STANDARD_CONFIGURATION_README.html revision 1.1.1.6
1 1.1 tron <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 1.1 tron "http://www.w3.org/TR/html4/loose.dtd"> 3 1.1 tron 4 1.1 tron <html> 5 1.1 tron 6 1.1 tron <head> 7 1.1 tron 8 1.1 tron <title>Postfix Standard Configuration Examples</title> 9 1.1 tron 10 1.1.1.5 christos <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 11 1.1.1.6 christos <link rel='stylesheet' type='text/css' href='postfix-doc.css'> 12 1.1 tron 13 1.1 tron </head> 14 1.1 tron 15 1.1 tron <body> 16 1.1 tron 17 1.1 tron <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Standard Configuration Examples</h1> 18 1.1 tron 19 1.1 tron <hr> 20 1.1 tron 21 1.1 tron <h2>Purpose of this document</h2> 22 1.1 tron 23 1.1 tron <p> This document presents a number of typical Postfix configurations. 24 1.1 tron This document should be reviewed after you have followed the basic 25 1.1 tron configuration steps as described in the BASIC_CONFIGURATION_README 26 1.1 tron document. In particular, do not proceed here if you don't already 27 1.1 tron have Postfix working for local mail submission and for local mail 28 1.1 tron delivery. </p> 29 1.1 tron 30 1.1 tron <p> The first part of this document presents standard configurations 31 1.1 tron that each solve one specific problem. </p> 32 1.1 tron 33 1.1 tron <ul> 34 1.1 tron 35 1.1 tron <li><a href="#stand_alone">Postfix on a stand-alone Internet host</a> 36 1.1 tron 37 1.1 tron <li><a href="#null_client">Postfix on a null client</a> 38 1.1 tron 39 1.1 tron <li><a href="#local_network">Postfix on a local network</a> 40 1.1 tron 41 1.1 tron <li><a href="#firewall">Postfix email firewall/gateway</a> 42 1.1 tron 43 1.1 tron </ul> 44 1.1 tron 45 1.1 tron <p> The second part of this document presents additional configurations 46 1.1 tron for hosts in specific environments. </p> 47 1.1 tron 48 1.1 tron <ul> 49 1.1 tron 50 1.1 tron <li><a href="#some_local">Delivering some but not all accounts locally</a> 51 1.1 tron 52 1.1 tron <li><a href="#intranet">Running Postfix behind a firewall</a> 53 1.1 tron 54 1.1 tron <li><a href="#backup">Configuring Postfix as primary or backup MX host for a remote 55 1.1 tron site</a> 56 1.1 tron 57 1.1 tron <li><a href="#dialup">Postfix on a dialup machine</a> 58 1.1 tron 59 1.1 tron <li><a href="#fantasy">Postfix on hosts without a real 60 1.1 tron Internet hostname</a> 61 1.1 tron 62 1.1 tron </ul> 63 1.1 tron 64 1.1 tron <h2><a name="stand_alone">Postfix on a stand-alone Internet host</a></h2> 65 1.1 tron 66 1.1 tron <p> Postfix should work out of the box without change on a stand-alone 67 1.1 tron machine that has direct Internet access. At least, that is how 68 1.1 tron Postfix installs when you download the Postfix source code via 69 1.1 tron http://www.postfix.org/. </p> 70 1.1 tron 71 1.1 tron <p> You can use the command "<b>postconf -n</b>" to find out what 72 1.1 tron settings are overruled by your main.cf. Besides a few pathname 73 1.1 tron settings, few parameters should be set on a stand-alone box, beyond 74 1.1 tron what is covered in the BASIC_CONFIGURATION_README document: </p> 75 1.1 tron 76 1.1 tron <blockquote> 77 1.1 tron <pre> 78 1.1 tron /etc/postfix/main.cf: 79 1.1 tron # Optional: send mail as user@domainname instead of user@hostname. 80 1.1 tron #myorigin = $mydomain 81 1.1 tron 82 1.1 tron # Optional: specify NAT/proxy external address. 83 1.1 tron #proxy_interfaces = 1.2.3.4 84 1.1 tron 85 1.1 tron # Alternative 1: don't relay mail from other hosts. 86 1.1 tron mynetworks_style = host 87 1.1 tron relay_domains = 88 1.1 tron 89 1.1 tron # Alternative 2: relay mail from local clients only. 90 1.1 tron # mynetworks = 192.168.1.0/28 91 1.1 tron # relay_domains = 92 1.1 tron </pre> 93 1.1 tron </blockquote> 94 1.1 tron 95 1.1 tron <p> See also the section "<a href="#fantasy">Postfix on hosts without 96 1.1 tron a real Internet hostname</a>" if this is applicable to your configuration. 97 1.1 tron </p> 98 1.1 tron 99 1.1 tron <h2><a name="null_client">Postfix on a null client</a></h2> 100 1.1 tron 101 1.1 tron <p> A null client is a machine that can only send mail. It receives no 102 1.1 tron mail from the network, and it does not deliver any mail locally. A 103 1.1 tron null client typically uses POP, IMAP or NFS for mailbox access. </p> 104 1.1 tron 105 1.1 tron <p> In this example we assume that the Internet domain name is 106 1.1.1.4 tron "example.com" and that the machine is named "hostname.example.com". 107 1.1 tron As usual, the examples show only parameters that are not left at 108 1.1 tron their default settings. </p> 109 1.1 tron 110 1.1 tron <blockquote> 111 1.1 tron <pre> 112 1.1 tron 1 /etc/postfix/main.cf: 113 1.1.1.4 tron 2 myhostname = hostname.example.com 114 1.1.1.4 tron 3 myorigin = $mydomain 115 1.1.1.4 tron 4 relayhost = $mydomain 116 1.1.1.4 tron 5 inet_interfaces = loopback-only 117 1.1.1.4 tron 6 mydestination = 118 1.1 tron </pre> 119 1.1 tron </blockquote> 120 1.1 tron 121 1.1 tron <p> Translation: </p> 122 1.1 tron 123 1.1 tron <ul> 124 1.1 tron 125 1.1.1.4 tron <li> <p> Line 2: Set myhostname to hostname.example.com, in case 126 1.1.1.4 tron the machine name isn't set to a fully-qualified domain name (use 127 1.1.1.4 tron the command "postconf -d myhostname" to find out what the machine 128 1.1.1.4 tron name is). </p> 129 1.1.1.4 tron 130 1.1.1.4 tron <li> <p> Line 2: The myhostname value also provides the default 131 1.1.1.4 tron value for the mydomain parameter (here, "mydomain = example.com"). 132 1.1.1.4 tron </p> 133 1.1 tron 134 1.1.1.4 tron <li> <p> Line 3: Send mail as "user (a] example.com" (instead of 135 1.1.1.4 tron "user (a] hostname.example.com"), so that nothing ever has a reason 136 1.1.1.4 tron to send mail to "user (a] hostname.example.com". </p> 137 1.1.1.4 tron 138 1.1.1.4 tron <li> <p> Line 4: Forward all mail to the mail server that is 139 1.1 tron responsible for the "example.com" domain. This prevents mail from 140 1.1 tron getting stuck on the null client if it is turned off while some 141 1.1.1.4 tron remote destination is unreachable. Specify a real hostname 142 1.1.1.4 tron here if your "example.com" domain has no MX record. </p> 143 1.1 tron 144 1.1.1.4 tron <li> <p> Line 5: Do not accept mail from the network. </p> 145 1.1 tron 146 1.1.1.4 tron <li> <p> Line 6: Disable local mail delivery. All mail goes to 147 1.1.1.4 tron the mail server as specified in line 4. </p> 148 1.1 tron 149 1.1 tron </ul> 150 1.1 tron 151 1.1 tron <h2><a name="local_network">Postfix on a local network</a></h2> 152 1.1 tron 153 1.1 tron <p> This section describes a local area network environment of one 154 1.1 tron main server and multiple other systems that send and receive email. 155 1.1 tron As usual we assume that the Internet domain name is "example.com". 156 1.1 tron All systems are configured to send mail as "user (a] example.com", and 157 1.1 tron all systems receive mail for "user (a] hostname.example.com". The main 158 1.1 tron server also receives mail for "user (a] example.com". We call this 159 1.1 tron machine by the name of mailhost.example.com. </p> 160 1.1 tron 161 1.1 tron <p> A drawback of sending mail as "user (a] example.com" is that mail 162 1.1 tron for "root" and other system accounts is also sent to the central 163 1.1 tron mailhost. See the section "<a href="#some_local">Delivering some 164 1.1 tron but not all accounts locally</a>" below for possible solutions. 165 1.1 tron </p> 166 1.1 tron 167 1.1 tron <p> As usual, the examples show only parameters that are not left 168 1.1 tron at their default settings. </p> 169 1.1 tron 170 1.1 tron <p> First we present the non-mailhost configuration, because it is 171 1.1 tron the simpler one. This machine sends mail as "user (a] example.com" and 172 1.1.1.5 christos is the final destination for "user (a] hostname.example.com". </p> 173 1.1 tron 174 1.1 tron <blockquote> 175 1.1 tron <pre> 176 1.1 tron 1 /etc/postfix/main.cf: 177 1.1 tron 2 myorigin = $mydomain 178 1.1 tron 3 mynetworks = 127.0.0.0/8 10.0.0.0/24 179 1.1 tron 4 relay_domains = 180 1.1 tron 5 # Optional: forward all non-local mail to mailhost 181 1.1 tron 6 #relayhost = $mydomain 182 1.1 tron </pre> 183 1.1 tron </blockquote> 184 1.1 tron 185 1.1 tron <p> Translation: </p> 186 1.1 tron 187 1.1 tron <ul> 188 1.1 tron 189 1.1 tron <li> <p> Line 2: Send mail as "user (a] example.com". </p> 190 1.1 tron 191 1.1 tron <li> <p> Line 3: Specify the trusted networks. </p> 192 1.1 tron 193 1.1 tron <li> <p> Line 4: This host does not relay mail from untrusted networks. </p> 194 1.1 tron 195 1.1 tron <li> <p> Line 6: This is needed if no direct Internet access is 196 1.1 tron available. See also below, "<a href="#firewall">Postfix behind 197 1.1 tron a firewall</a>". </p> 198 1.1 tron 199 1.1 tron </ul> 200 1.1 tron 201 1.1 tron <p> Next we present the mailhost configuration. This machine sends 202 1.1.1.5 christos mail as "user (a] example.com" and is the final destination for 203 1.1 tron "user (a] hostname.example.com" as well as "user (a] example.com". </p> 204 1.1 tron 205 1.1 tron <blockquote> 206 1.1 tron <pre> 207 1.1 tron 1 DNS: 208 1.1 tron 2 example.com IN MX 10 mailhost.example.com. 209 1.1 tron 3 210 1.1 tron 4 /etc/postfix/main.cf: 211 1.1 tron 5 myorigin = $mydomain 212 1.1 tron 6 mydestination = $myhostname localhost.$mydomain localhost $mydomain 213 1.1 tron 7 mynetworks = 127.0.0.0/8 10.0.0.0/24 214 1.1 tron 8 relay_domains = 215 1.1 tron 9 # Optional: forward all non-local mail to firewall 216 1.1 tron 10 #relayhost = [firewall.example.com] 217 1.1 tron </pre> 218 1.1 tron </blockquote> 219 1.1 tron 220 1.1 tron <p> Translation: </p> 221 1.1 tron 222 1.1 tron <ul> 223 1.1 tron 224 1.1 tron <li> <p> Line 2: Send mail for the domain "example.com" to the 225 1.1 tron machine mailhost.example.com. Remember to specify the "." at the 226 1.1 tron end of the line. </p> 227 1.1 tron 228 1.1 tron <li> <p> Line 5: Send mail as "user (a] example.com". </p> 229 1.1 tron 230 1.1 tron <li> <p> Line 6: This host is the final mail destination for the 231 1.1 tron "example.com" domain, in addition to the names of the machine 232 1.1 tron itself. </p> 233 1.1 tron 234 1.1 tron <li> <p> Line 7: Specify the trusted networks. </p> 235 1.1 tron 236 1.1 tron <li> <p> Line 8: This host does not relay mail from untrusted networks. </p> 237 1.1 tron 238 1.1 tron <li> <p> Line 10: This is needed only when the mailhost has to 239 1.1 tron forward non-local mail via a mail server on a firewall. The 240 1.1 tron <tt>[]</tt> forces Postfix to do no MX record lookups. </p> 241 1.1 tron 242 1.1 tron </ul> 243 1.1 tron 244 1.1 tron <p> In an environment like this, users access their mailbox in one 245 1.1 tron or more of the following ways: 246 1.1 tron 247 1.1 tron <ul> 248 1.1 tron 249 1.1 tron <li> <p> Mailbox access via NFS or equivalent. </p> 250 1.1 tron 251 1.1 tron <li> <p> Mailbox access via POP or IMAP. </p> 252 1.1 tron 253 1.1 tron <li> <p> Mailbox on the user's preferred machine. </p> 254 1.1 tron 255 1.1 tron </ul> 256 1.1 tron 257 1.1 tron <p> In the latter case, each user has an alias on the mailhost that 258 1.1 tron forwards mail to her preferred machine: </p> 259 1.1 tron 260 1.1 tron <blockquote> 261 1.1 tron <pre> 262 1.1 tron /etc/aliases: 263 1.1 tron joe: joe (a] joes.preferred.machine 264 1.1 tron jane: jane (a] janes.preferred.machine 265 1.1 tron </pre> 266 1.1 tron </blockquote> 267 1.1 tron 268 1.1 tron <p> On some systems the alias database is not in /etc/aliases. To 269 1.1 tron find out the location for your system, execute the command "<b>postconf 270 1.1 tron alias_maps</b>". </p> 271 1.1 tron 272 1.1 tron <p> Execute the command "<b>newaliases</b>" whenever you change 273 1.1 tron the aliases file. </p> 274 1.1 tron 275 1.1 tron <h2><a name="firewall">Postfix email firewall/gateway</a></h2> 276 1.1 tron 277 1.1 tron <p> The idea is to set up a Postfix email firewall/gateway that 278 1.1 tron forwards mail for "example.com" to an inside gateway machine but 279 1.1 tron rejects mail for "anything.example.com". There is only one problem: 280 1.1 tron with "relay_domains = example.com", the firewall normally also 281 1.1 tron accepts mail for "anything.example.com". That would not be right. 282 1.1 tron </p> 283 1.1 tron 284 1.1 tron <p> Note: this example requires Postfix version 2.0 and later. To find 285 1.1 tron out what Postfix version you have, execute the command "<b>postconf 286 1.1 tron mail_version</b>". </p> 287 1.1 tron 288 1.1 tron <p> The solution is presented in multiple parts. This first part 289 1.1 tron gets rid of local mail delivery on the firewall, making the firewall 290 1.1 tron harder to break. </p> 291 1.1 tron 292 1.1 tron <blockquote> 293 1.1 tron <pre> 294 1.1 tron 1 /etc/postfix/main.cf: 295 1.1 tron 2 myorigin = example.com 296 1.1 tron 3 mydestination = 297 1.1 tron 4 local_recipient_maps = 298 1.1 tron 5 local_transport = error:local mail delivery is disabled 299 1.1 tron 6 300 1.1 tron 7 /etc/postfix/master.cf: 301 1.1 tron 8 Comment out the local delivery agent 302 1.1 tron </pre> 303 1.1 tron </blockquote> 304 1.1 tron 305 1.1 tron <p> Translation: </p> 306 1.1 tron 307 1.1 tron <ul> 308 1.1 tron 309 1.1 tron <li> <p> Line 2: Send mail from this machine as "user (a] example.com", 310 1.1 tron so that no reason exists to send mail to "user (a] firewall.example.com". 311 1.1 tron </p> 312 1.1 tron 313 1.1 tron <li> <p> Lines 3-8: Disable local mail delivery on the firewall 314 1.1 tron machine. </p> 315 1.1 tron 316 1.1 tron </ul> 317 1.1 tron 318 1.1 tron <p> For the sake of technical correctness the firewall must be able 319 1.1 tron to receive mail for postmaster@[firewall ip address]. Reportedly, 320 1.1 tron some things actually expect this ability to exist. The second part 321 1.1 tron of the solution therefore adds support for postmaster@[firewall ip 322 1.1 tron address], and as a bonus we do abuse@[firewall ip address] as well. 323 1.1 tron All the mail to these two accounts is forwarded to an inside address. 324 1.1 tron </p> 325 1.1 tron 326 1.1 tron <blockquote> 327 1.1 tron <pre> 328 1.1 tron 1 /etc/postfix/main.cf: 329 1.1 tron 2 virtual_alias_maps = hash:/etc/postfix/virtual 330 1.1 tron 3 331 1.1 tron 4 /etc/postfix/virtual: 332 1.1 tron 5 postmaster postmaster (a] example.com 333 1.1 tron 6 abuse abuse (a] example.com 334 1.1 tron </pre> 335 1.1 tron </blockquote> 336 1.1 tron 337 1.1 tron <p> Translation: </p> 338 1.1 tron 339 1.1 tron <ul> 340 1.1 tron 341 1.1 tron <li> <p> Because mydestination is empty (see the previous example), 342 1.1 tron only address literals matching $inet_interfaces or $proxy_interfaces 343 1.1 tron are deemed local. So "localpart@[a.d.d.r]" can be matched as simply 344 1.1 tron "localpart" in canonical(5) and virtual(5). This avoids the need to 345 1.1.1.5 christos specify firewall IP addresses in Postfix configuration files. </p> 346 1.1 tron 347 1.1 tron </ul> 348 1.1 tron 349 1.1 tron <p> The last part of the solution does the email forwarding, which 350 1.1 tron is the real purpose of the firewall email function. </p> 351 1.1 tron 352 1.1 tron <blockquote> 353 1.1 tron <pre> 354 1.1 tron 1 /etc/postfix/main.cf: 355 1.1 tron 2 mynetworks = 127.0.0.0/8 12.34.56.0/24 356 1.1 tron 3 relay_domains = example.com 357 1.1 tron 4 parent_domain_matches_subdomains = 358 1.1 tron 5 debug_peer_list smtpd_access_maps 359 1.1.1.4 tron <br> 360 1.1.1.4 tron 6a # Postfix 2.10 and later support separate relay control and 361 1.1.1.4 tron 7a # spam control. 362 1.1.1.4 tron 8a smtpd_relay_restrictions = 363 1.1.1.4 tron 9a permit_mynetworks reject_unauth_destination 364 1.1.1.4 tron 10a smtpd_recipient_restrictions = ...spam blocking rules.... 365 1.1.1.4 tron <br> 366 1.1.1.4 tron 6b # Older configurations combine relay control and spam control. To 367 1.1.1.4 tron 7b # use this with Postfix ≥ 2.10 specify "smtpd_relay_restrictions=". 368 1.1.1.4 tron 8b smtpd_recipient_restrictions = 369 1.1.1.4 tron 9b permit_mynetworks reject_unauth_destination 370 1.1.1.4 tron 10b ...spam blocking rules.... 371 1.1.1.4 tron <br> 372 1.1.1.4 tron 11 relay_recipient_maps = hash:/etc/postfix/relay_recipients 373 1.1.1.4 tron 12 transport_maps = hash:/etc/postfix/transport 374 1.1.1.4 tron 13 375 1.1.1.4 tron 14 /etc/postfix/relay_recipients: 376 1.1.1.4 tron 15 user1 (a] example.com x 377 1.1.1.4 tron 16 user2 (a] example.com x 378 1.1.1.4 tron 17 . . . 379 1.1.1.4 tron 18 380 1.1.1.4 tron 19 /etc/postfix/transport: 381 1.1.1.6 christos 20 example.com relay:[inside-gateway.example.com] 382 1.1 tron </pre> 383 1.1 tron </blockquote> 384 1.1 tron 385 1.1 tron <p> Translation: </p> 386 1.1 tron 387 1.1 tron <ul> 388 1.1.1.4 tron 389 1.1.1.4 tron <li><p> Lines 1-10: Accept mail from local systems in $mynetworks, 390 1.1 tron and accept mail from outside for "user (a] example.com" but not for 391 1.1 tron "user (a] anything.example.com". The magic is in lines 4-5. </p> 392 1.1 tron 393 1.1.1.4 tron <li> <p> Lines 11, 13-16: Define the list of valid addresses in the 394 1.1 tron "example.com" domain that can receive mail from the Internet. This 395 1.1 tron prevents the mail queue from filling up with undeliverable 396 1.1 tron MAILER-DAEMON messages. If you can't maintain a list of valid 397 1.1 tron recipients then you must specify "relay_recipient_maps =" (that 398 1.1 tron is, an empty value), or you must specify an "@example.com x" 399 1.1 tron wild-card in the relay_recipients table. </p> 400 1.1 tron 401 1.1.1.4 tron <li> <p> Lines 12, 19-20: Route mail for "example.com" to the inside 402 1.1 tron gateway machine. The <tt>[]</tt> forces Postfix to do no MX lookup. 403 1.1.1.6 christos This uses the "relay" delivery transport (a copy of the default 404 1.1.1.6 christos "smtp" delivery transport) to forward inbound mail. This can improve 405 1.1.1.6 christos performance of deliveries to internal domains because they will 406 1.1.1.6 christos compete for SMTP clients from the "relay" delivery transport, instead 407 1.1.1.6 christos of competing with other SMTP deliveries for SMTP clients from the 408 1.1.1.6 christos default "smtp" delivery transport. </p> 409 1.1 tron 410 1.1 tron </ul> 411 1.1 tron 412 1.1 tron <p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses 413 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 414 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 415 1.1 tron 416 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/relay_recipients</b>" 417 1.1 tron whenever you change the relay_recipients table. </p> 418 1.1 tron 419 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/transport</b>" 420 1.1 tron whenever you change the transport table. </p> 421 1.1 tron 422 1.1 tron <p> In some installations, there may be separate instances of Postfix 423 1.1 tron processing inbound and outbound mail on a multi-homed firewall. The 424 1.1 tron inbound Postfix instance has an SMTP server listening on the external 425 1.1 tron firewall interface, and the outbound Postfix instance has an SMTP server 426 1.1 tron listening on the internal interface. In such a configuration is it is 427 1.1 tron tempting to configure $inet_interfaces in each instance with just the 428 1.1 tron corresponding interface address. </p> 429 1.1 tron 430 1.1 tron <p> In most cases, using inet_interfaces in this way will not work, 431 1.1 tron because as documented in the $inet_interfaces reference manual, the 432 1.1 tron smtp(8) delivery agent will also use the specified interface address 433 1.1 tron as the source address for outbound connections and will be unable to 434 1.1 tron reach hosts on "the other side" of the firewall. The symptoms are that 435 1.1 tron the firewall is unable to connect to hosts that are in fact up. See the 436 1.1 tron inet_interfaces parameter documentation for suggested work-arounds.</p> 437 1.1 tron 438 1.1 tron <h2><a name="some_local">Delivering some but not all accounts 439 1.1 tron locally</a></h2> 440 1.1 tron 441 1.1 tron <p> A drawback of sending mail as "user (a] example.com" (instead of 442 1.1 tron "user (a] hostname.example.com") is that mail for "root" and other 443 1.1 tron system accounts is also sent to the central mailhost. In order to 444 1.1 tron deliver such accounts locally, you can set up virtual aliases as 445 1.1 tron follows: </p> 446 1.1 tron 447 1.1 tron <blockquote> 448 1.1 tron <pre> 449 1.1 tron 1 /etc/postfix/main.cf: 450 1.1 tron 2 virtual_alias_maps = hash:/etc/postfix/virtual 451 1.1 tron 3 452 1.1 tron 4 /etc/postfix/virtual: 453 1.1 tron 5 root root@localhost 454 1.1 tron 6 . . . 455 1.1 tron </pre> 456 1.1 tron </blockquote> 457 1.1 tron 458 1.1 tron <p> Translation: </p> 459 1.1 tron 460 1.1 tron <ul> 461 1.1 tron 462 1.1 tron <li> <p> Line 5: As described in the virtual(5) manual page, the 463 1.1 tron bare name "root" matches "root@site" when "site" is equal to 464 1.1 tron $myorigin, when "site" is listed in $mydestination, or when it 465 1.1 tron matches $inet_interfaces or $proxy_interfaces. </p> 466 1.1 tron 467 1.1 tron </ul> 468 1.1 tron 469 1.1.1.2 tron <p> Execute the command "<b>postmap /etc/postfix/virtual</b>" after 470 1.1.1.3 tron editing the file. </p> 471 1.1.1.2 tron 472 1.1 tron <h2><a name="intranet">Running Postfix behind a firewall</a></h2> 473 1.1 tron 474 1.1 tron <p> The simplest way to set up Postfix on a host behind a firewalled 475 1.1 tron network is to send all mail to a gateway host, and to let that mail 476 1.1 tron host take care of internal and external forwarding. Examples of that 477 1.1 tron are shown in the <a href="#local_network">local area network</a> 478 1.1 tron section above. A more sophisticated approach is to send only external 479 1.1.1.3 tron mail to the gateway host, and to send intranet mail directly. </p> 480 1.1 tron 481 1.1 tron <p> Note: this example requires Postfix version 2.0 and later. To find 482 1.1 tron out what Postfix version you have, execute the command "<b>postconf 483 1.1 tron mail_version</b>". </p> 484 1.1 tron 485 1.1 tron <p> The following example presents additional configuration. You 486 1.1 tron need to combine this with basic configuration information as 487 1.1.1.5 christos discussed in the first half of this document. </p> 488 1.1 tron 489 1.1 tron <blockquote> 490 1.1 tron <pre> 491 1.1 tron 1 /etc/postfix/main.cf: 492 1.1 tron 2 transport_maps = hash:/etc/postfix/transport 493 1.1 tron 3 relayhost = 494 1.1 tron 4 # Optional for a machine that isn't "always on" 495 1.1 tron 5 #fallback_relay = [gateway.example.com] 496 1.1 tron 6 497 1.1 tron 7 /etc/postfix/transport: 498 1.1 tron 8 # Internal delivery. 499 1.1 tron 9 example.com : 500 1.1 tron 10 .example.com : 501 1.1 tron 11 # External delivery. 502 1.1 tron 12 * smtp:[gateway.example.com] 503 1.1 tron </pre> 504 1.1 tron </blockquote> 505 1.1 tron 506 1.1 tron <p> Translation: </p> 507 1.1 tron 508 1.1 tron <ul> 509 1.1 tron 510 1.1 tron <li> <p> Lines 2, 7-12: Request that intranet mail is delivered 511 1.1 tron directly, and that external mail is given to a gateway. Obviously, 512 1.1 tron this example assumes that the organization uses DNS MX records 513 1.1 tron internally. The <tt>[]</tt> forces Postfix to do no MX lookup. 514 1.1 tron </p> 515 1.1 tron 516 1.1 tron <li> <p> Line 3: IMPORTANT: do not specify a relayhost in main.cf. 517 1.1 tron </p> 518 1.1 tron 519 1.1 tron <li> <p> Line 5: This prevents mail from being stuck in the queue 520 1.1 tron when the machine is turned off. Postfix tries to deliver mail 521 1.1 tron directly, and gives undeliverable mail to a gateway. </p> 522 1.1 tron 523 1.1 tron </ul> 524 1.1 tron 525 1.1 tron <p> Specify <b>dbm</b> instead of <b>hash</b> if your system uses 526 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 527 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 528 1.1 tron 529 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/transport</b>" whenever 530 1.1 tron you edit the transport table. </p> 531 1.1 tron 532 1.1 tron <h2><a name="backup">Configuring Postfix as primary or backup MX host for a remote site</a></h2> 533 1.1 tron 534 1.1 tron <p> This section presents additional configuration. You need to 535 1.1.1.5 christos combine this with basic configuration information as discussed in the 536 1.1 tron first half of this document. </p> 537 1.1 tron 538 1.1 tron <p> When your system is SECONDARY MX host for a remote site this 539 1.1 tron is all you need: </p> 540 1.1 tron 541 1.1 tron <blockquote> 542 1.1 tron <pre> 543 1.1 tron 1 DNS: 544 1.1 tron 2 the.backed-up.domain.tld IN MX 100 your.machine.tld. 545 1.1 tron 3 546 1.1 tron 4 /etc/postfix/main.cf: 547 1.1 tron 5 relay_domains = . . . the.backed-up.domain.tld 548 1.1.1.4 tron <br> 549 1.1.1.4 tron 6a # Postfix 2.10 and later support separate relay control and 550 1.1.1.4 tron 7a # spam control. 551 1.1.1.4 tron 8a smtpd_relay_restrictions = 552 1.1.1.4 tron 9a permit_mynetworks reject_unauth_destination 553 1.1.1.4 tron 10a smtpd_recipient_restrictions = ...spam blocking rules.... 554 1.1.1.4 tron <br> 555 1.1.1.4 tron 6b # Older configurations combine relay control and spam control. To 556 1.1.1.4 tron 7b # use this with Postfix ≥ 2.10 specify "smtpd_relay_restrictions=". 557 1.1.1.4 tron 8b smtpd_recipient_restrictions = 558 1.1.1.4 tron 9b permit_mynetworks reject_unauth_destination 559 1.1.1.4 tron 10b ...spam blocking rules.... 560 1.1.1.4 tron <br> 561 1.1.1.4 tron 11 # You must specify your NAT/proxy external address. 562 1.1.1.4 tron 12 #proxy_interfaces = 1.2.3.4 563 1.1 tron 13 564 1.1.1.4 tron 14 relay_recipient_maps = hash:/etc/postfix/relay_recipients 565 1.1.1.4 tron 15 566 1.1.1.4 tron 16 /etc/postfix/relay_recipients: 567 1.1.1.4 tron 17 user1 (a] the.backed-up.domain.tld x 568 1.1.1.4 tron 18 user2 (a] the.backed-up.domain.tld x 569 1.1.1.4 tron 19 . . . 570 1.1 tron </pre> 571 1.1 tron </blockquote> 572 1.1 tron 573 1.1 tron <p> When your system is PRIMARY MX host for a remote site you 574 1.1 tron need the above, plus: </p> 575 1.1 tron 576 1.1 tron <blockquote> 577 1.1 tron <pre> 578 1.1.1.4 tron 20 /etc/postfix/main.cf: 579 1.1.1.4 tron 21 transport_maps = hash:/etc/postfix/transport 580 1.1.1.4 tron 22 581 1.1.1.4 tron 23 /etc/postfix/transport: 582 1.1.1.4 tron 24 the.backed-up.domain.tld relay:[their.mail.host.tld] 583 1.1 tron </pre> 584 1.1 tron </blockquote> 585 1.1 tron 586 1.1 tron <p> Important notes: 587 1.1 tron 588 1.1 tron <ul> 589 1.1 tron 590 1.1 tron <li><p>Do not list the.backed-up.domain.tld in mydestination.</p> 591 1.1 tron 592 1.1 tron <li><p>Do not list the.backed-up.domain.tld in virtual_alias_domains.</p> 593 1.1 tron 594 1.1 tron <li><p>Do not list the.backed-up.domain.tld in virtual_mailbox_domains.</p> 595 1.1 tron 596 1.1.1.4 tron <li> <p> Lines 1-9: Forward mail from the Internet for 597 1.1 tron "the.backed-up.domain.tld" to the primary MX host for that domain. 598 1.1 tron </p> 599 1.1 tron 600 1.1.1.4 tron <li> <p> Line 12: This is a must if Postfix receives mail via a 601 1.1 tron NAT relay or proxy that presents a different IP address to the 602 1.1 tron world than the local machine. </p> 603 1.1 tron 604 1.1.1.4 tron <li> <p> Lines 14-18: Define the list of valid addresses in the 605 1.1 tron "the.backed-up.domain.tld" domain. This prevents your mail queue 606 1.1 tron from filling up with undeliverable MAILER-DAEMON messages. If you 607 1.1 tron can't maintain a list of valid recipients then you must specify 608 1.1 tron "relay_recipient_maps =" (that is, an empty value), or you must 609 1.1 tron specify an "@the.backed-up.domain.tld x" wild-card in the 610 1.1 tron relay_recipients table. </p> 611 1.1 tron 612 1.1.1.4 tron <li> <p> Line 24: The <tt>[]</tt> forces Postfix to do no MX lookup. </p> 613 1.1 tron 614 1.1 tron </ul> 615 1.1 tron 616 1.1 tron <p> Specify <b>dbm</b> instead of <b>hash</b> if your system uses 617 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 618 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 619 1.1 tron 620 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/transport</b>" 621 1.1 tron whenever you change the transport table. </p> 622 1.1 tron 623 1.1 tron <p> NOTE for Postfix < 2.2: Do not use the fallback_relay feature 624 1.1 tron when relaying mail 625 1.1 tron for a backup or primary MX domain. Mail would loop between the 626 1.1 tron Postfix MX host and the fallback_relay host when the final destination 627 1.1 tron is unavailable. </p> 628 1.1 tron 629 1.1 tron <ul> 630 1.1 tron 631 1.1 tron <li> In main.cf specify "<tt>relay_transport = relay</tt>", 632 1.1 tron 633 1.1 tron <li> In master.cf specify "<tt>-o fallback_relay =</tt>" at the 634 1.1 tron end of the <tt>relay</tt> entry. 635 1.1 tron 636 1.1 tron <li> In transport maps, specify "<tt>relay:<i>nexthop...</i></tt>" 637 1.1 tron as the right-hand side for backup or primary MX domain entries. 638 1.1 tron 639 1.1 tron </ul> 640 1.1 tron 641 1.1 tron <p> These are default settings in Postfix version 2.2 and later. 642 1.1 tron </p> 643 1.1 tron 644 1.1 tron <h2><a name="dialup">Postfix on a dialup machine</a></h2> 645 1.1 tron 646 1.1 tron <p> This section applies to dialup connections that are down most 647 1.1 tron of the time. For dialup connections that are up 24x7, see the <a 648 1.1 tron href="#local_network">local area network</a> section above. </p> 649 1.1 tron 650 1.1 tron <p> This section presents additional configuration. You need to 651 1.1.1.5 christos combine this with basic configuration information as discussed in the 652 1.1 tron first half of this document. </p> 653 1.1 tron 654 1.1 tron <p> If you do not have your own hostname and IP address (usually 655 1.1 tron with dialup, cable TV or DSL connections) then you should also 656 1.1 tron study the section on "<a href="#fantasy">Postfix on hosts without 657 1.1 tron a real Internet hostname</a>". </p> 658 1.1 tron 659 1.1 tron <ul> 660 1.1 tron 661 1.1 tron <li> Route all outgoing mail to your network provider. 662 1.1 tron 663 1.1 tron <p> If your machine is disconnected most of the time, there isn't 664 1.1 tron a lot of opportunity for Postfix to deliver mail to hard-to-reach 665 1.1 tron corners of the Internet. It's better to give the mail to a machine 666 1.1 tron that is connected all the time. In the example below, the <tt>[]</tt> 667 1.1 tron prevents Postfix from trying to look up DNS MX records. </p> 668 1.1 tron 669 1.1 tron <pre> 670 1.1 tron /etc/postfix/main.cf: 671 1.1 tron relayhost = [smtprelay.someprovider.com] 672 1.1 tron </pre> 673 1.1 tron 674 1.1 tron <li> <p><a name="spontaneous_smtp">Disable spontaneous SMTP mail 675 1.1 tron delivery (if using on-demand dialup IP only).</a> </p> 676 1.1 tron 677 1.1 tron <p> Normally, Postfix attempts to deliver outbound mail at its convenience. 678 1.1 tron If your machine uses on-demand dialup IP, this causes your system 679 1.1 tron to place a telephone call whenever you submit new mail, and whenever 680 1.1 tron Postfix retries to deliver delayed mail. To prevent such telephone 681 1.1 tron calls from being placed, disable spontaneous SMTP mail deliveries. </p> 682 1.1 tron 683 1.1 tron <pre> 684 1.1 tron /etc/postfix/main.cf: 685 1.1 tron defer_transports = smtp (Only for on-demand dialup IP hosts) 686 1.1 tron </pre> 687 1.1 tron 688 1.1 tron <li> <p>Disable SMTP client DNS lookups (dialup LAN only).</p> 689 1.1 tron 690 1.1 tron <pre> 691 1.1 tron /etc/postfix/main.cf: 692 1.1 tron disable_dns_lookups = yes (Only for on-demand dialup IP hosts) 693 1.1 tron </pre> 694 1.1 tron 695 1.1 tron <li> Flush the mail queue whenever the Internet link is established. 696 1.1 tron 697 1.1 tron <p> Put the following command into your PPP or SLIP dialup scripts: </p> 698 1.1 tron 699 1.1 tron <pre> 700 1.1 tron /usr/sbin/sendmail -q (whenever the Internet link is up) 701 1.1 tron </pre> 702 1.1 tron 703 1.1 tron <p> The exact location of the Postfix sendmail command is system-specific. 704 1.1 tron Use the command "<b>postconf sendmail_path</b>" to find out where the 705 1.1 tron Postfix sendmail command is located on your machine. </p> 706 1.1 tron 707 1.1 tron <p> In order to find out if the mail queue is flushed, use something 708 1.1 tron like: </p> 709 1.1 tron 710 1.1 tron <pre> 711 1.1 tron #!/bin/sh 712 1.1 tron 713 1.1 tron # Start mail deliveries. 714 1.1 tron /usr/sbin/sendmail -q 715 1.1 tron 716 1.1 tron # Allow deliveries to start. 717 1.1 tron sleep 10 718 1.1 tron 719 1.1 tron # Loop until all messages have been tried at least once. 720 1.1 tron while mailq | grep '^[^ ]*\*' >/dev/null 721 1.1 tron do 722 1.1 tron sleep 10 723 1.1 tron done 724 1.1 tron </pre> 725 1.1 tron 726 1.1 tron <p> If you have disabled <a href="#spontaneous_smtp">spontaneous 727 1.1 tron SMTP mail delivery</a>, you also need to run the "<b>sendmail -q</b>" 728 1.1 tron command every now and then while the dialup link is up, so that 729 1.1 tron newly-posted mail is flushed from the queue. </p> 730 1.1 tron 731 1.1 tron </ul> 732 1.1 tron 733 1.1 tron <h2><a name="fantasy">Postfix on hosts without a real Internet 734 1.1 tron hostname</a></h2> 735 1.1 tron 736 1.1 tron <p> This section is for hosts that don't have their own Internet 737 1.1 tron hostname. Typically these are systems that get a dynamic IP address 738 1.1 tron via DHCP or via dialup. Postfix will let you send and receive mail 739 1.1 tron just fine between accounts on a machine with a fantasy name. However, 740 1.1 tron you cannot use a fantasy hostname in your email address when sending 741 1.1 tron mail into the Internet, because no-one would be able to reply to 742 1.1 tron your mail. In fact, more and more sites refuse mail addresses with 743 1.1 tron non-existent domain names. </p> 744 1.1 tron 745 1.1 tron <p> Note: the following information is Postfix version dependent. 746 1.1 tron To find out what Postfix version you have, execute the command 747 1.1 tron "<b>postconf mail_version</b>". </p> 748 1.1 tron 749 1.1 tron <h3>Solution 1: Postfix version 2.2 and later </h3> 750 1.1 tron 751 1.1 tron <p> Postfix 2.2 uses the generic(5) address mapping to replace 752 1.1 tron local fantasy email addresses by valid Internet addresses. This 753 1.1 tron mapping happens ONLY when mail leaves the machine; not when you 754 1.1 tron send mail between users on the same machine. </p> 755 1.1 tron 756 1.1 tron <p> The following example presents additional configuration. You 757 1.1 tron need to combine this with basic configuration information as 758 1.1.1.5 christos discussed in the first half of this document. </p> 759 1.1 tron 760 1.1 tron <blockquote> 761 1.1 tron <pre> 762 1.1 tron 1 /etc/postfix/main.cf: 763 1.1 tron 2 smtp_generic_maps = hash:/etc/postfix/generic 764 1.1 tron 3 765 1.1 tron 4 /etc/postfix/generic: 766 1.1 tron 5 his (a] localdomain.local hisaccount (a] hisisp.example 767 1.1 tron 6 her (a] localdomain.local heraccount (a] herisp.example 768 1.1 tron 7 @localdomain.local hisaccount+local (a] hisisp.example 769 1.1 tron </pre> 770 1.1 tron </blockquote> 771 1.1 tron 772 1.1 tron <p> When mail is sent to a remote host via SMTP: </p> 773 1.1 tron 774 1.1 tron <ul> 775 1.1 tron 776 1.1 tron <li> <p> Line 5 replaces <i>his (a] localdomain.local</i> by his ISP 777 1.1 tron mail address, </p> 778 1.1 tron 779 1.1 tron <li> <p> Line 6 replaces <i>her (a] localdomain.local</i> by her ISP 780 1.1 tron mail address, and </p> 781 1.1 tron 782 1.1 tron <li> <p> Line 7 replaces other local addresses by his ISP account, 783 1.1 tron with an address extension of +<i>local</i> (this example assumes 784 1.1 tron that the ISP supports "+" style address extensions). </p> 785 1.1 tron 786 1.1 tron </ul> 787 1.1 tron 788 1.1 tron <p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses 789 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 790 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 791 1.1 tron 792 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/generic</b>" 793 1.1 tron whenever you change the generic table. </p> 794 1.1 tron 795 1.1 tron <h3>Solution 2: Postfix version 2.1 and earlier </h3> 796 1.1 tron 797 1.1 tron <p> The solution with older Postfix systems is to use valid 798 1.1 tron Internet addresses where possible, and to let Postfix map valid 799 1.1 tron Internet addresses to local fantasy addresses. With this, you can 800 1.1 tron send mail to the Internet and to local fantasy addresses, including 801 1.1 tron mail to local fantasy addresses that don't have a valid Internet 802 1.1 tron address of their own.</p> 803 1.1 tron 804 1.1 tron <p> The following example presents additional configuration. You 805 1.1 tron need to combine this with basic configuration information as 806 1.1.1.5 christos discussed in the first half of this document. </p> 807 1.1 tron 808 1.1 tron <blockquote> 809 1.1 tron <pre> 810 1.1 tron 1 /etc/postfix/main.cf: 811 1.1 tron 2 myhostname = hostname.localdomain 812 1.1 tron 3 mydomain = localdomain 813 1.1 tron 4 814 1.1 tron 5 canonical_maps = hash:/etc/postfix/canonical 815 1.1 tron 6 816 1.1 tron 7 virtual_alias_maps = hash:/etc/postfix/virtual 817 1.1 tron 8 818 1.1 tron 9 /etc/postfix/canonical: 819 1.1 tron 10 your-login-name your-account (a] your-isp.com 820 1.1 tron 11 821 1.1 tron 12 /etc/postfix/virtual: 822 1.1 tron 13 your-account (a] your-isp.com your-login-name 823 1.1 tron </pre> 824 1.1 tron </blockquote> 825 1.1 tron 826 1.1 tron <p> Translation: </p> 827 1.1 tron 828 1.1 tron <ul> 829 1.1 tron 830 1.1 tron <li> <p> Lines 2-3: Substitute your fantasy hostname here. Do not 831 1.1 tron use a domain name that is already in use by real organizations 832 1.1 tron on the Internet. See RFC 2606 for examples of domain 833 1.1 tron names that are guaranteed not to be owned by anyone. </p> 834 1.1 tron 835 1.1 tron <li> <p> Lines 5, 9, 10: This provides the mapping from 836 1.1 tron "your-login-name (a] hostname.localdomain" to "your-account (a] your-isp.com". 837 1.1 tron This part is required. </p> 838 1.1 tron 839 1.1 tron <li> <p> Lines 7, 12, 13: Deliver mail for "your-account (a] your-isp.com" 840 1.1 tron locally, instead of sending it to the ISP. This part is not required 841 1.1 tron but is convenient. 842 1.1 tron 843 1.1 tron </ul> 844 1.1 tron 845 1.1 tron <p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses 846 1.1 tron <b>dbm</b> files instead of <b>db</b> files. To find out what lookup 847 1.1 tron tables Postfix supports, use the command "<b>postconf -m</b>". </p> 848 1.1 tron 849 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/canonical</b>" 850 1.1 tron whenever you change the canonical table. </p> 851 1.1 tron 852 1.1 tron <p> Execute the command "<b>postmap /etc/postfix/virtual</b>" 853 1.1 tron whenever you change the virtual table. </p> 854 1.1 tron 855 1.1 tron </body> 856 1.1 tron 857 1.1 tron </html> 858
Indexes created Sat Jun 27 00:24:51 UTC 2026