Postfix Mail Relay Server with TLS

Question

I currently have Postfix set up on a Centos 6 server, as a simple forwarding service.

Currently in /etc/postfix/main.cf I have set the following:

smtpd_client_restrictions = permit_mynetworks,reject_unknown_client,permit
smtpd_recipient_restrictions = permit_mynetworks,permit_auth_destination,permit_sasl_authenticated,reject_unauth_destination

and also:

#For virtual domains
virtual_alias_domains = hash:/etc/postfix/mydomains
virtual_alias_maps = hash:/etc/postfix/virtual

In /etc/postfix/mydomains I have listed domains that it will accept mail for, and in /etc/postfix/virtual I list the addresses that are configured, and what addresses they forward to.

What I would like to do...

I would like postfix to continue to act as it currently does for mails coming in on port 25.

However, I would like to also set up mail relaying for authenticated users through port 587, with TLS authentication, so I can set up GMail to send email from my own domains through my server.

I've found some tutorials on setting up relaying, but every time I attempt it, it breaks the mail forwarding on port 25.

My last attempt involved the following changes to /etc/postfix/main.cf:

relayhost = [smtp.mydomain.com]:587

smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/smtp_auth
smtp_sasl_security_options = noanonymous

I only have a small number of users, so I'm happy with a simple username/password list in /etc/postfix/smtp_auth (for now at least).

Can anyone give me some pointers on setting this up, please?

Thanks for your help!

James

Answer 1

You need to update the master.cf file:

submission inet n       -       -       -       -       smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
  -o smtpd_etrn_restrictions=reject
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth-client
  -o smtpd_reject_unlisted_sender=yes
  -o smtpd_recipient_restrictions=reject_non_fqdn_sender,reject_unknown_sender_domain,permit_auth_destination,permit_mynetworks,permit_sasl_authenticated,reject

I use dovecot as the authentication method, so that I don't have to update multiple places if anything changes.