This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.
Who may send, and who may read
A mail server that accepts mail for your domains and a mail server that lets clients send are related and not the same listener. Submission is the authenticated port your users send through. The public port 25 receives mail from other servers for the domains you host. An open relay accepts mail from the world for domains you do not host, and you will not configure one. The lab uses a documentation address and a prefix you name, and production replaces both with the real domain and the real client prefix.
Postfix is a common MTA. Dovecot is a common way to serve mailboxes over IMAP. The generators on this site draft a main.cf shape and a Dovecot shape. Read them. A draft that sets mynetworks to every address is a draft you delete. mynetworks in the lab is 192.0.2.0/24 only if that is the lab you built, and in production it is the prefix your authenticated clients or your internal hosts actually use. Everyone else authenticates or is refused.
Mailboxes are files or a database with an owner. The permissions guide applies. A mailbox directory that other users can read is a privacy incident. Logs from the mail guide's logging setup will contain addresses. They should not contain passwords. If a debug flag prints a password, turn it off and rotate that password.
The security desk's email guide is the companion for SPF, DKIM, and DMARC. This page does not pretend those records are optional decoration, and it does not invent the DNS for you. Until those records exist, do not be surprised when other servers refuse or spam-folder your mail. Fix them as their own change.
A lab that receives for one name and does not relay
The lab hostname is edge-01.example.com and the domain you accept for is example.com, which you use only because it is a documentation name. Do not point a real domain at this lab by accident. The host accepts mail for example.com and refuses to relay for other domains. A test from the lab prefix to a local mailbox works. A test that tries to send to an unrelated domain, without authentication, fails. That failure is the proof you want.
Submission, if you enable it, requires authentication and TLS you have a certificate for, or it stays off in the lab. Do not enable submission on every interface with no password to see if a client works. The client test uses one account whose password is prompt-for-this in any note, replaced before the daemon starts, and never written into the ticket.
Dovecot, if the lab needs to read the mailbox, listens for that user and that mailbox path. It does not turn on a clear-text login on a public address. The config test for each daemon is the one the package documents. Reload only after it passes.
Write the accept domains, the mynetworks prefix, and the result of the refused relay test in the ticket. Rollback is the previous main.cf, which you kept.
# Review before you paste. Lab intent, not a complete config.
# Accept example.com only. Relay is not open.
# mynetworks is the lab prefix you named, never every address.
# A send to an unrelated domain without auth must fail.
# Replace prompt-for-this. Do not store the password in the ticket.A change you can finish
Production replaces example.com with a domain you host and replaces the prefix with the real client network. The refused-relay test is repeated after the change. DNS records from the security companion are a separate ticket that has to be true before you expect other servers to trust you.
Rollback is the previous configuration and a reload. You do not debug a possible open relay by widening mynetworks.
- List the domains you accept mail for.
- Set mynetworks to the prefix you operate, not to the world.
- Prove an unauthenticated send to an unrelated domain fails.
- Prove a local delivery to a lab mailbox works.
- Turn on submission only with authentication, and keep the password out of the ticket.
- Pass each daemon's config test before reload.
- Hand SPF, DKIM, and DMARC to their own change with the security companion.
Mistakes that outlive the command
mail server administration fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.
- mynetworks set to every IPv4 address so a client test would pass.
- An open relay left in place because the queue was finally moving.
- A real domain pointed at a lab that still accepts example.com defaults.
- Clear-text authentication on a public listener.
- A mailbox path that other users can read.
- Debug logs that include passwords.
- Calling the server done before the refused-relay test.
- Editing DNS SPF by guess in the same window as the first install.
Decisions to write down before the window
Decision 1 for mail server administration. Accepted domains are a list. example.com stays only in the lab. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 2 for mail server administration. mynetworks is a prefix you can draw. It is not every address. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 3 for mail server administration. Unauthenticated relay to other domains fails, and you have a transcript of that failure. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 4 for mail server administration. Submission requires authentication. The password is prompt-for-this in notes and real in the password store, not in the ticket. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 5 for mail server administration. Mailbox files follow the permissions guide. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 6 for mail server administration. Config tests pass before reload. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 7 for mail server administration. The generators' drafts were searched for a wide mynetworks and that line was removed. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 8 for mail server administration. SPF, DKIM, and DMARC are a companion change, not a paragraph you skip. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 9 for mail server administration. Logs do not contain passwords. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 10 for mail server administration. Rollback is the previous main.cf and dovecot config. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Decision 11 for mail server administration. A second person saw the refused relay. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.
Mail checks before the server accepts real mail
Check 1 in Mail checks before the server accepts real mail. The accept-domain list matches the ticket. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 2 in Mail checks before the server accepts real mail. mynetworks is the named prefix, not the world. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 3 in Mail checks before the server accepts real mail. An unauthenticated relay attempt failed. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 4 in Mail checks before the server accepts real mail. A local test message was delivered. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 5 in Mail checks before the server accepts real mail. Submission is authenticated or still off. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 6 in Mail checks before the server accepts real mail. No password is in the ticket or the log. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 7 in Mail checks before the server accepts real mail. Mailbox modes match the permissions guide. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 8 in Mail checks before the server accepts real mail. Both daemons passed their config tests. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 9 in Mail checks before the server accepts real mail. The previous configs are saved. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 10 in Mail checks before the server accepts real mail. example.com is not left in a production accept list. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 11 in Mail checks before the server accepts real mail. The security companion owns the DNS records and they are not guessed here. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 12 in Mail checks before the server accepts real mail. A second person saw the relay refusal. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 13 in Mail checks before the server accepts real mail. The queue is not full of mail to domains you do not host. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 14 in Mail checks before the server accepts real mail. The hostname in the prompt matches the hostname in the ticket for mail server administration. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 15 in Mail checks before the server accepts real mail. The result line includes the time and the person, not only the command. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 16 in Mail checks before the server accepts real mail. You can point at the rollback value without searching a chat history. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Check 17 in Mail checks before the server accepts real mail. Done is a sentence a second person can repeat: the proof for mail server administration happened, and the next host is not started early. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.
Tools for this guide
These tools run in the browser on this site. They do not log into your machines.
Related pillar guides
Guides in this cluster
These supporting pages belong to this pillar. A published page is linked. The others are named until they are published.
- How-To: Postfix as a Relay (Smarthost) Setup
- How-To: Managing the Postfix Mail Queue
- Troubleshooting: Troubleshooting Mail Delivery with Logs
- Comparison: Postfix vs Exim vs Sendmail
The content plan also names a companion in another desk: Security: Email Security Guide.