I have recently added spamassassin to my mailserver, as the blacklists weren't effective enough.

To clarify: I use Postfix as SMTP + Dovecot as LDA, postgrey for greylisting and postfwd for rate-limiting.

To add Spamassassin, I use guide: https://www.digitalocean.com/community/tutorials/how-to-configure-a-mail-server-using-postfix-dovecot-mysql-and-spamassassin Even though it works, I don't see why it does. What troubles me is the master.cf:

smtp       inet  n       -       y       -       -       smtpd
-o content_filter=spamassassin

dovecot unix    -       n       n       -       -      pipe
  flags=DRhu user=virtual:virtual argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${nexthop} -m ${extension}

spamassassin unix -     n       n       -       -       pipe
user=debian-spamd argv=/usr/bin/spamc -f -e  
/usr/sbin/sendmail -oi -f ${sender} ${recipient}

I don't understand why there is suddenly sendmail involved. Is there a way to set this up more properly?

Here is also my postconf -n in case it is needed.

append_at_myorigin = yes
biff = no
broken_sasl_auth_clients = yes
default_destination_concurrency_limit = 1
delay_warning_time = 8h
disable_vrfy_command = yes
dovecot_destination_concurrency_limit = 1
dovecot_destination_recipient_limit = 1
enable_original_recipient = yes
local_destination_concurrency_limit = 1
mailbox_size_limit = 100000000
maximal_queue_lifetime = 6d
message_size_limit = 52428800
myhostname = REDACTED
myorigin = /etc/mailname
smtp_helo_name = REDACTED
smtp_use_tls = yes
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated
smtpd_delay_reject = no
smtpd_hard_error_limit = 10
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, reject_invalid_hostname
smtpd_recipient_restrictions = check_policy_service inet: permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unlisted_recipient, reject_unauth_destination, reject_unauth_pipelining, reject_rbl_client zen.spamhaus.org=127.0.0.[2..11], reject_rbl_client bl.spamcop.net, reject_rbl_client cbl.abuseat.org, check_policy_service inet:
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unlisted_recipient, reject_unauth_destination, reject_unauth_pipelining
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain = REDACTED
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = permit_mynetworks, reject_unknown_sender_domain
smtpd_soft_error_limit = 5
smtpd_tls_cert_file = REDACTED
smtpd_tls_dh1024_param_file = /etc/ssl/dhparams.pem
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDC3-SHA, KRB5-DE5, CBC3-SHA
smtpd_tls_key_file = REDACTED
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
strict_rfc821_envelopes = yes
tls_random_source = dev:/dev/urandom
virtual_alias_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_maps.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf
virtual_mailbox_domains = proxy:mysql:/etc/postfix/sql/mysql_virtual_domains_maps.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_mailbox_maps.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf
virtual_transport = dovecot

2 Answers 2


When a trademark is very successful, it can become a generic name for the thing it's best known for. Something very similar has happened to the /usr/sbin/sendmail command in Linux and Unix systems.

When Postfix is installed, /usr/sbin/sendmail is not actually Sendmail - it is just a component of Postfix that provides the same interface (i.e. the same options and piping conventions) as Sendmail.

Postfix was designed as a replacement for Sendmail. It turns out many programs will interact with the mail subsystem by calling /usr/sbin/sendmail with well-known options and piping stuff to it. So Postfix must support that too.

When Spamassassin is being used, the message must be passed to spamc for spam detection. Since it is going to add at least a few headers to the message, indicating that the spam check was performed and its results (and, if a message is spam, a notification in the beginning of the message contents), spamc must then pass the message back to Postfix for final delivery.

Note that "pipe" is considered by Postfix to be a transport method, or in other words, if the message is sent to spamc, Postfix considers its job done at that point. So, the spam-checked message needs to be re-injected back to Postfix's processing - and that is what the sendmail command does.

The content_filter keyword does less than you might expect - it just tells Postfix to pass the message that came in by smtpd to a specific transport method. It does not automatically expect any content back: if the content_filter transport method swallows the message with no output, Postfix's job is done. If there is anything left after the message passes through the filter, it's the filter's job to get it back to processing again.

There is at least one other way to achieve the same thing but it will end up using the sendmail command for re-injecting the mail after spam check too.

If you're sure this Postfix will only ever process incoming mail, you could probably configure spamc to pass the message directly to Dovecot instead.

  • Thanks for your answer. I actually know that the sendmail binary is part of the postfix. But I don't see why to use it. Isn't this unnecessary call, when Postfix already has that email and just needs to either send it out or give it to Dovecot to deliver? Mar 27, 2018 at 13:13
  • I updated my answer.
    – telcoM
    Mar 28, 2018 at 13:06

sendmail is not involved. That is just a postfix executable, and it's called like this for historical reasons and compatibility.

look at the man page:

SENDMAIL(1)                                       General Commands Manual 

       sendmail - Postfix to Sendmail compatibility interface

       sendmail [option ...] [recipient ...]

EDIT: (added after your comment)

you could change it with the dovecot LDA but it would only work for local delivery of course. You can check for spam also outgoing emails, and they would not work with dovecot. Full Disclaimer: I did not check all your configuration :)

  • As I answered to telcoM: Yes, this is something I understand. What I don't understand is why it is setup this way. Isn't this an unnecessary call? The sendmail binary will eventually give the mail to Dovecot anyway... Mar 27, 2018 at 17:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .