prevents your mail queue 600 1.1 tron from filling up with undeliverable MAILER-DAEMON messages. If you 601 1.1 tron can't maintain a list of valid recipients then you must specify 602 1.1 tron "relay_recipient_maps =" (that is, an empty value), or you must 603 1.1 tron specify an "@the.backed-up.domain.tld x" wild-card in the 604 1.1 tron relay_recipients table. </p> 605 1.1 tron 606 1.1.1.4 tron <li> <p> Line 24: The <tt>[]</tt> forces Postfix to do no MX lookup. </p> 607 1.1 tron 608 1.1 tron </ul> 609 1.1 tron 610 1.1 tron <p> Specify <b>dbm</b> instead of <b>hash</b> if your system uses 611 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 612 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 613 1.1 tron 614 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/transport</b>" 615 1.1 tron whenever you change the transport table. </p> 616 1.1 tron 617 1.1 tron <p> NOTE for Postfix < 2.2: Do not use the fallback_relay feature 618 1.1 tron when relaying mail 619 1.1 tron for a backup or primary MX domain. Mail would loop between the 620 1.1 tron Postfix MX host and the fallback_relay host when the final destination 621 1.1 tron is unavailable. </p> 622 1.1 tron 623 1.1 tron <ul> 624 1.1 tron 625 1.1 tron <li> In main.cf specify "<tt>relay_transport = relay</tt>", 626 1.1 tron 627 1.1 tron <li> In master.cf specify "<tt>-o fallback_relay =</tt>" at the 628 1.1 tron end of the <tt>relay</tt> entry. 629 1.1 tron 630 1.1 tron <li> In transport maps, specify "<tt>relay:<i>nexthop...</i></tt>" 631 1.1 tron as the right-hand side for backup or primary MX domain entries. 632 1.1 tron 633 1.1 tron </ul> 634 1.1 tron 635 1.1 tron <p> These are default settings in Postfix version 2.2 and later. 636 1.1 tron </p> 637 1.1 tron 638 1.1 tron <h2><a name="dialup">Postfix on a dialup machine</a></h2> 639 1.1 tron 640 1.1 tron <p> This section applies to dialup connections that are down most 641 1.1 tron of the time. For dialup connections that are up 24x7, see the <a 642 1.1 tron href="#local_network">local area network</a> section above. </p> 643 1.1 tron 644 1.1 tron <p> This section presents additional configuration. You need to 645 1.1.1.5 christos combine this with basic configuration information as discussed in the 646 1.1 tron first half of this document. </p> 647 1.1 tron 648 1.1 tron <p> If you do not have your own hostname and IP address (usually 649 1.1 tron with dialup, cable TV or DSL connections) then you should also 650 1.1 tron study the section on "<a href="#fantasy">Postfix on hosts without 651 1.1 tron a real Internet hostname</a>". </p> 652 1.1 tron 653 1.1 tron <ul> 654 1.1 tron 655 1.1 tron <li> Route all outgoing mail to your network provider. 656 1.1 tron 657 1.1 tron <p> If your machine is disconnected most of the time, there isn't 658 1.1 tron a lot of opportunity for Postfix to deliver mail to hard-to-reach 659 1.1 tron corners of the Internet. It's better to give the mail to a machine 660 1.1 tron that is connected all the time. In the example below, the <tt>[]</tt> 661 1.1 tron prevents Postfix from trying to look up DNS MX records. </p> 662 1.1 tron 663 1.1 tron <pre> 664 1.1 tron /etc/postfix/main.cf: 665 1.1 tron relayhost = [smtprelay.someprovider.com] 666 1.1 tron </pre> 667 1.1 tron 668 1.1 tron <li> <p><a name="spontaneous_smtp">Disable spontaneous SMTP mail 669 1.1 tron delivery (if using on-demand dialup IP only).</a> </p> 670 1.1 tron 671 1.1 tron <p> Normally, Postfix attempts to deliver outbound mail at its convenience. 672 1.1 tron If your machine uses on-demand dialup IP, this causes your system 673 1.1 tron to place a telephone call whenever you submit new mail, and whenever 674 1.1 tron Postfix retries to deliver delayed mail. To prevent such telephone 675 1.1 tron calls from being placed, disable spontaneous SMTP mail deliveries. </p> 676 1.1 tron 677 1.1 tron <pre> 678 1.1 tron /etc/postfix/main.cf: 679 1.1 tron defer_transports = smtp (Only for on-demand dialup IP hosts) 680 1.1 tron </pre> 681 1.1 tron 682 1.1 tron <li> <p>Disable SMTP client DNS lookups (dialup LAN only).</p> 683 1.1 tron 684 1.1 tron <pre> 685 1.1 tron /etc/postfix/main.cf: 686 1.1 tron disable_dns_lookups = yes (Only for on-demand dialup IP hosts) 687 1.1 tron </pre> 688 1.1 tron 689 1.1 tron <li> Flush the mail queue whenever the Internet link is established. 690 1.1 tron 691 1.1 tron <p> Put the following command into your PPP or SLIP dialup scripts: </p> 692 1.1 tron 693 1.1 tron <pre> 694 1.1 tron /usr/sbin/sendmail -q (whenever the Internet link is up) 695 1.1 tron </pre> 696 1.1 tron 697 1.1 tron <p> The exact location of the Postfix sendmail command is system-specific. 698 1.1 tron Use the command "<b>postconf sendmail_path</b>" to find out where the 699 1.1 tron Postfix sendmail command is located on your machine. </p> 700 1.1 tron 701 1.1 tron <p> In order to find out if the mail queue is flushed, use something 702 1.1 tron like: </p> 703 1.1 tron 704 1.1 tron <pre> 705 1.1 tron #!/bin/sh 706 1.1 tron 707 1.1 tron # Start mail deliveries. 708 1.1 tron /usr/sbin/sendmail -q 709 1.1 tron 710 1.1 tron # Allow deliveries to start. 711 1.1 tron sleep 10 712 1.1 tron 713 1.1 tron # Loop until all messages have been tried at least once. 714 1.1 tron while mailq | grep '^[^ ]*\*' >/dev/null 715 1.1 tron do 716 1.1 tron sleep 10 717 1.1 tron done 718 1.1 tron </pre> 719 1.1 tron 720 1.1 tron <p> If you have disabled <a href="#spontaneous_smtp">spontaneous 721 1.1 tron SMTP mail delivery</a>, you also need to run the "<b>sendmail -q</b>" 722 1.1 tron command every now and then while the dialup link is up, so that 723 1.1 tron newly-posted mail is flushed from the queue. </p> 724 1.1 tron 725 1.1 tron </ul> 726 1.1 tron 727 1.1 tron <h2><a name="fantasy">Postfix on hosts without a real Internet 728 1.1 tron hostname</a></h2> 729 1.1 tron 730 1.1 tron <p> This section is for hosts that don't have their own Internet 731 1.1 tron hostname. Typically these are systems that get a dynamic IP address 732 1.1 tron via DHCP or via dialup. Postfix will let you send and receive mail 733 1.1 tron just fine between accounts on a machine with a fantasy name. However, 734 1.1 tron you cannot use a fantasy hostname in your email address when sending 735 1.1 tron mail into the Internet, because no-one would be able to reply to 736 1.1 tron your mail. In fact, more and more sites refuse mail addresses with 737 1.1 tron non-existent domain names. </p> 738 1.1 tron 739 1.1 tron <p> Note: the following information is Postfix version dependent. 740 1.1 tron To find out what Postfix version you have, execute the command 741 1.1 tron "<b>postconf mail_version</b>". </p> 742 1.1 tron 743 1.1 tron <h3>Solution 1: Postfix version 2.2 and later </h3> 744 1.1 tron 745 1.1 tron <p> Postfix 2.2 uses the generic(5) address mapping to replace 746 1.1 tron local fantasy email addresses by valid Internet addresses. This 747 1.1 tron mapping happens ONLY when mail leaves the machine; not when you 748 1.1 tron send mail between users on the same machine. </p> 749 1.1 tron 750 1.1 tron <p> The following example presents additional configuration. You 751 1.1 tron need to combine this with basic configuration information as 752 1.1.1.5 christos discussed in the first half of this document. </p> 753 1.1 tron 754 1.1 tron <blockquote> 755 1.1 tron <pre> 756 1.1 tron 1 /etc/postfix/main.cf: 757 1.1 tron 2 smtp_generic_maps = hash:/etc/postfix/generic 758 1.1 tron 3 759 1.1 tron 4 /etc/postfix/generic: 760 1.1 tron 5 his (a] localdomain.local hisaccount (a] hisisp.example 761 1.1 tron 6 her (a] localdomain.local heraccount (a] herisp.example 762 1.1 tron 7 @localdomain.local hisaccount+local (a] hisisp.example 763 1.1 tron </pre> 764 1.1 tron </blockquote> 765 1.1 tron 766 1.1 tron <p> When mail is sent to a remote host via SMTP: </p> 767 1.1 tron 768 1.1 tron <ul> 769 1.1 tron 770 1.1 tron <li> <p> Line 5 replaces <i>his (a] localdomain.local</i> by his ISP 771 1.1 tron mail address, </p> 772 1.1 tron 773 1.1 tron <li> <p> Line 6 replaces <i>her (a] localdomain.local</i> by her ISP 774 1.1 tron mail address, and </p> 775 1.1 tron 776 1.1 tron <li> <p> Line 7 replaces other local addresses by his ISP account, 777 1.1 tron with an address extension of +<i>local</i> (this example assumes 778 1.1 tron that the ISP supports "+" style address extensions). </p> 779 1.1 tron 780 1.1 tron </ul> 781 1.1 tron 782 1.1 tron <p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses 783 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 784 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 785 1.1 tron 786 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/generic</b>" 787 1.1 tron whenever you change the generic table. </p> 788 1.1 tron 789 1.1 tron <h3>Solution 2: Postfix version 2.1 and earlier </h3> 790 1.1 tron 791 1.1 tron <p> The solution with older Postfix systems is to use valid 792 1.1 tron Internet addresses where possible, and to let Postfix map valid 793 1.1 tron Internet addresses to local fantasy addresses. With this, you can 794 1.1 tron send mail to the Internet and to local fantasy addresses, including 795 1.1 tron mail to local fantasy addresses that don't have a valid Internet 796 1.1 tron address of their own.</p> 797 1.1 tron 798 1.1 tron <p> The following example presents additional configuration. You 799 1.1 tron need to combine this with basic configuration information as 800 1.1.1.5 christos discussed in the first half of this document. </p> 801 1.1 tron 802 1.1 tron <blockquote> 803 1.1 tron <pre> 804 1.1 tron 1 /etc/postfix/main.cf: 805 1.1 tron 2 myhostname = hostname.localdomain 806 1.1 tron 3 mydomain = localdomain 807 1.1 tron 4 808 1.1 tron 5 canonical_maps = hash:/etc/postfix/canonical 809 1.1 tron 6 810 1.1 tron 7 virtual_alias_maps = hash:/etc/postfix/virtual 811 1.1 tron 8 812 1.1 tron 9 /etc/postfix/canonical: 813 1.1 tron 10 your-login-name your-account (a] your-isp.com 814 1.1 tron 11 815 1.1 tron 12 /etc/postfix/virtual: 816 1.1 tron 13 your-account (a] your-isp.com your-login-name 817 1.1 tron </pre> 818 1.1 tron </blockquote> 819 1.1 tron 820 1.1 tron <p> Translation: </p> 821 1.1 tron 822 1.1 tron <ul> 823 1.1 tron 824 1.1 tron <li> <p> Lines 2-3: Substitute your fantasy hostname here. Do not 825 1.1 tron use a domain name that is already in use by real organizations 826 1.1 tron on the Internet. See RFC 2606 for examples of domain 827 1.1 tron names that are guaranteed not to be owned by anyone. </p> 828 1.1 tron 829 1.1 tron <li> <p> Lines 5, 9, 10: This provides the mapping from 830 1.1 tron "your-login-name (a] hostname.localdomain" to "your-account (a] your-isp.com". 831 1.1 tron This part is required. </p> 832 1.1 tron 833 1.1 tron <li> <p> Lines 7, 12, 13: Deliver mail for "your-account (a] your-isp.com" 834 1.1 tron locally, instead of sending it to the ISP. This part is not required 835 1.1 tron but is convenient. 836 1.1 tron 837 1.1 tron </ul> 838 1.1 tron 839 1.1 tron <p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses 840 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 841 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 842 1.1 tron 843 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/canonical</b>" 844 1.1 tron whenever you change the canonical table. </p> 845 1.1 tron 846 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/virtual</b>" 847 1.1 tron whenever you change the virtual table. </p> 848 1.1 tron 849 1.1 tron </body> 850 1.1 tron 851 1.1 tron </html> 852
Indexes created Sat Jun 27 00:24:51 UTC 2026