Introduction

An email server accepts, routes, queues, and delivers messages. The central security rule is simple: accept relay requests only from authorized clients or authenticated users.

What you should be able to do after this lesson:

Explain SMTP roles and a basic delivery path.
Inspect and change Postfix configuration.
Configure local aliases and relay policy.
Recognize virtual domains and mailbox quotas.
Inspect the mail queue and logs.
Configure basic SMTP TLS behavior.

Big Idea: Acceptance, Relay, and Final Delivery Are Separate Decisions

When Postfix receives a message, ask three questions:

May this client submit it?
Is this destination local or authorized for relay?
Where should the accepted recipient finally be delivered?

Confusing these decisions creates open relays, rejected local mail, or loops. Trace one queue ID through logs to see which decision produced the result.

Mail Flow and Roles

A mail user agent creates or reads mail.
A mail submission or transfer agent accepts SMTP messages.
DNS MX records identify destination mail exchangers.
A delivery agent places mail into a local mailbox.
IMAP or POP services provide mailbox access.

SMTP delivery normally uses TCP port 25 between servers; authenticated submission commonly uses ports 587 or 465 according to deployment policy.

Postfix Configuration

Postfix files commonly live under /etc/postfix/. main.cf holds service-wide parameters; master.cf defines daemon services.

postconf -n
postconf myhostname mydestination mynetworks relay_domains
postfix check

postconf -n shows settings that differ from defaults, which is useful for review.

Relay Safety

Trusted networks may be listed in mynetworks, and destinations delivered locally appear in settings such as mydestination or virtual-domain maps. Modern relay policy commonly requires an authorized destination, trusted client, or authenticated session.

Test from an untrusted network as well as locally. An open relay can be abused to send spam and damage domain reputation.

An internal relay may accept mail from explicitly trusted application networks and forward it to a controlled next hop. Keep mynetworks narrow; authentication is preferable when clients cannot be trusted solely by network location.

Aliases

Local aliases are commonly defined in /etc/aliases:

postmaster: root
root: [email protected]

Rebuild the aliases database:

newaliases

Virtual alias and mailbox maps support domains and recipients that are not ordinary local accounts.

Virtual alias domains rewrite recipients to another address. Virtual mailbox domains represent final hosted recipients and mailbox storage. Keep a domain out of conflicting local, relay, and virtual classes. Recipient quotas can be enforced at the mailbox or delivery layer, but they require consistent behavior between the MTA, delivery agent, and mailbox-access service.

Queue and Logs

postqueue -p
postqueue -f
postsuper -d <queue-id>

Sendmail-compatible commands such as mailq may invoke the Postfix compatibility layer. Logs commonly appear in the system journal or mail files below /var/log/.

Read the complete transaction by queue ID to connect acceptance, routing, retries, and final status.

The Postfix queue lives below /var/spool/postfix/. Use Postfix queue commands instead of modifying queue files manually. Sendmail-compatible commands provide a familiar interface, but Postfix remains the implementation processing them.

Basic TLS

TLS can protect SMTP transport, but opportunistic server-to-server TLS differs from authenticated client submission. Configure certificate and key paths, protocol policy, and whether TLS is optional or required for each service.

openssl s_client -starttls smtp -connect mail.example.test:25

Other MTAs

Sendmail and Exim are alternative MTAs. Know that their configuration and queue tools differ even though SMTP concepts remain common.

Guided Practice: Trace One Message

On an isolated mail lab, verify configuration and listeners:

postfix check
postconf -n
ss -ltnp | grep -E ':(25|587)\b'

Submit a message to a controlled local recipient, then find its queue ID in the log. Follow every line for that ID and identify:

connecting client
envelope sender and recipient
restriction decision
next-hop or local delivery transport
final status

Add a local alias, run newaliases, submit again, and prove the rewritten destination. Finally test relay from an untrusted source to a nonlocal domain and confirm rejection without sending unwanted mail.

Troubleshooting Scenario

Mail for a hosted virtual domain loops back into Postfix until it is deferred. The same domain appears as both a relay destination and a virtual mailbox domain, with its transport pointing to the server again.

Assign the domain one clear role, inspect map lookups and postconf -n, reload, and trace a new queue ID. Flushing the old queue without correcting routing only repeats the loop.

Exam Focus

Know /etc/postfix/, main.cf, master.cf, /var/spool/postfix/, aliases, and mail logs.
Distinguish local domains, relay domains, virtual aliases, and virtual mailboxes.
Understand SMTP, basic TLS, quotas, queues, and sendmail-compatible commands.
Recognize Sendmail and Exim while configuring Postfix in depth.

Recap

Distinguish local delivery, relay, and submission.
Never rely on defaults without testing unauthorized relay.
Use queue IDs to follow a message through logs.
TLS, authentication, and relay authorization solve different problems.

211.1 Using e-mail servers