How to setup an email server with the features:
SES (Simple Email Service) is required as AWS block outbound port 25 by default. It was a lot easier to use SES and the jump though the hoops of getting port 25 unblocked, and SES is dirt cheap anyway.
To try and make it easier to understand, this is setup in stages, so that it can be tested out in stages, going from simple to more complex.
May of the config files won't be shown initially in their final form, but build upon.
This will assume a brand new EC2 instance running Debian 12.
The ARM instances are cheaper than x86
The t4g.nano has 1 cpu and 0.5gb of RAM which is more than enough for this setup and is about $5 a month.
The CPU barely goes above a few % when handling around 5 emails per second. More than enough for a small configuration.
This will assume a new domain with no existing entries.
Domain name is mytestes.com, domain1.com & domain2.com
mytestes.com will be the main domain. The other domains will use mytestes.com for email
mail.mytestes.com A = \<ip of mail server\>
domain1.com MX = mail.domain1.com
mail.domain1.com CNAME = mail.mytestes.com (The rDNS will be mail.mytestes.com)
AWS by default block outbound port 25. Getting it unblocked is a lot harder than just using SES (Simple Email Service)
To be able to send email via the AWS's SES, you need to configure an Identity. This can be done for a single email address or for a whole domain.
Choose the Domain identity, Easy DKIM, RSA_2048_BIT, and make sure "Publish DNS records to Route53 and DKIM Signatures" are both enabled.
The order of operations
Create EC2 instance with an appropraite sized drive and a security group that opens up ports:
Create an Elastic IP, assign it to the EC2 instance,
From the Elastic IP page, Update Reverse DNS to the host name that will be used for the mail server, for which i'll choose mail.mytestes.com
Now you know your public IP, update the DNS settings in Route 53
Create an A record for public IP, with a name of mail.mytestes.com
Create an MX record of 10 mail.mytestes.com
| Record Name | Type | Value |
|---|---|---|
| mytestes.com | SOA | not important. Created by Route 53 |
| mytestes.com | NS | same as above |
| mytestes.com | MX | 10 mail.mytestes.com |
| mail.mytestes.com | A | 16.50.100.120 |
| After setting up the SES DKIM keys for a domain, you'll have 3 CNAME records similar to: | ||
| nc6btesdfad5323._domainkey.mytestes.com | CNAME | nc6btesdfad5323.dkim.amazonses.com |
On Debian, vim by default won't let you copy text by highlighting it with the mouse.
~/.vimrc
set mouse=r
syntax on
On a fresh Debian install, do:
sudo hostnamectl set-hostname mail.mytestes.com
sudo timedatectl set-timezone Australia/Melbourne
sudo apt update && sudo apt upgrade -y
sudo apt install -y postfix dovecot-core dovecot-imapd dovecot-lmtpd \
certbot libsasl2-modules mailutils
#Optional stuff i like
sudo apt install -y htop glances ncdu
When it install postfix, choose "Internet Site"
System Mail name mytestes.com
Configure some swap
sudo fallocate -l 512M /swapfile && \
sudo chmod 600 /swapfile && \
sudo mkswap /swapfile && \
sudo swapon /swapfile && \
sudo swapon --show && \
echo "/swapfile none swap sw 0 0" | sudo tee -a /etc/fstab && \
echo "vm.swappiness=10" | sudo tee -a /etc/sysctl.conf
sudo swapon --show
Create a new user for the virtual mailboxes
sudo groupadd -g 5000 vmail
sudo useradd -g vmail -u 5000 -r -d /var/mail/vmail -s /usr/sbin/nologin -c "Virtual Mail User" vmail
This will result in a warning from Debian which can be ignored.
useradd warning: vmail's uid 5000 is greater than SYS_UID_MAX 999
This default needs to change as we are using virtual domains and users. If you some of these here, they will conflict with the virtual domains which will be setup next.
mydestination = $myhostname, mytestes.com, mail.mytestes.com, localhost.mytestes.com, localhost
Change to
mydestination = localhost.mytestes.com, localhost
Add in the Virtual settings
#Virtual mailboxes
virtual_mailbox_domains = hash:/etc/postfix/virtual_domains
virtual_mailbox_maps = hash:/etc/postfix/virtual_mailboxes
virtual_alias_maps = hash:/etc/postfix/virtual_aliases
#Set the base directory that all mailboxes will be subdirectories of
virtual_mailbox_base = /var/mail/vmail
virtual_minimum_uid = 5000
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
#Set to 40MB
message_size_limit = 41943040
/etc/postfix/virtual_domains
mytestes.com OK
nitro.onl OK
/etc/postfix/virtual_mailboxes
craig@mytestes.com mytestes.com/craig/
info@mytestes.com mytestes.com/info/
craig@nitro.onl nitro.onl/craig/
/etc/postfix/virtual_aliases
optional aliases for additional email address that point to mailboxes defined above.
craigus@mytestes.com craig@mytestes.com
cock@nitro.onl craig@nitro.onl
Create hash files of all these
sudo postmap virtual_domains
sudo postmap virtual_mailboxees
sudo postmap virtual_aliases
If you reload postfix, you should be able to send emails to postfix for any domains, mailboxes and aliases listed above as long as your DNS MX records point to this server
At this stage, you should be able to telnet and send emails.
telnet mail.mytestes.com 25
helo xxxx
main from:<test@test.com>
rcpt to:<craig@mytestes.com>
data
gagf
.
You will get an error as postfix can't save the emails to disk yet, but it should be accepting emails for its defined mailboxes and domains and rejecting invalid domains as "relay access denied" and invalid mailboxes as "recipient address rejected: User is unknown in virtual mailbox table
Aug 11 17:46:06 mail.mytestes.com postfix/virtual[37422]: 659AD69494: to=<craig@mytestes.com>, relay=virtual, delay=18, delays=18/0.01/0/0.01, dsn=4.2.0, status=deferred (maildir delivery failed: create maildir file /var/mail/vhosts/mytestes.com/craig/tmp/1754898366.P37422.mail.mytestes.com: Permission denied)
Aug 11 17:49:37 mail.mytestes.com postfix/smtpd[37416]: NOQUEUE: reject: RCPT from unknown[144.355.52.189]: 550 5.1.1 <dick@nitro.onl>: Recipient address rejected: User unknown in virtual mailbox table; from=<sadf@sdf.com> to=<dick@nitro.onl> proto=SMTP
At this stage, after the above additions to the default main.cf, the full /etc/postfix/main.cf is:
smtpd_banner = $myhostname ESMTP $mail_name (Debian/Cocko)
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
readme_directory = no
# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 3.6 on fresh installs
compatibility_level = 3.6
# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_security_level=may
smtp_tls_CApath=/etc/ssl/certs
smtp_tls_security_level=may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = mail.mytestes.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = localhost.mytestes.com, localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
#Virtual mailboxes
virtual_mailbox_domains = hash:/etc/postfix/virtual_domains
virtual_mailbox_maps = hash:/etc/postfix/virtual_mailboxes
virtual_alias_maps = hash:/etc/postfix/virtual_aliases
virtual_mailbox_base = /var/mail/vmail
virtual_minimum_uid = 5000
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
#Set to 40MB
message_size_limit = 41943040
Now, we need to get postfix to deliver the emails to Dovecot.
Dovecot will both save the emails to disk, and then allow access to these emails via IMAPS
Add the following to /etc/postfix/main.cf
# Use Dovecot LMTP for local delivery
virtual_transport = lmtp:unix:private/dovecot-lmtp
Create the directory to store the mail
sudo mkdir -p /var/mail/vmail
sudo chown -R vmail:vmail /var/mail/vmail
sudo chmod -R 750 /var/mail/vmail
There are 4 config files in /etc/dovecot/conf.d/ to update
10-auth.conf 10-mail.conf 10-master.conf auth-passwdfile.conf.ext
10-auth.conf
#increase compatability with older imap clients
auth_mechanisms = plain login
#Comment out auth-system so it doesn't try to auth against system accounts
#uncomment out passwdfile
#!include auth-system.conf.ext
!include auth-passwdfile.conf.ext
10-mail.conf
Delete the line mail_location = mbox:~/mail:INBOX=/var/mail/%u
Put in the following
mail_location = maildir:/var/mail/vmail/%d/%n/Maildir
mail_uid = vmail
mail_gid = vmail
10-master.conf
Update the service lmtp section to the following
service lmtp {
unix_listener /var/spool/postfix/private/dovecot-lmtp {
mode = 0660
user = postfix
group = postfix
}
}
auth-passwdfile.conf.ext
passdb {
driver = passwd-file
args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/users
}
userdb {
driver = static
args = uid=vmail gid=vmail home=/var/mail/vmail/%d/%n
}
To generate a password for the users files
doveadm pw -s SHA512-CRYPT -p "yourpassword"
Put the users and passwords as user:password
/etc/dovecot/users
craig@mytestes.com:{SHA512-CRYPT}$6$LTqHE7fdccDlU62j$eqDFrj19j3QZF7RP5j
info@mytestes.com:{SHA512-CRYPT}$6$LTqHE7fdccDlU62j$eqDFrj19j3QZF7RP5j
fstick@mytestes.com:{SHA512-CRYPT}$6$LTqHE7fdccDlU62j$eqDFrj19j3QZF7RP5j
craig@nitro.onl
For email to be accepted, it needs to be both in the postfix side and dovecot
/etc/dovecot/users
and
/etc/postfix/virtual_domains # for postfix to accept any email from that domain at all
/etc/postfix/virtual_mailboxes # for each mailbox. You can have more than 1 email go to each mailbox
If the user is in Dovecot but not in Postfix, you'll get an error like:
550 5.1.1 <fstick@mytestes.com>: Recipient address rejected: User unknown in virtual mailbox table
If the user in in Postfix, but not in Dovecot, you get:
550 5.1.1 <knob@nitro.onl> User doesn't exist: knob@nitro.onl (in reply to RCPT TO command)
If postfix rejects it, the email will be immediately rejected.
If postfix accepts, but then rejected by dovecot, a bounce message is sent back
At this stage, Postfix are accepting email for all the setup domains mailboxes and any aliases, while rejecting everything else.
This setup is for AWS, and by default, port 25 outbound is blocked, so now we have to forward output email to SES.
From the default /etc/postfix/main.cf, delete the existing entry for smtpd_tls_security_level=may, then add in the following
# Relay all outgoing mail via AWS SES
relayhost = [email-smtp.ap-southeast-2.amazonaws.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_sasl_mechanism_filter = plain,login
smtp_use_tls = yes
smtp_tls_security_level = encrypt
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
Create /etc/postfix/sasl_passwd with [host]:port user:password
[email-smtp.ap-southeast-2.amazonaws.com]:587 KAIDL45CMN:BajVn/wL/qzDSsnpY31aUIAszSDz8
sudo postmap sasl_passwd
sudo chown root:postfix sasl_passwd*
sudo chmod 640 sasl_passwd*
Create new DNS entries
_dmarc.mytestes.com TXT v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@mytestes.com
TXT v=spf1 include:amazonses.com -all
Add in dmarc-reports@mytestes.com as a mailbox or an alias to an existing mailbox
This will be the last change required to DNS records. The complete DNS records are now:
| Record Name | Type | Value |
|---|---|---|
| mytestes.com | SOA | not important. Created by Route 53 |
| mytestes.com | NS | same as above |
| mytestes.com | MX | 10 mail.mytestes.com |
| mail.mytestes.com | A | 16.50.100.120 |
| mytestes.com | TXT | v=spf1 include:amazonses.com -all |
| _dmarc.mytestes.com | TXT | v=DMARC1; p=reject; rua=mailto:dmarc-reports@mytestes.com |
| After setting up the SES DKIM keys for a domain, you'll have 3 CNAME records similar to: | ||
| nc6btesdfad5323._domainkey.mytestes.com | CNAME | nc6btesdfad5323.dkim.amazonses.com |
Go to https://www.mail-tester.com/ and send an email to the address listed.
You should now be getting a 10/10 score
The main thing missing is be able to security connect to Postfix to send emails via SMTP and to Dovecot to retreive emails via IMAP.
Both these require a SSL Certificate and we can get one for free from Let's Encrypt
Now to setup IMAPS as we can use a mail client to send and recieve emails.
nitro.onl MX has to be mytestes.com
If when I get the SSL cert, if I include nitro.onl into the same request, it might work???
Certbot requires inbound port 80 to be open
sudo certbot --standalone certonly -d mail.mytestes.com --agree-tos -m craig@mytestes.com --non-interactive
Should get the following
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/mail.mytestes.com/fullchain.pem
Key is saved at: /etc/letsencrypt/live/mail.mytestes.com/privkey.pem
This certificate expires on 2025-11-10.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
/etc/dovecot/conf.d/10-ssl.conf
ssl = required
ssl_cert = </etc/letsencrypt/live/mail.mytestes.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.mytestes.com/privkey.pem
/etc/dovecot/conf.d/10-master.conf
The below should already be there, just need to uncomment it
inet_listener imaps {
port = 993
ssl = yes
}
sudo systemctl restart dovecot
To test, from another machine
openssl s_client -connect mail.mytestes.com:993
It should output a few pages indicating a valid certificate from Lets Encrypt
The final step is to use this same SSL certificate to enable secure logging in to Postfix to sent emails via SMTP
Point Postfix to the same lets encrypt cert and uses Dovecot for SASL (passwords are set in Dovecot)
/etc/postfix/main.cf
# TLS parameters
smtpd_tls_cert_file=/etc/letsencrypt/live/mail.mytestes.com/fullchain.pem
smtpd_tls_key_file=/etc/letsencrypt/live/mail.mytestes.com/privkey.pem
smtpd_tls_security_level=encrypt
smtpd_tls_auth_only=yes
# Use Dovecot for SASL
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
Dovecot needs to expose the auth socket to Postfix
/etc/dovecot/conf.d/10-master.conf
service auth {
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
}
}
/etc/postfix/master.cf
Towards the top, uncomment or adjust the following settings
submission inet n - y - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING
Let's encrypt expires every 90 days.
Certbot will automatically renew this after 60 days.
To hook into this renewal to automatically reload the cert info Postfix and Dovecotm, do the following
/etc/letsencrypt/renewal-hooks/post/reload-mail
#!/bin/bash
systemctl reload postfix dovecot
sudo chmod +x /etc/letsencrypt/renewal-hooks/post/reload-mail
Email clients often store Send email locally.
On Thunderbird, create a folder call Sent. You can then change the account settings to store sent mail on the server. The default method of this however means that emails are sent twice. Once to send the email, then again to store it on the server.
sudo apt install fail2ban -y
Dovecot doesn't log individual failed attempts at logging in via IMAP.
If someone tries 10 times, when they finally stop trying, dovecot just displays one message saying there were 10 failed attempts.
To change this so fail2ban can pick up the failed attempts.
/etc/dovecot/conf.d/10-logging.conf
auth_verbose = yes
Fail2ban doesn't pick up the following
sshd[3095]: Connection closed by 50.148.155.106 port 46735 [preauth]
/etc/fail2ban/filter.d/sshd-preauth.conf
[Definition]
failregex = ^\s*Connection closed by <HOST> port \d+ \[preauth\]$
If you want to check all fail2ban jails with one command
sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' '\n' | xargs -I {} sudo fail2ban-client status {}
/etc/fail2ban/jail.local
[DEFAULT]
# "bantime" is the number of seconds that a host is banned.
bantime = 60d
# A host is banned if it has generated "maxretry" during the last "findtime"
findtime = 10m
# "maxretry" is the number of failures before a host get banned.
maxretry = 5
backend = systemd
#
# JAILS
#
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
[sshd-preauth]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
filter = sshd-preauth
#
# Mail servers
#
[postfix]
enabled = true
mode = more
port = smtp,465,submission
logpath = %(postfix_log)s
backend = %(postfix_backend)s
[dovecot]
enabled = true
port = pop3,pop3s,imap,imaps,submission,465,sieve
logpath = %(dovecot_log)s
backend = %(dovecot_backend)s
[postfix-sasl]
enabled = true
filter = postfix[mode=auth]
port = smtp,465,submission,imap,imaps,pop3,pop3s
# You might consider monitoring /var/log/mail.warn instead if you are
# running postfix since it would provide the same log lines at the
# "warn" level but overall at the smaller filesize.
logpath = %(postfix_log)s
backend = %(postfix_backend)s
POSTFIX
To check the postfix configuration as changes are made:
postfix check No output means no errors
postconf -n Shows configration, and will show errors.
To see emails queued up in postfix
mailq
Delete queued up emails
sudo postsuper -d <queue id>
sudo postsuper -d ALL
Send test email
echo "Test email" | mail -s "Test LMTP/LDA" craig@mytestes.com
swaks --to craig@mytestes.com --from craig@testes.com --header "Subject: gagf" --body "There you go"
DOVECOT
Rainloop is a very light weight webmail client and fits in will with the lowest end AWS EC2 instance of 1 cpu and 0.5GB ram
sudo apt install -y nginx php-fpm php-cli php-curl php-json php-xml php-mbstring php-zip unzip
cd /tmp
wget https://www.rainloop.net/repository/webmail/rainloop-latest.zip
sudo unzip rainloop-latest.zip -d /var/www/html/rainloop
sudo chown -R www-data:www-data /var/www/html/rainloop
sudo find /var/www/html/rainloop -type d -exec chmod 755 {} \;
sudo find /var/www/html/rainloop -type f -exec chmod 644 {} \;
/etc/nginx/site-available/rainloop
# ==============================
# HTTP → HTTPS redirect
# ==============================
server {
listen 80;
listen [::]:80;
server_name mail.mytestes.com;
return 301 https://$host$request_uri;
}
# ==============================
# Main HTTPS server
# ==============================
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name mail.mytestes.com;
root /var/www/html/rainloop;
index index.php;
# ==============================
# SSL Configuration
# ==============================
ssl_certificate /etc/letsencrypt/live/mail.mytestes.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mail.mytestes.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_ecdh_curve X25519:secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1h;
ssl_session_tickets off;
# ==============================
# Security Headers
# ==============================
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options nosniff always;
add_header X-Frame-Options SAMEORIGIN always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy no-referrer-when-downgrade always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
server_tokens off;
# ==============================
# Main location block
# ==============================
location / {
try_files $uri $uri/ /index.php?$query_string;
}
# ==============================
# PHP handling
# ==============================
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
fastcgi_intercept_errors on;
}
# ==============================
# Access restrictions
# ==============================
# Block .ht* files
location ~ /\.ht {
deny all;
}
# Block hidden files (.git, .env, etc.)
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# Block RainLoop data directory completely
location ^~ /data {
deny all;
}
# Optional: prevent PHP execution in /data
location ~ ^/data/.*\.php$ {
deny all;
}
}
sudo ln -s /etc/nginx/sites-available/rainloop /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default # Remove default configuration
sudo nginx -t
sudo systemctl reload nginx
Go to the admin consdole
http://mail.mytestes.com/?admin
user: admin
pass: 12345
obviously change the password asap
Go to "Domains" and add the domains to use, along with mail server and login credentials.
A list complete list of configuration files.
Dovecot files are full of commented out settings. These won't be included.
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Debian/Cocko)
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
readme_directory = no
# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 3.6 on
# fresh installs.
compatibility_level = 3.6
# TLS parameters
smtpd_tls_cert_file=/etc/letsencrypt/live/mail.mytestes.com/fullchain.pem
smtpd_tls_key_file=/etc/letsencrypt/live/mail.mytestes.com/privkey.pem
smtpd_tls_security_level=encrypt
smtpd_tls_auth_only=yes
#smtpd_tls_loglevel=1
# Postfix uses Dovecot SASL
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtp_tls_CApath=/etc/ssl/certs
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = mail.mytestes.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = localhost.mytestes.com, localhost
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
#Virtual mailboxes
virtual_mailbox_domains = hash:/etc/postfix/virtual_domains
virtual_mailbox_maps = hash:/etc/postfix/virtual_mailboxes
virtual_alias_maps = hash:/etc/postfix/virtual_aliases
virtual_mailbox_base = /var/mail/vmail
virtual_minimum_uid = 5000
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
#Set to 40MB
message_size_limit = 41943040
# Use Dovecot LMTP for local delivery
virtual_transport = lmtp:unix:private/dovecot-lmtp
# Relay all outgoing mail via AWS SES
relayhost = [email-smtp.ap-southeast-2.amazonaws.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_sasl_mechanism_filter = plain,login
smtp_use_tls = yes
smtp_tls_security_level = encrypt
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
submission inet n - y - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
# -o smtpd_tls_auth_only=yes
# -o smtpd_reject_unlisted_recipient=no
# Instead of specifying complex smtpd_<xxx>_restrictions here,
# specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
# here, and specify mua_<xxx>_restrictions in main.cf (where
# "<xxx>" is "client", "helo", "sender", "relay", or "recipient").
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o smtpd_helo_restrictions=
# -o smtpd_sender_restrictions=
# -o smtpd_relay_restrictions=
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING
(use postmap to create hash file)
mytestes.com OK
bounces.mytestes.com OK
domain2.com OK
domain3.com OK
(use postmap to create hash file)
craig@mytestes.com mytestes.com/craig/
xxx@mytestes.com mytestes.com/craig/
info@mytestes.com mytestes.com/info/
craig@domain2.com domain2.com/craig/
(use postmap to create hash file)
craigus@mytestes.com craig@mytestes.com
dmarc-reports@mytestes.com craig@mytestes.com
(use postmap to create hash file)
chown root:postfix
chmod 640
[email-smtp.ap-southeast-2.amazonaws.com]:587 username:password