This article is for people with a VPS or server with root access, or an application that sends e-mail. The short answer: instead of your server delivering mail straight to each destination over port 25, it hands it to a mail server that is already trusted (the smarthost), with a username and password, over 587 or 465. That server makes the final delivery. It solves three problems at once: outbound port 25 blocked by the network, a VPS IP with no reputation or reverse DNS, and an SPF record that does not include the VPS.
Direct sending or through a smarthost
| What |
Direct (port 25) |
Through a smarthost (587 or 465) |
| Who delivers to the destination |
The VPS itself, connecting to each recipient's MX. |
The mail server where you have your mailbox, or a sending service. |
| Outbound port |
25, which many networks and providers block outbound. |
587 (STARTTLS) or 465 (SSL/TLS), the authenticated submission ports. |
| Reputation and reverse DNS |
Those of the VPS IP. A new IP, or one without PTR, often ends up in spam: PTR and reverse DNS. |
Those of the smarthost. |
| SPF and DKIM |
The domain's SPF must include the VPS IP, and DKIM signing must happen on the VPS. |
Those of the delivering server count, if the domain already has them set up for it. |
| Limits |
Those of the VPS and the IP reputation. |
Those of the smarthost: an ordinary mailbox is not a bulk sending service. |
Setting up Postfix with a smarthost
| 1 |
Create a mailbox just for sending (a notifications address, for example) and use it as the sender. Many servers refuse, or flag as suspicious, a sender that differs from the authenticated account.
|
|
| 2 |
Check that the VPS reaches the port: openssl s_client -starttls smtp -connect mail.yourdomain:587 -quiet If it hangs with no answer, it is the VPS or network firewall: ports and firewall on a VPS.
|
|
| 3 |
In /etc/postfix/main.cf, add (or change) these lines: relayhost = [mail.yourdomain]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt The square brackets tell Postfix to use the name as it is, without looking up its MX.
|
|
| 4 |
Store the credentials in /etc/postfix/sasl_passwd, on a single line, and protect the file: [mail.yourdomain]:587 sender@yourdomain:the-password
chmod 600 /etc/postfix/sasl_passwd
postmap /etc/postfix/sasl_passwd
systemctl reload postfix On Red Hat family distributions Postfix needs the cyrus-sasl-plain package to authenticate; on Debian and Ubuntu, libsasl2-modules.
|
|
| 5 |
Send a test and read the log (/var/log/maillog or /var/log/mail.log, depending on the distribution, or journalctl -u postfix). Look for relay=mail.yourdomain and status=sent. A 535 error is the username or password; “no mechanism available” is the missing SASL package.
|
|
|
Copy main.cf before you touch it and reload Postfix only after checking the syntax with postfix check. And use the smarthost for system and application mail, not for newsletters: a mailbox that sends in bulk gets blocked, and takes the domain's normal mail down with it.
|
|
An application does not need Postfix: nearly all of them take an SMTP server in their settings (server, port, username, password). It is the same smarthost, set up in the application itself. To choose between SMTP and a service with an API, see sending by SMTP or through an e-mail API.
|
|
The smarthost relay will not authenticate, or mail still lands in spam? Send us the Postfix log lines, without the password.
Open a support ticket
|
Where to see it in your account
Whether outbound port 25 is open on your VPS is something you can test in a minute, so test it. From the VPS, try to open a connection to port 25 of any mail server (for example with nc -vz followed by the server name and 25). If it hangs and times out, port 25 is blocked on that path, and the smarthost route in this article is the way. If you want us to confirm, open a ticket with the VPS and the result.
- Our mailbox as smarthost. E-mail accounts are unlimited on every hosting plan, so create one just for sending. In cPanel, Email Accounts, the mail client settings (Connect Devices) show the server name, the secure ports and the user name; use those values in Postfix.
- The ceiling. Everything the VPS sends through it counts against the plan's hourly limit: 100 on Pro, 200 on Plus, 300 on Ultra. It is for application notices, not for mass mailing.
RECOMMENDED PRODUCT VPS server with root access Resources of your own, the OS you choose, reinstall whenever you like. from $8.39/mo (3-year plan, with coupon) See plans |
Português
English
