Set up Postfix as a send-only SMTP server on Linux

Many servers only need to send email: password resets from an app, cron job output, monitoring alerts. A Postfix send-only SMTP server does that without running a full mail system or accepting mail from the internet. This guide sets it up securely and covers the DNS records that keep your messages out of spam.

Before you start

• A Linux VPS with root access and a fully qualified hostname such as server1.example.com with an A record.
• Outbound port 25 allowed by your provider, or an external SMTP relay account (port 587).
• Access to the DNS zone of the sending domain.

Install Postfix

1. Ubuntu/Debian:
   Copy

   sudo apt install -y postfix mailutils

   Choose Internet Site and enter your domain as the system mail name.

2. AlmaLinux/Rocky:
   Copy

   sudo dnf install -y postfix s-nail && sudo systemctl enable --now postfix

Make Postfix send-only

1. Edit /etc/postfix/main.cf and set:
   Copy

   myhostname = server1.example.com
   myorigin = example.com
   inet_interfaces = loopback-only
   inet_protocols = all
   mydestination = localhost
   smtp_tls_security_level = may

   inet_interfaces = loopback-only means only programs on this server can submit mail – nothing from the internet.

2. Restart and confirm it listens only on localhost:
   Copy

   sudo systemctl restart postfix && ss -tlnp | grep ':25'

Send a test email

echo 'Test body' | mail -s 'Postfix test' you@yourmail.com

Watch the log with sudo journalctl -u postfix -f (or /var/log/mail.log / /var/log/maillog). Look for status=sent.

Set up DNS for deliverability

1. PTR (reverse DNS): ask your provider (or use their panel) to set the server IP's PTR to server1.example.com.
2. SPF: add or update a TXT record on example.com, for example v=spf1 ip4:203.0.113.10 ~all. Merge with any existing SPF – a domain must have only one.
3. DKIM: install OpenDKIM, generate a key and publish its TXT record, then connect it to Postfix with milter settings.
4. DMARC: start with v=DMARC1; p=none; rua=mailto:dmarc@example.com on _dmarc.example.com.

Alternative: relay through an SMTP provider

If port 25 is blocked or your IP has poor reputation, relay via a transactional email service or your mailbox provider on port 587:

1. Add to main.cf:
   Copy

   relayhost = [smtp.provider.com]:587
   smtp_sasl_auth_enable = yes
   smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
   smtp_sasl_security_options = noanonymous
   smtp_tls_security_level = encrypt

2. Create /etc/postfix/sasl_passwd containing [smtp.provider.com]:587 username:password, then:
   Copy

   sudo chmod 600 /etc/postfix/sasl_passwd && sudo postmap /etc/postfix/sasl_passwd && sudo systemctl restart postfix

3. Use the provider's SPF/DKIM instructions for your domain.

Troubleshooting

• Connection timed out to port 25: the provider blocks outbound SMTP. Request unblocking or use a relay.
• Mail lands in spam: check PTR, SPF, DKIM and DMARC, and test your IP on blocklists.
• Queue grows: view with postqueue -p, retry with postqueue -f, and read the deferral reason in the log.
• "Relay access denied": an app tried to submit from another host; send via localhost instead.

FAQ: Postfix send-only server

Will this server receive email?

No. With loopback-only it accepts mail only from local programs. Keep MX records pointed at your real mail host.

Can a PHP app use it?

Yes. PHP's mail() uses sendmail, which Postfix provides, or point an SMTP library at localhost:25.

Is a relay better than sending directly?

For important transactional mail, a reputable relay usually delivers more reliably than a fresh VPS IP.

Next steps

• SPF, DKIM and DMARC explained
• Reverse DNS and email deliverability
• Mail server software: Exim vs Postfix and Dovecot