Postfix: Setting Up a Mail Server on a VPS

Installing Postfix

apt install postfix -y
# During installation choose: Internet Site
# System mail name: yourdomain.com

Main main.cf parameters

# /etc/postfix/main.cf
myhostname = mail.yourdomain.com
mydomain = yourdomain.com
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, $mydomain

# TLS
smtpd_tls_cert_file = /etc/letsencrypt/live/yourdomain.com/fullchain.pem
smtpd_tls_key_file  = /etc/letsencrypt/live/yourdomain.com/privkey.pem
smtpd_use_tls = yes
smtpd_tls_security_level = may

# Relay restrictions
smtpd_relay_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination

Testing the setup

# Send test
echo "Test email" | mail -s "Subject" test@example.com

# View queue
mailq

# Logs
tail -f /var/log/mail.log

Common Postfix configuration mistakes

Most mail problems on a VPS show up right in the logs — learn to read them.

554 5.7.1 <user@example.com>: Relay access denied

The server rejects the message because the sender isn't in mynetworks and didn't pass SASL authentication, while the recipient isn't a local domain. Check smtpd_relay_restrictions in main.cf: if your application sends mail from the same server via localhost, add 127.0.0.1/32 to mynetworks.

connect to 127.0.0.1[127.0.0.1]:10024: Connection refused (port 10024)

Postfix is configured to pass mail through a content filter (Amavis, Rspamd) on port 10024, but the filter itself isn't running or isn't installed. Check systemctl status rspamd, or remove the content_filter line from main.cf if you don't need filtering.

Received-SPF: fail (domain owner discourages use of this host)

The recipient checked the domain's SPF record and didn't find your server's IP in it. The message gets flagged as suspicious or rejected outright. Add the VPS IP address to the domain's SPF record — see SPF, DKIM and DMARC setup.

Maildir vs mbox: mail storage formats

Modern Postfix with Dovecot uses Maildir by default — set with the home_mailbox = Maildir/ parameter in main.cf. There's no reason to switch to mbox today.

When Postfix on a VPS doesn't fit

Running your own mail server for 10-20 transactional emails a day is overkill: it's simpler to plug in an SMTP relay (SendGrid, Mailgun, Amazon SES) without worrying about IP reputation and SPF/DKIM. A fresh VPS IP address has no sending history — mail providers will bulk-route your first messages to spam until the IP "warms up" over weeks of gradually growing volume. If the PTR record for the server's IP address isn't set up (see reverse DNS and PTR records), large mail services like Gmail reject messages without explanation — that's the first thing to check before digging into the rest of the settings.

How to verify the result

Don't rely on "the message arrived" alone — check the queue, encryption, and signature separately:

# Mail queue
mailq

# Test TLS connection
openssl s_client -connect mail.example.com:587 -starttls smtp

# Check DKIM key
opendkim-testkey -d example.com -s mail -vvv

The best external test is mail-tester.com: send a message to the address it provides and get a score covering SPF, DKIM, DMARC, blocklists, and message content. A score below 8/10 usually means at least one of the points above needs fixing.

Before restarting the service, always check the configuration syntax with postfix check — a typo in main.cf doesn't always bring Postfix down right away, but it can cause a silent failure to accept mail on new connections. That kind of bug is easy to miss, because the service formally keeps running, and the logs show only a single rejection line for one connection rather than an obvious cause.

Frequently asked questions

How long does it take to get ports 25/465/587 opened after a support request, and can you avoid needing them at all?

There is no fixed timeline — each request is reviewed individually rather than by template, checking the customer's track record and the purpose for the ports. You can skip the request by sending mail through an email provider's HTTP API instead: it runs over port 443 and is not subject to the restriction, so many projects never need a ticket.

Do you also need to install Dovecot to read mail in an email client, or does Postfix handle that on its own?

Yes, Postfix only receives and sends mail over SMTP; accessing a mailbox from an email client over IMAP or POP3 needs a separate service, most commonly Dovecot. Without it, messages are technically delivered and stored on the server, but there is no way to read them in Outlook, Thunderbird, or on a phone.

If you migrate an already working mail setup to a new VPS, does the IP address need to be warmed up again?

Yes, sender reputation is tied to the specific IP address, not to the domain or message history, so warm-up starts over whenever the server changes. To reduce the risk of landing in spam on the new address, ramp up sending volume gradually, keep SPF and DKIM in order, and keep the previous IP if the provider's migration process allows it.

Is it safe to run Postfix and a web server together on the same VPS?

Running both together is not dangerous by itself: Postfix and the web server are independent services that use different ports and usually coexist fine on one VPS. What matters more is keeping their configuration and logs isolated from each other, and making sure a vulnerability in the web application cannot let an attacker turn the server into a spam source.