Postfix Configuration

Postfix must be configured as a mail relay (smarthost gateway). Its purpose is to:

Accept unencrypted SMTP connections (no TLS, no AUTH) from trusted internal devices.
Forward all outgoing mail to an external SMTP relay.
Enforce TLS encryption for outbound delivery.
Operate using an IP-based trust model (without SMTP authentication).

Core Configuration Concepts

If parameters are not explicitly mentioned, they remain unchanged from the default configuration.

The configuration file is usually located at:

/etc/postfix/main.cf

If you cannot find the configuration file, the following command displays the location of the file:

# postconf config_directory

To display only active Postfix configuration parameters:

# postconf -n

Identity and Host Configuration

myhostname = raspi.customerdomain.com
      myorigin = $myhostname
      smtp_helo_name = raspi.customerdomain.com

This configuration defines the system identity used in:

SMTP HELO/EHLO
Locally generated emails

This ensures a consistent and valid hostname is presented to the upstream relay.

Network and Trust Boundary

inet_interfaces = all
        
        mynetworks = 127.0.0.0/8 [::1]/128 10.0.1.0/24
        mynetworks_style = host

This configuration:

Allows Postfix to listen on all interfaces
Restricts relay usage to trusted IP ranges. Only clients within the following IP ranges are allowed to relay mail:
- localhost
- Internal subnet 10.0.1.0/24

This prevents the system from becoming an open relay.

It is recommended to leave mynetworks_style = host and manually define allowed trusted networks using the mynetworks parameter.

Ensure that you replace, add, or remove networks or interfaces according to the IP ranges for which you want to allow the relay to be used.

Relay Restrictions

smtpd_relay_restrictions =
      permit_mynetworks
      permit_sasl_authenticated
      reject_unauth_destinations

This parameter is one of the most important security mechanisms in Postfix because it prevents the server from being abused as an open relay.

smtpd_relay_restrictions defines the access control rules for SMTP relay requests in Postfix. It determines which clients are allowed to relay emails through the server to external domains.

This configuration:

Allows relaying only for:
- permit_mynetworks: Trusted networks defined in mynetworks.
- permit_sasl_authenticated: Authenticated SMTP users (reserved for future compatibility).
Avoids open relay or relay to other domains:

reject_unauth_destinations: Blocks unauthorized relay attempts or destinations.

Inbound SMTP

smtpd_tls_security_level = none

This configuration:

Disables TLS requirements for incoming SMTP.
Allows legacy devices (for example, printers) to send email without encryption.

Outbound SMTP (to relay)

relayhost = [eu-west-1.cp-mta.com]:587

This configuration forwards all outgoing mail to the smart host.

Note:

Use square brackets to reduce the risk of MX lookups (with brackets, no MX lookup will be done, only A/AAAA record lookup, direct delivery to this host is enforced).
Ensure that you enter the correct relay address. You can find the address in the Email Security Portal.

TLS Enforcement

smtp_tls_security_level = encrypt
      smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
      smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

This configuration:

Enforces TLS encryption for all outbound SMTP connections.
Uses the system CA store for certificate validation.
Enables TLS session caching for performance optimization.

No SMTP Authentication

smtp_sasl_auth_enable = no

This configuration:

Disables SMTP authentication.
Assumes the relay trusts the source IP address (IP whitelisting).

TLS Certificates (Inbound)

smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
      smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key

These are default self-signed certificates.
They are included for completeness but are not actively used because inbound TLS is disabled.

Local Delivery Settings

mydestination = $myhostname, raspi, localhost.localdomain, localhost
      mailbox_size_limit = 0
      mailbox_command =

Local delivery is not a primary use case.
Mailboxes are effectively unused.
The system acts primarily as a relay.

Aliases

alias_maps = hash:/etc/aliases
        alias_database = hash:/etc/aliases

This configuration enables standard alias handling for system users.

Compatibility Level

compatibility_level = 3.9

This ensures that Postfix uses modern default behaviors aligned with Postfix version 3.9.