Integration Guide

Postfix Smarthost
Configuration

Deliver all emails sent from your Postfix server through the MXGate smarthost (with SASL authentication and TLS). Works on Ubuntu, Debian, CentOS, RHEL and other Linux distributions.

main.cf + SASL TLS Encryption ~15 min Setup

Prerequisites

Root or sudo access
Postfix installed and running
SMTP username and password created from MXGate panel
libsasl2-modules and sasl2-bin packages (usually installed by default)

What does this guide do? Ensures all emails sent from your Postfix server are delivered through the MXGate smarthost (with authentication). Your outgoing emails are thus delivered from a clean IP pool, encrypted and authenticated.

Setup Steps

Postfix Configuration in 6 Steps

Backup main.cf File

Take a backup of the Postfix configuration file just in case:

# Create a backup:sudo cp /etc/postfix/main.cf /etc/postfix/main.cf.backup.$(date +%Y%m%d) # Check the current relayhost setting:sudo postconf relayhost

Configure main.cf

Edit the Postfix main configuration file. Add the following settings to the end of the main.cf file:

Open main.cf

sudo nano /etc/postfix/main.cf

/etc/postfix/main.cf

# ============================================# MXGate Smarthost Configuration# ============================================relayhost = [smtp.mxgate.com.tr]:587 # SMTP Authenticationsmtp_sasl_auth_enable = yessmtp_sasl_password_maps = hash:/etc/postfix/sasl_passwdsmtp_sasl_security_options = noanonymoussmtp_sasl_mechanism_filter = plain, login # TLS Encryptionsmtp_tls_security_level = encryptsmtp_tls_loglevel = 1smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt # Connection settingssmtp_connect_timeout = 30ssmtp_helo_timeout = 30s

Square brackets [] ensure the hostname is used directly instead of looking up MX records.

Create SASL Password File

Create the password file containing SMTP authentication credentials:

/etc/postfix/sasl_passwd

sudo nano /etc/postfix/sasl_passwd # File content (single line):[smtp.mxgate.com.tr]:587 MXGATE_KULLANICI_ADI:MXGATE_SIFRE # Example:[smtp.mxgate.com.tr]:587 user@domain.com:SecureP@ss123

Security: This file must not be readable by any user other than root.

Set permissions and build hash

# Set file permissions:sudo chmod 600 /etc/postfix/sasl_passwdsudo chown root:root /etc/postfix/sasl_passwd # Build the hash database with postmap:sudo postmap /etc/postfix/sasl_passwd # Check the generated files:ls -la /etc/postfix/sasl_passwd*

TLS/SSL Certificate Settings

Set the CA certificates path according to your distribution for TLS encryption:

Debian / Ubuntu

smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

RHEL / CentOS / Rocky

smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt

Verify the CA file exists

# For Debian/Ubuntu:ls -la /etc/ssl/certs/ca-certificates.crt# Install if missing:sudo apt-get install ca-certificates # For RHEL/CentOS:ls -la /etc/pki/tls/certs/ca-bundle.crt# Install if missing:sudo yum install ca-certificates

Reload Postfix Configuration

Reload Postfix to apply configuration changes:

Reload / restart

# Reload configuration (without stopping):sudo postfix reload # Or restart the service:sudo systemctl restart postfix # Or:sudo service postfix restart

Status and verification

# Check service status:sudo systemctl status postfix # Validate configuration:sudo postfix check

Testing and Verification

Test if the configuration is working:

Send a test email

# Send a test email:echo "Subject: Test Mail" | sendmail -v test@example.com # Or with the mail command:echo "Test body" | mail -s "Test Subject" -a "From: sender@yourdomain.com" recipient@example.com # Watch the Postfix logs:sudo tail -f /var/log/mail.log# or:sudo tail -f /var/log/maillog

What you should see in the logs

# Successful connection:"smtp.mxgate.com.tr[IP]:587: 250 2.0.0 Ok: queued as" # Authentication successful:"Trusted TLS connection established to smtp.mxgate.com.tr" # If there is an error you will see:"SASL authentication failed"

Success! All your outgoing emails are now delivered encrypted and authenticated through MXGate.

Troubleshooting

Common Errors

How do I fix the "SASL authentication failed" error in Postfix?

Check the username/password. Verify the mapping with the command below, then re-run the postmap command and check the file permissions (600, root:root):

sudo postmap -q [smtp.mxgate.com.tr]:587 /etc/postfix/sasl_passwd

Why does Postfix throw an "Unable to verify certificate" error?

Ensure the CA certificate file is in the correct path. Alternatively you can relax TLS verification (not recommended):

smtp_tls_security_level = may

Why does Postfix return a "Connection refused / timed out" error?

The firewall (ufw, firewalld, iptables) may not allow outbound access to port 587. Also ensure your hosting provider does not block SMTP ports.

How do I resolve the "Relay access denied" error in Postfix?

Ensure your server IP is whitelisted in the MXGate panel and that the authentication credentials are correct.

Distribution Specific Notes

Ubuntu / Debian

main.cf: /etc/postfix/main.cf
Log: /var/log/mail.log
CA: /etc/ssl/certs/ca-certificates.crt

CentOS / RHEL / Rocky

main.cf: /etc/postfix/main.cf
Log: /var/log/maillog
CA: /etc/pki/tls/certs/ca-bundle.crt

Plesk

Exim

Support

Need help?

If you get stuck, our 24/7 support team is here. Let's complete your Postfix configuration together.

Need help? All Guides

Postfix SmarthostConfiguration