Appendix M: Configuring Postfix as an Internal SMTP Relay for Non‐TLS Senders to Check Point Cloud SMTP Relay

Overview

Check Point Cloud SMTP Relay accepts SMTP connections only when they are encrypted with TLS.

Some internal systems, applications, printers, scanners, or legacy services may need to send email through Check Point Cloud SMTP Relay, but may not support TLS encryption. In such cases, you can use an internal mail relay as an intermediary.

This guide explains how to configure Postfix on Linux as an internal SMTP relay. Postfix accepts SMTP connections from trusted internal senders that do not support TLS and securely forwards those email messages to Check Point Cloud SMTP Relay using a TLS-encrypted connection.

Postfix is a widely used open-source Mail Transfer Agent (MTA) that supports secure SMTP communication using TLS encryption. Its official documentation includes support for TLS-encrypted SMTP sessions.

Use Case

Use this configuration when an internal sender needs to send email through Check Point Cloud SMTP Relay but cannot establish a TLS-encrypted SMTP connection directly.

In this setup:

Non-TLS sender > Postfix internal relay > TLS-encrypted connection > Check Point Cloud SMTP Relay

The connection between the sender and Postfix may be unencrypted, but the connection from Postfix to Check Point Cloud SMTP Relay must use TLS encryption.

Security Considerations

  • Relay access is restricted to internal networks.

  • TLS is enforced for outbound traffic.

  • No open relay exposure.

Limitations

  • No TLS for inbound connections (intentional for legacy devices).

  • Trust model is network-based not identity-based.

Prerequisites

Before configuring Postfix as an internal SMTP relay, ensure that the following requirements are met:

  • Linux Server for the Internal Relay

    A Linux server is required to host Postfix. Deploy the Linux server inside the customer's trusted internal network.

  • Software Requirements

    • Postfix

    • Check Point Cloud SMTP Relay

  • Postfix Installation

    Install and configure Postfix as the local SMTP relay.

  • Network Access to Check Point Cloud SMTP Relay

    The Postfix server must be able to make outbound SMTP connections to Check Point Cloud SMTP Relay on the required SMTP port.

  • Trusted Internal Senders only

    Allow only approved internal systems to send email through the Postfix relay. The relay must not be exposed as an open relay.

  • TLS Support on the Postfix Server

    Configure Postfix to forward all outbound email to Check Point Cloud SMTP Relay using TLS encryption.

  • IP-Based Authentication

    Check Point Cloud SMTP Relay currently authenticates the relay based on the source IP address of the Postfix server. The public outbound IP address used by the Postfix server must be allowed in the Check Point Cloud SMTP Relay service.

    Note:

    Additional SMTP authentication mechanisms (such as username/password authentication) are planned and will be documented when available.

  • Basic Linux Administration Knowledge

    This guide assumes familiarity with:

    • Installing Linux packages

    • Editing configuration files

    • Restarting services

    • Reviewing system logs

Architecture