Postfix

https://www.postfix.org/
Admin
Postfix is a free and open-source mail transfer agent that routes and delivers electronic mail,...
Tokens:504,442
Snippets:6,106
Trust Score:9.5
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install Postfix from Source

Source: https://www.postfix.org/INSTALL.html

Use 'make install' for a first-time interactive installation, which prompts for pathnames and saves preferences. Use 'make upgrade' for non-interactive upgrades on existing installations.

```makefile
# make install       (interactive version, first time install)

# make upgrade       (non-interactive version, for upgrades)
```

--------------------------------

### Enable and start the Postfix instance

Source: https://www.postfix.org/MULTI_INSTANCE_README.html

Commands to enable the instance and start the service after configuration.

```bash
# postmulti -i postfix-in -x postconf -e \
    "master_service_disable =" "authorized_submit_users = root"
# postmulti -i postfix-in -e enable
# postmulti -i postfix-in -p start
```

--------------------------------

### Configure relayhost examples

Source: https://www.postfix.org/postconf.5.html

Examples of setting the relayhost parameter for various network configurations.

```text
relayhost = $mydomain
relayhost = [gateway.example.com]
relayhost = mail1.example:587, mail2.example:587
relayhost = [an.ip.add.ress]
```

--------------------------------

### Start Postfix

Source: https://www.postfix.org/UNPRIVILEGED_README.html

Execute as the root or postfix user to start the Postfix service.

```bash
postfix start
```

--------------------------------

### Enable and Start Postfix Multi-Instance

Source: https://www.postfix.org/MULTI_INSTANCE_README.html

Commands to enable the multi-instance for start/stop operations and then start the new Postfix instance.

```bash
1 # postmulti -i postfix-out -x postconf -e \
2     "master_service_disable =" "authorized_submit_users = root"
3 # postmulti -i postfix-out -e enable
4 # postmulti -i postfix-out -p start
```

--------------------------------

### Configure smtpd_banner

Source: https://www.postfix.org/postconf.5.html

Example of setting the smtpd_banner parameter. The SMTP protocol requires that the banner starts with $myhostname.

```text
smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
```

--------------------------------

### SMTP Dot Stuffing Example

Source: https://www.postfix.org/false-smuggling-claims.html

Shows how an SMTP server, after prepending a '.' to lines starting with '.', transmits a message. This prevents confusion with End-of-DATA, invalidating the attack.

```text
    mail from:<attacker><CR><LF>
    rcpt to:<someone><CR><LF>
    data<CR><LF>
    message content
    <CR><LF>..<non-CRLF>        // note the '..' here
        mail from:<spoofed><CR><LF>
        rcpt to:<victim><CR><LF>
        data<CR><LF>            // or BDAT if available
        message content
    real End-of-DATA

```

--------------------------------

### Postfix Instance Configuration (main.cf)

Source: https://www.postfix.org/MULTI_INSTANCE_README.html

Example `main.cf` settings for a new Postfix instance, including multi-instance specific parameters and queue/data directory configurations.

```postfix
/etc/postfix-out/main.cf
    #
    # ... "stock" main.cf settings ...
    #
    multi_instance_name = postfix-out
    queue_directory = /var/spool/postfix-out
    data_directory = /var/lib/postfix-out
    #
    multi_instance_enable = no
    master_service_disable = inet
    authorized_submit_users =

```

--------------------------------

### Install Postfix with custom shlib_directory

Source: https://www.postfix.org/INSTALL.html

Use 'make install' with shlib_directory to specify a custom location for shared library files during installation.

```makefile
# make install shlib_directory=/usr/local/lib/postfix ...
```

--------------------------------

### Install Certificates and Keys

Source: https://www.postfix.org/TLS_README.html

Copies the generated files to the Postfix directory and sets appropriate file permissions. Requires super-user privileges.

```bash
# **cp demoCA/cacert.pem foo-key.pem foo-cert.pem /etc/postfix**
# **chmod 644 /etc/postfix/foo-cert.pem /etc/postfix/cacert.pem**
# **chmod 400 /etc/postfix/foo-key.pem**
```

--------------------------------

### Start Postfix Service

Source: https://www.postfix.org/INSTALL.html

After configuring Postfix to send mail only, start the Postfix system using the 'postfix start' command. Alternatively, the Postfix sendmail command can be used.

```bash
# postfix start
```

--------------------------------

### Install Certificate Files

Source: https://www.postfix.org/TLS_LEGACY_README.html

Moves the generated files to the Postfix configuration directory and sets appropriate permissions.

```bash
# **cp demoCA/cacert.pem FOO-key.pem FOO-cert.pem /etc/postfix**
# **chmod 644 /etc/postfix/FOO-cert.pem /etc/postfix/cacert.pem**
# **chmod 400 /etc/postfix/FOO-key.pem**
```

--------------------------------

### Start Postfix Service

Source: https://www.postfix.org/NON_BERKELEYDB_README.html

Start the Postfix mail transfer agent.

```bash
# **postfix start**
```

--------------------------------

### To Header Example

Source: https://www.postfix.org/VERP_README.html

Example of the To header containing the encapsulated recipient address.

```text
To: owner-listname+user=domain@your.domain
```

--------------------------------

### Initialize and Test Null-Client

Source: https://www.postfix.org/MULTI_INSTANCE_README.html

Commands to build databases, start Postfix, and perform a test mail submission.

```bash
# cd /etc/postfix; make
# postfix start
# sendmail -i -f root -t <<EOF
From: root
To: root
Subject: test

testing
EOF
```

--------------------------------

### Advanced Policy Client Configuration Example

Source: https://www.postfix.org/SMTPD_POLICY_README.html

Configure a non-critical policy service with a short timeout and 'DUNNO' as the default action. This example demonstrates overriding global settings on a per-client basis.

```postfix
1 /etc/postfix/main.cf:
2     mua_recipient_restrictions = 
3         ...
4         reject_unauth_destination
5         check_policy_service { inet:host:port, 
6             timeout=10s, default_action=DUNNO
7             policy_context=submission }
8         ...
```

--------------------------------

### MIME-Error header example

Source: https://www.postfix.org/postconf.5.html

Example of the header inserted when non_empty_end_of_header_action is set to add_header.

```text
MIME-Error: message header was not terminated by empty line

```

--------------------------------

### Primary Instance Directory Settings

Source: https://www.postfix.org/MULTI_INSTANCE_README.html

Example configuration paths for a primary Postfix instance.

```text
config_directory = /conf-path/postfix
queue_directory = /queue-path/postfix
data_directory = /data-path/postfix
```

--------------------------------

### Create a new Postfix instance

Source: https://www.postfix.org/MULTI_INSTANCE_README.html

Use `postmulti -e create` to set up a new Postfix instance. Specify the configuration, queue, and data directories. The `-I` and `-G` options assign a name and group name, respectively, to the new instance.

```bash
# postmulti [-I postfix-myinst] [-G mygroup] -e create \
        "config_directory = /path/to/config_directory" \
        "queue_directory = /path/to/queue_directory" \
        "data_directory = /path/to/data_directory"
```

--------------------------------

### Reject log format example

Source: https://www.postfix.org/postconf.5.html

Example of the log format when non_empty_end_of_header_action is set to reject.

```text
_queueid_ reject: mime-error message header was terminated
with non-empty line: _erroneous text_; from=<_sender_>
to=<_recipient_>

```

--------------------------------

### Header Filter Map Example

Source: https://www.postfix.org/regexp_table.5.html

Example configuration for rejecting specific email headers.

```text
# These were once common in junk mail.
/^Subject: make money fast/     REJECT
/^To: friend@public\.com/       REJECT
```

--------------------------------

### Enable STARTTLS Offer Logging

Source: https://www.postfix.org/TLS_LEGACY_README.html

Configures Postfix to log when a remote server offers STARTTLS, helping identify TLS-capable sites.

```text
postfix/smtp[pid]: Host offered STARTTLS: [hostname.example.com]
```

```text
/etc/postfix/main.cf:
    smtp_tls_note_starttls_offer = yes
```

--------------------------------

### Create a new Postfix instance

Source: https://www.postfix.org/postmulti.1.html

Example of creating a new instance with a specific name using the -I option.

```bash
# postmulti -I postfix-mumble \
```

--------------------------------

### Postmap Command Examples

Source: https://www.postfix.org/memcache_table.5.html

Examples of using the `postmap` command with memcache lookup tables.

```APIDOC
## Postmap Command Examples

### Description
Examples demonstrating how to query Postfix memcache tables using the `postmap` command.

### Method
`postmap` command-line utility

### Endpoint
`memcache:/etc/postfix/filename`

### Parameters
#### Path Parameters
- **filename** (string) - Required - The name of the memcache configuration file.

#### Query Parameters
- **-q "_string_"** - Required - The key to query in the memcache table.
- **-** - Required - Indicates that the input will be piped from stdin.

### Request Example
```bash
postmap -q "user@example.com" memcache:/etc/postfix/memcache-aliases.cf
```

### Request Example (Piping Input)
```bash
cat inputfile | postmap -q - memcache:/etc/postfix/memcache-aliases.cf
```

### Response
#### Success Response (200)
- **value** (string) - The value associated with the queried key in the memcache table.

#### Response Example
```
user@example.com value
```
```

--------------------------------

### Redirect Log Example

Source: https://www.postfix.org/NON_BERKELEYDB_README.html

Example of log output indicating a file path redirection.

```text
redirecting _xxx_:/path/to/file to _yyy_:/path/to/file
```

--------------------------------

### Configure Postfix Lookup Tables

Source: https://www.postfix.org/DATABASE_README.html

Example configuration entries for main.cf defining various lookup tables for aliasing, filtering, and routing.

```text
/etc/postfix/main.cf:
    alias_maps = hash:/etc/postfix/aliases            (local aliasing)
    header_checks = regexp:/etc/postfix/header_checks (content filtering)
    transport_maps = hash:/etc/postfix/transport      (routing table)
    virtual_alias_maps = hash:/etc/postfix/virtual    (virtual aliasing)
```

--------------------------------

### Initialize postmulti management

Source: https://www.postfix.org/postmulti.1.html

The init action updates the primary instance's main.cf to enable multi-instance management.

```text
multi_instance_wrapper =
        ${command_directory}/postmulti -p --
multi_instance_enable = yes
```

--------------------------------

### Error Log Example

Source: https://www.postfix.org/NON_BERKELEYDB_README.html

Example of an error message logged when a command fails to execute.

```text
could not execute command _xxx..._
```

--------------------------------

### Example Multi-Instance Wrapper Script

Source: https://www.postfix.org/postfix-wrapper.5.html

This shell script provides a basic implementation of a multi-instance manager. It iterates through configured directories to execute commands for each Postfix instance.

```sh
#!/bin/sh

: ${command_directory?"do not invoke this command directly"}

POSTCONF=$command_directory/postconf
POSTFIX=$command_directory/postfix
instance_dirs=`$POSTCONF -h multi_instance_directories |
                sed 'y/,/ /'` || exit 1

err=0
for dir in $config_directory $instance_dirs
do
    case "$1" in
    stop|abort|flush|reload|drain)

```

--------------------------------

### Start Postfix and Test

Source: https://www.postfix.org/NON_BERKELEYDB_README.html

Starts or reloads Postfix and sends a test message to trigger re-indexing.

```bash
# **postfix start** (or **postfix reload**)
# **sendmail -bv postmaster**
```

--------------------------------

### domain_to_ascii ASCII example

Source: https://www.postfix.org/postconf.5.html

Example showing domain_to_ascii behavior when the domain contains only ASCII characters.

```bash
# postconf -o 'mydomain=foo.example' -x smtp_requiretls_policy
smtp_requiretls_policy = inline:{
    { foo.example = opportunistic },
    { .foo.example = opportunistic },
     ...
```

--------------------------------

### Initialize Makefiles for Postfix Build

Source: https://www.postfix.org/INSTALL.html

Run this command from the Postfix top-level directory if you encounter 'make: don't know how to ...' errors during the build process. It ensures the makefiles are correctly initialized.

```bash
$ make -f Makefile.init makefiles
```

--------------------------------

### Configure authorized_submit_users example

Source: https://www.postfix.org/postconf.5.html

An example configuration for authorized_submit_users that excludes the 'www' user and allows all others.

```text
authorized_submit_users = !www, static:all
```

--------------------------------

### Build Postfix from source

Source: https://www.postfix.org/DEBUG_README.html

Commands to compile and install Postfix after configuration.

```shell
% make
% su
Password:
```

--------------------------------

### Message-ID header example

Source: https://www.postfix.org/BACKSCATTER_README.html

Example of a Message-ID header generated by Outlook 2003 when a DSN is requested.

```text
Message-ID: <!&! ...very long string... ==@example.com>
```

--------------------------------

### Configure RSA Certificate and Key File

Source: https://www.postfix.org/postconf.5.html

Example of a combined RSA private key and certificate file structure for Postfix.

```text
/etc/postfix/rsa.pem:
    -----BEGIN PRIVATE KEY-----
    MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDc4QusgkahH9rL
    ...
    ahQkZ3+krcaJvDSMgvu0tDc=
    -----END PRIVATE KEY-----
    -----BEGIN CERTIFICATE-----
    MIIC+DCCAeCgAwIBAgIUIUkrbk1GAemPCT8i9wKsTGDH7HswDQYJKoZIhvcNAQEL
    ...
    Rirz15HGVNTK8wzFd+nulPzwUo6dH2IU8KazmyRi7OGvpyrMlm15TRE2oyE=
    -----END CERTIFICATE-----
```

--------------------------------

### Start instances in a group

Source: https://www.postfix.org/postmulti.1.html

Use the -g and -p options to start only the instances belonging to a specific group.

```bash
# postmulti -g msa -p start
```

--------------------------------

### Configure Postfix TLS Settings

Source: https://www.postfix.org/TLS_README.html

Updates main.cf to enable TLS and point to the newly installed certificate and key files.

```text
/etc/postfix/main.cf:
    smtp_tls_CAfile = /etc/postfix/cacert.pem
    smtp_tls_session_cache_database =
        btree:/var/lib/postfix/smtp_tls_session_cache
    smtp_tls_security_level = may
    smtp_tls_loglevel = 1
    smtpd_tls_CAfile = /etc/postfix/cacert.pem
    smtpd_tls_cert_file = /etc/postfix/foo-cert.pem
    smtpd_tls_key_file = /etc/postfix/foo-key.pem
    smtpd_tls_received_header = yes
    smtpd_tls_session_cache_database =
        btree:/var/lib/postfix/smtpd_tls_session_cache
    tls_random_source = dev:/dev/urandom
    smtpd_tls_security_level = may
    smtpd_tls_loglevel = 1
```

--------------------------------

### Default Settings for New Instance

Source: https://www.postfix.org/MULTI_INSTANCE_README.html

Default configuration parameters assigned to a newly created instance named postfix-myinst.

```text
multi_instance_enable = no
multi_instance_name = postfix-myinst
config_directory = /conf-path/postfix-myinst
queue_directory = /queue-path/postfix-myinst
data_directory = /data-path/postfix-myinst
```

--------------------------------

### Example ed448.pem file content

Source: https://www.postfix.org/postconf.5.html

Example content for an ed448.pem file containing a private key and certificate.

```text
/etc/postfix/ed448.pem:
    -----BEGIN PRIVATE KEY-----
    MEcCAQAwBQYDK2VxBDsEOQf+m0P+G0qi+NZ0RolyeiE5zdlPQR8h8y4jByBifpIe
    LNler7nzHQJ1SLcOiXFHXlxp/84VZuh32A==
    -----END PRIVATE KEY-----
    -----BEGIN CERTIFICATE-----
    MIIBdjCB96ADAgECAhQSv4oP972KypOZPNPF4fmsiQoRHzAFBgMrZXEwFDESMBAG
    ...
    pQcWsx+4J29e6YWH3Cy/CdUaexKP4RPCZDrPX7bk5C2BQ+eeYOxyThMA
    -----END CERTIFICATE-----
```

--------------------------------

### Example ed25519.pem file content

Source: https://www.postfix.org/postconf.5.html

Example content for an ed25519.pem file containing a private key and certificate.

```text
/etc/postfix/ed25519.pem:
    -----BEGIN PRIVATE KEY-----
    MC4CAQAwBQYDK2VwBCIEIEJfbbO4BgBQGBg9NAbIJaDBqZb4bC4cOkjtAH+Efbz3
    -----END PRIVATE KEY-----
    -----BEGIN CERTIFICATE-----
    MIIBKzCB3qADAgECAhQaw+rflRreYuUZBp0HuNn/e5rMZDAFBgMrZXAwFDESMBAG
    ...
    nC0egv51YPDWxEHom4QA
    -----END CERTIFICATE-----
```

--------------------------------

### Configure tls_server_sni_maps in main.cf

Source: https://www.postfix.org/postconf.5.html

Example configuration for setting up SNI maps in the Postfix main.cf file. Note that the indexed table must be created using the postmap -F command.

```text
/etc/postfix/main.cf:
    #
    # The indexed SNI table must be created with "postmap -F"
    #
    indexed = ${default_database_type}:${config_directory}/
    tls_server_sni_maps = ${indexed}sni
```

--------------------------------

### Configure qmqpd_authorized_clients

Source: https://www.postfix.org/postconf.5.html

Example configuration for the qmqpd_authorized_clients parameter, showing how to use negation and network masks to control client access.

```text
qmqpd_authorized_clients = !192.168.0.1, 192.168.0.0/24
```
Tokens:
Raw