1

I would like to set up a Postfix null client, i.e. a mail server that sends but does not receive emails, on an Ubuntu 20.04 machine. I spent days trying suggestions from tutorials, the Postfix documentation, forum discussions etc. Many of them do not provide a full picture and even contradict each other. In short: the system does not work as expected and I do not know which settings I got right.

Let me be a bit more specific about the current setup and some more precise questions that I have. For security reasons, I anonymize the domain name, using example.com, as well as some of the IP addresses. In /etc/postfix/main.cf, I use the following settings:

# TLS parameters
smtpd_tls_cert_file=/etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file=/etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_tls_security_level=may
smtp_use_tls=yes
smtp_tls_CApath=/etc/ssl/certs
smtp_tls_security_level=may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = mail.example.com
mydomain = mail.example.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = localhost.$mydomain, localhost, $myhostname
mynetworks = 127.0.0.0/8 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = loopback-only
inet_protocols = ipv4
local_transport = error: local delivery disabled

where /etc/aliases lists [email protected] as postmaster and /etc/mailname contains the line mail.example.com.

After modifying the Postfix configuration, I restart the program with sudo systemctl restart postfix.

The external DNS server uses the following settings:

@                  IN A 123.456.789.01
mail               IN A 123.456.789.01
www                IN A 123.456.789.01
autoconfig         IN CNAME mail.your-server.com.
@                  IN TXT "v=spf1 +a +mx ?all"
@                  IN MX 0 mail
_autodiscover._tcp IN SRV 0 100 443 mail.your-server.com.
_imaps._tcp        IN SRV 0 100 993 mail.your-server.com.
_pop3s._tcp        IN SRV 0 100 995 mail.your-server.com.
_submission._tcp   IN SRV 0 100 587 mail.your-server.com.

The cloud server on which Postfix is installed has a PTR record.

When attempting to send an email via

sudo echo "Test" | mail -s "Test" [email protected]

the system attempts to send it from current-user@hostname, e.g. john@abc, instead of [email protected]. The logs reflect this with the error message: Sender address rejected: need fully-qualified address (in reply to RCPT TO command). I tried changing the sender address with masquerade_domains = example.com and by using mail's r option. Yet, that does not work. Emails only go through, if I change the hostname of the entire machine via

sudo hostnamectl set-hostname mail.example.com

However, I would only like to change the hostname employed by Postfix. Furthermore, I would like to replace the user name in the sending address with noreply, without having to set up a new user account named noreply. I.e. emails should be sent from [email protected].

The hosting provider unblocked port 25. So, that should not be an issue.

I downloaded separate Let's Encrypt certificates for the Nginx web server (example.com) and the Postfix mail server (mail.example.com).

My guess is that myhostname, mydomain, alias_maps, alias_database, myorigin, mydestination (some example leave this setting blank), mynetworks (some examples use different addresses), or relayhost (I do not want to accept any incoming emails, so I figured there is no need to set a relayhost?) in the Postfix configuration, or parts of the DNS configuration are not correctly defined. I am confident that I got the A records right, but I am not at all sure about the other DNS entries. Some tutorials recommend setting a MX record, others do not. Do I need the SRV records, if I exclusively send the emails directly from the shell using mail?

As I said, I have played around with the configuration for days and reviewed the documentation as well as tutorials and numerous forum discussions. Nothing produced the intended result. The task is simply to set up a secure mail server that sends emails from the command line, while not allowing for incoming emails. Which of the above outlined settings are incorrect or not appropriate in this application?

I am new to mail servers and am looking forward to receiving any helpful comments and answers - other than "read the documentation" (which I already did) or "read related posts" (which I also did).

1 Answer 1

1

How you setup listening and sending, is done in /etc/postfix/master.cf.

To disable receiving, find a line similar to:

<hostname>:smtp inet n - n - - smtpd -o smtpd_sasl_auth_enable=no -o syslog_name=smtpd -o smtp_helo_name=<hostname> -o myhostname=<hostname> -o smtpd_banner=$smtpd_banner_bgcomp

and comment it out. That will stop it listening on the smtp port. It's the smtpd bit which is important.

You should still have either or both of the following lines:

<socket relative pathname under in private queue directory> unix - - n - - smtpd -o smtpd_sasl_auth_enable=no -o syslog_name=smtp -o smtp_helo_name=<hostname> -o smtp_bind_address=<ip address> -o smtp_bind_address6=<ipv6 address>

<hostname>:submission inet n - n - - smtpd -o smtpd_sasl_auth_enable=no

These will allow you to inject emails locally for forwarding, either through a unix domain socket or through the submission port. This is all detailed in man 5 master

You are best to set up an mx host in DNS pointing to the source IP address, as many systems will reject emails if it does not exist.

I'm sure I have something wrong somewhere, I usually do...

And remember, these are specific to my system, yours will be slightly different.

4
  • The other thing to remember though is, I have seen other systems, that when you send an email to them, they make a test connection back, and if it fails, they refuse to accept the email. Commented Sep 25, 2021 at 9:46
  • Thanks for the answer. You are right, this indeed looks different on my system. Much of that was already commented out. And if I understand correctly, inet_interfaces = loopback-only already prevents Postfix from listening for incoming emails on port 25. Does your solution add further benefits?
    – user
    Commented Sep 25, 2021 at 13:23
  • What still bothers me is that the server tries to send emails as current-user@machine-hostname rather than [email protected], with machine-hostname being the machine's overall hostname. Postfix somehow ignores the hostname specified in /etc/postfix/main.cf. As suggested by the Postfix documentation, I now also added the line smtp_generic_maps = hash:/etc/postfix/generic where the file /etc/postfix/generic contains the line current-user@machine-hostname [email protected]. Postfix seems to ignore it. What am I missing?
    – user
    Commented Sep 25, 2021 at 13:23
  • The smtp_generic_maps step worked now. It probably just needed time somehow.
    – user
    Commented Sep 25, 2021 at 13:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .