Getting Started with Postfix SBS: A Beginner’s GuidePostfix is a widely used open-source mail transfer agent (MTA) known for its performance, security, and simplicity. “Postfix SBS” typically refers to Postfix deployments tailored for Small Business Server (SBS) environments — compact, cost-effective mail server setups designed to serve a small organization’s email needs reliably. This guide walks you through the essentials: planning, installation, basic configuration, security, common extensions (spam filtering, antivirus, webmail), and basic troubleshooting. It’s aimed at beginners with basic Linux familiarity and a desire to run a dependable mail server for a small team.
Why choose Postfix for Small Business Server (SBS)?
- Reliability and performance: Postfix handles typical small- to medium-sized mail loads efficiently and recovers gracefully from bursts.
- Security by design: Postfix’s modular architecture and privilege separation reduce attack surface.
- Simplicity: Configuration is straightforward, with sane defaults and a clear configuration file layout.
- Ecosystem: Works well with common tools: Dovecot (IMAP/POP), SpamAssassin/Rspamd (spam filtering), ClamAV (antivirus), and webmail interfaces like Roundcube.
Planning your Postfix SBS deployment
Before installing anything, make these decisions:
- Server OS: Common choices are Debian/Ubuntu LTS or CentOS/RHEL/Alma/Rocky. For beginners, Debian/Ubuntu often has more recent packages and simpler package management.
- Domain and DNS: You need a domain name with these DNS records:
- MX record pointing to your mail host (e.g., mail.example.com).
- A (or AAAA) record for the mail server hostname.
- PTR (reverse DNS) for the server IP — important for deliverability.
- SPF, DKIM, and DMARC records for authentication and anti-spoofing.
- Mailbox storage: Local UNIX mailboxes, Maildir, or an external storage backend. Maildir is recommended for reliability and concurrency.
- User accounts: System users, virtual users in files, or virtual users in a database (MySQL/PostgreSQL). Small businesses often use virtual users for easier management.
- Backups and monitoring: Plan for regular backups of mailbox data and configuration, monitoring of mail queue and disk usage, and alerting.
Installation (example: Ubuntu/Debian)
On Debian/Ubuntu, installation is straightforward with apt. This example uses Postfix + Dovecot for SMTP and IMAP/POP.
-
Update and install packages:
sudo apt update sudo apt install postfix dovecot-core dovecot-imapd dovecot-pop3d -
During Postfix package installation, a configuration prompt appears. Choose “Internet Site” and set the system mail name to your domain (example.com) or the mail host (mail.example.com). You can change these later in /etc/postfix/main.cf.
-
Basic Postfix config files:
- /etc/postfix/main.cf — main configuration
- /etc/postfix/master.cf — controls Postfix daemon services
Basic Postfix configuration
Open /etc/postfix/main.cf and set or verify these key parameters:
- myhostname = mail.example.com
- mydomain = example.com
- myorigin = $mydomain
- mydestination = \(myhostname, localhost.\)mydomain, localhost, $mydomain
- inet_interfaces = all
- inet_protocols = ipv4 (or all if IPv6 is configured)
- home_mailbox = Maildir/ # if using Maildir format
- mailbox_command = # leave empty when using Maildir
- smtpd_banner = $myhostname ESMTP
- smtpd_tls_cert_file and smtpd_tls_key_file — paths to TLS cert and key (see TLS section)
- smtpd_recipient_restrictions — configure access and anti-relay rules
Minimal example snippet to add to main.cf:
myhostname = mail.example.com mydomain = example.com myorigin = $mydomain mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain inet_interfaces = all inet_protocols = ipv4 home_mailbox = Maildir/ smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem smtpd_use_tls = yes smtpd_tls_security_level = may After editing, reload Postfix:
sudo systemctl reload postfix User and mailbox setup
Two common approaches:
- System users (simple, quick)
- Create a Linux user per mailbox: sudo adduser alice
- Mail delivered to /home/alice/Maildir if home_mailbox = Maildir/
- Virtual users (recommended for SBS)
- Store users in a database (MySQL/Postgres) or in simple mapping files (/etc/postfix/virtual).
- Use Dovecot for authentication against virtual user DB and to provide IMAP/POP services.
Example /etc/postfix/virtual entry:
[email protected] info [email protected] sales Then run:
sudo postmap /etc/postfix/virtual sudo systemctl reload postfix Configure Dovecot to authenticate virtual users and point mail_location to Maildir locations.
TLS (encryption) — essential for security and deliverability
Use Let’s Encrypt to obtain free TLS certificates:
- Install certbot and obtain cert:
sudo apt install certbot sudo certbot certonly --standalone -d mail.example.com - Point Postfix and Dovecot to the certificate files:
- Postfix: smtpd_tls_cert_file and smtpd_tls_key_file (see earlier)
- Dovecot: ssl_cert and ssl_key in /etc/dovecot/conf.d/10-ssl.conf
Set appropriate permissions (private key readable only by root) and reload services. Configure automatic renewal hooks to reload Postfix/Dovecot after renewal:
sudo crontab -e # add: 0 3 * * * /usr/bin/certbot renew --quiet --deploy-hook "/bin/systemctl reload postfix dovecot" Authentication and relay control
Prevent open relay by restricting who can send mail via your server:
- smtpd_recipient_restrictions example:
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination - Enable SASL authentication (typically via Dovecot’s SASL): In /etc/postfix/main.cf:
smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymousIn /etc/dovecot/conf.d/10-master.conf, ensure a socket for Postfix:
service auth { unix_listener /var/spool/postfix/private/auth { mode = 0660 user = postfix group = postfix } }Reload both services.
Spam filtering and antivirus
Small businesses benefit from adding spam filtering and antivirus:
- SpamAssassin — classic, easy to integrate. Use amavisd-new to connect Postfix -> amavis -> SpamAssassin/ClamAV -> Postfix.
- Rspamd — modern, faster, with a web UI. Increasingly preferred over SpamAssassin for performance.
- ClamAV — antivirus scanner.
Simple architecture: Postfix (incoming) → amavis/rspamd + clamav → Postfix (final delivery) → Dovecot (IMAP)
Example packages to install:
sudo apt install rspamd clamav Configure Postfix to communicate with Rspamd using milter protocols (milter or LMTP).
Webmail and mobile access
- Dovecot provides IMAP/POP for mail clients (Outlook, Thunderbird, mobile apps).
- For webmail, Roundcube or RainLoop are popular choices. Install with a web server (nginx/apache) and connect to Dovecot’s IMAP.
- Configure SMTP submission port (587) in /etc/postfix/master.cf to allow authenticated clients to send mail:
submission inet n - y - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject
Deliverability: SPF, DKIM, DMARC, and PTR
- SPF: Add a TXT record specifying authorized senders, e.g.: v=spf1 mx ip4:203.0.113.5 -all
- DKIM: Use opendkim to sign outgoing mail. Generate keys, include the public key in DNS TXT.
- DMARC: Add a policy TXT record to instruct receivers how to handle spoofed mail.
- PTR: Ensure reverse DNS matches your mail server hostname to avoid being blocked.
Backups, monitoring, and maintenance
- Backup mailbox directories (Maildir) and configuration files (/etc/postfix, /etc/dovecot).
- Monitor mail queue with: mailq or postqueue -p
- Check logs: /var/log/mail.log (or /var/log/maillog)
- Watch disk space and inode usage — full disks cause mail delivery failures.
- Keep software updated and review logs for authentication failures or abuse.
Common troubleshooting steps
- Mail stuck in queue: inspect with mailq, view logs in /var/log/mail.log, and check connectivity to remote SMTP ports (telnet mail.target.com 25).
- Authentication issues: verify Dovecot SASL socket permissions and Postfix SASL settings.
- TLS errors: check certificate paths and permissions; ensure cert chain is correct.
- Delivery rejection: examine remote bounce messages for specific rejection codes (e.g., 550). Check blacklists and PTR/SPF/DKIM settings.
Example minimal checklist to go live
- Register domain and set MX + A records.
- Install Postfix and Dovecot.
- Configure mailboxes (Maildir) and user authentication.
- Obtain and configure TLS certificates.
- Enable SASL authentication and submission port 587.
- Configure SPF, DKIM, DMARC, and PTR.
- Add spam filtering/antivirus.
- Test sending/receiving from external accounts and mobile clients.
- Set up backups and monitoring.
Final notes
Running an SBS mail server gives you full control over your email, privacy, and policies. For small teams, Postfix combined with Dovecot, TLS, and basic anti-spam/antivirus provides a robust solution. Start simple, secure the basics (TLS, authentication, anti-relay), then add filtering and webmail as needed.
Leave a Reply