Postfix Relayhost Config for Amazon SES 2026

Why configure Postfix relayhost for Amazon SES?

You send 500 password reset emails a day. Your mail server slows down. Deliveries time out. Recipients don’t get them. You check the logs, see a few 554 errors, and remember: this isn’t the first time.

Amazon SES is designed to handle transactional emails at scale—order confirmations, password resets, alerts—without the overhead of running a fully-fledged mail server. But using it directly from your app or script isn’t always the cleanest path. That’s where Postfix, the industry-standard MTA, becomes your middleman.

Configuring Postfix as a relayhost for Amazon SES means your application sends emails to Postfix, which then securely forwards them through Amazon SES. It offloads the complexity of SMTP authentication, DNS alignment, and reputation management—while keeping your delivery consistent and reliable.

Key takeaways

• Postfix uses Amazon SES as a relayhost to send transactional emails at scale without managing your own outbound SMTP infrastructure.
• Proper authentication (using AWS IAM or SMTP credentials) and DNS alignment (SPF, DKIM) are required to avoid delivery rejection by Amazon SES.
• Without relayhost configuration, transactional emails risk being delayed, blocked, or bounced due to misaligned authentication or poor sender reputation.

What you need before setting up Postfix relayhost with Amazon SES

You need an active AWS account with IAM credentials, a verified domain or email in Amazon SES (in a supported region like us-east-1), a Postfix server with administrative access, and correctly configured DNS records for SPF, DKIM, and MX (if using custom domains). Optionally, verify recipient addresses with a tool like MailTester to reduce bounces and improve sender reputation.

Core prerequisites

• AWS account with IAM credentials: You must have an AWS account with programmatic access keys. These grant Postfix permission to send via Amazon SES using the SMTP interface. Never expose credentials in public repositories.
• Verified identity in Amazon SES: Before sending, you must verify either a domain or an individual email address in SES. This must be done in a region like us-east-1, which supports SMTP relaying. Unverified identities cannot send.
• Postfix server with admin access: The server must run Postfix (version 2.10 or later recommended) and have root or sudo access for configuration changes. Ensure the server can reach AWS endpoints over port 587 (TLS) or 465 (SSL).
• Proper DNS configuration: If using a custom domain, set up SPF to authorize Postfix as an approved sender, DKIM to sign outgoing messages, and MX records if you’re hosting email internally. Misconfigured DNS is a leading cause of delivery failure.

Best practices for reliability and deliverability

• Validate recipient addresses: Use a real-time email verification service like MailTester to catch invalid, disposable, or risky addresses before sending. This reduces bounces and protects your sender reputation. MailTester’s API or bulk checker can validate large lists before integration with Postfix. Check your list with MailTester.
• Monitor Amazon SES sending limits: SES enforces sending quotas (e.g., 14 messages per second, 200k per 24 hours in the sandbox). Use the AWS console or CloudWatch to track usage and request production access when needed.
• Use SMTP authentication: Always enable SASL authentication when configuring Postfix’s relayhost. This ensures AWS can verify the sender is authorized—without it, your messages won’t be accepted.
• Check your IP reputation: If your Postfix server’s IP is blacklisted, SES will bounce emails. Use tools like MxToolbox to check IP reputation and blocklist status.

Good deliverability isn’t just about setup—it’s about maintaining a clean sending reputation and validating every address before sending.

How Postfix relayhost works with Amazon SES

You configure Postfix to use Amazon SES as a relayhost by pointing it to SES’s SMTP endpoint over TLS. When your app or user sends an email, Postfix forwards it to SES instead of sending it directly. SES validates your AWS credentials, checks sending volume and reputation, then routes the message to the recipient’s mail server or quarantines it if it violates policies. This setup gives you scalable transactional email delivery with built-in compliance and deliverability tools.

SMTP relay flow from Postfix to Amazon SES

Postfix starts with a mail delivery request—say, from a web form or automated service. Rather than contacting the destination domain’s MX record directly, Postfix routes the message through your configured relayhost. If you’ve set Amazon SES as the relayhost, Postfix connects to ses-smtp.amazonaws.com on port 587 using TLS encryption.

During this TLS handshake, the connection is secured. Postfix then authenticates using your AWS access key and secret—specifically, the AWS SMTP credentials generated in the IAM console. The authentication step is mandatory; without valid credentials, SES rejects the message outright.

Amazon SES validation and delivery decision

Once the message arrives at SES, it undergoes a multi-layer validation process. Amazon checks your sending reputation, verifies your account’s sending limits (e.g., 14 messages per second for production), and applies content filtering to detect potential spam. These checks happen in real time and are based on established best practices in internet email security, as defined in RFC 5321 and RFC 5322.

If the message passes, SES attempts to deliver it to the final destination using standard SMTP across the public internet. If the recipient address is invalid (e.g., typo, non-existent), SES returns a hard bounce. If the message resembles spam or violates AWS policies (such as open relaying or suspicious content), it’s blocked or discarded.

Many teams use this model for automated transactional emails—password resets, order confirmations, notifications—where reliability and deliverability matter. You can monitor delivery status via Amazon SES’s built-in bounce and complaint metrics, which are accessible through the AWS Console or API.

For higher reliability, verify sender addresses with tools like MailTester’s email checker, which helps avoid invalid addresses before sending. You can also test inbox placement with MailTester’s inbox tester to simulate delivery across major providers and fine-tune content before sending at scale.

As part of a robust email strategy, using SES as a relayhost with Postfix is an industry-standard approach backed by AWS's global infrastructure. It’s trusted by companies of all sizes—especially those already using AWS for other services—to ensure consistent, compliant transactional delivery. You can learn more about AWS's email best practices via the official AWS SES documentation.

Configure Postfix relayhost for Amazon SES: step-by-step

You can set up Postfix to relay transactional emails through Amazon SES by updating the main configuration file, defining the SES SMTP endpoint as the relayhost, enabling SASL authentication with your AWS credentials, securing the connection with TLS, and reloading the service. This keeps your outbound emails in the inbox and avoids spam flags.

1. Edit the Postfix main configuration file: Run sudo nano /etc/postfix/main.cf to open the config file. This file controls how Postfix handles mail delivery and routing. Changes here apply globally to the mail server.
2. Set the relayhost to Amazon SES: Add or update the line relayhost = [email-smtp.us-east-1.amazonaws.com]:587. Replace the region (e.g., us-east-1) with the one closest to your users or where your SES credentials were created. This tells Postfix where to send outgoing mail.
3. Enable SASL authentication: Add two lines: smtp_sasl_auth_enable = yes and smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd. SASL prevents unauthorized use of your mail server by requiring AWS credentials to authenticate with SES’s SMTP interface.
4. Create the SASL password file: Use sudo nano /etc/postfix/sasl_passwd to create a file containing the SES endpoint and your AWS access key and secret, formatted like: [email-smtp.us-east-1.amazonaws.com]:587 aws-access-key:aws-secret-key. Replace both placeholders with your actual AWS credentials.
5. Compile the password map: Run sudo postmap /etc/postfix/sasl_passwd. This converts the plain-text file into a binary hash map that Postfix can efficiently read at runtime.
6. Secure the password file: Run sudo chown root:root /etc/postfix/sasl_passwd* and sudo chmod 600 /etc/postfix/sasl_passwd*. These commands ensure only the root user can read or modify the file—critical to prevent credential leaks.
7. Configure TLS security: Add smtp_tls_security_level = may to allow encrypted connections when possible. Also set smtp_tls_session_cache_database = btree:/etc/postfix/smtp_sasl_tls_cache to improve connection performance across repeated sends. For more on TLS in email, see RFC 5246 (IETF TLS Documentation).
8. Reload Postfix configuration: Run sudo systemctl reload postfix to apply all changes without restarting the service. The server will now route outbound mail through Amazon SES using your AWS credentials.

Verify your setup

After configuration, send a test email and check the logs at /var/log/mail.log for success messages like “Connected to [email-smtp.us-east-1.amazonaws.com]” and “Authentication succeeded.” If you see connection errors, verify your credentials, region, and whether your AWS SES account is in production mode.

Use with caution

Ensure you’ve verified sender identities in Amazon SES (via AWS SES Console) before sending. Sending from unverified addresses results in bounces. You can reduce delivery risk further by using a real-time email checker like MailTester’s email checker to validate addresses before sending.

Key AWS IAM permissions for Amazon SES relay access

You need an IAM user or role with ses:SendRawEmail to relay via Postfix and Amazon SES. If using simplified SMTP, include ses:SendEmail as well. Attach the policy to a programmatic access identity, and use temporary credentials via AWS STS in automation to reduce exposure. This prevents hard-coded keys and aligns with least-privilege principles. For reference, AWS documentation outlines the required permissions in detail. You can test your setup with real email environments using tools like MailTester’s inbox placement tester.

Essential IAM permissions

• Grant ses:SendRawEmail to allow sending email via SES using raw message format, which is required when using Postfix as a relay.
• If your application uses simplified SMTP (e.g., SendEmail API), include ses:SendEmail in the policy.
• Never assign these permissions directly to an AWS root account. Use a dedicated IAM user or role with programmatic access.
• Ensure the policy is attached to a user or role with no inline policies if possible—use managed policies for easier maintenance and auditing.

Security best practices for automated environments

• Always use temporary credentials via AWS Security Token Service (STS) in scripts, CI/CD pipelines, or long-running processes.
• Set short expiration intervals—15–60 minutes is typical—to limit the window of compromise.
• Use IAM roles with trust policies that restrict source accounts, such as EC2 instances, Lambda functions, or specific VPCs.
• Rotate access keys regularly and monitor for unusual activity with AWS CloudTrail.

While you're setting up your relay, verify that your email addresses are valid to avoid bounces or reputation damage. You can check individual addresses or bulk lists using MailTester’s email checker or bulk verification tool. If you're testing deliverability, MailTester’s inbox placement tester can help simulate real-world conditions across major email providers.

Validate your email delivery path with a real-time test

Send a test message to a known inbox like Gmail or Outlook right after configuring Postfix relayhost for Amazon SES. Check /var/log/mail.log for successful delivery, authentication, and TLS handshake completion. Use MailTester’s real-time verification API to pre-check recipient validity and avoid sending to invalid or risky addresses. Clean your list with bulk verification to reduce bounces, spam trap hits, and damage to sender reputation.

Check your Postfix logs for delivery confirmation

After sending a test email, inspect /var/log/mail.log for key signals: successful SMTP authentication, a TLS handshake, and a final "sent" status. If you see status=sent (250 2.0.0 OK), your relay configuration is working. Absent or failed authentication logs often point to misconfigured credentials in your main.cf or sasl_passwd file. Use the SMTP RFC (5321) as a reference for required handshake behavior.

Pre-validate recipients to prevent delivery failures

Even with a working relay, sending to invalid, catch-all, or disposable addresses wastes resources and harms deliverability. Before sending at scale, run your list through MailTester’s real-time verification API to filter out invalid or risky addresses. You’ll get precise feedback on each email: valid, invalid, catch-all, or risky. This reduces bounce rates and avoids spam trap exposure — common causes of sender reputation damage.

For longer-term list hygiene, use MailTester’s bulk email list verification to clean entire lists in minutes. This process detects role addresses (like admin@), disposable domains, and inactive accounts. It’s an essential step in maintaining consistent inbox placement. Many senders see a 20–30% drop in bounces after cleaning their lists — a measurable improvement in deliverability, especially when using transactional email services like Amazon SES.

Once your test emails arrive and logs confirm proper TLS and authentication, and validated addresses are confirmed through real-time checks, you can proceed with confidence. Never assume delivery works — always verify the full path from Postfix to the end user’s inbox. This step ensures your transactional email system behaves as expected during real use.

Common pitfalls in Postfix-Amazon SES relay setups

Setting up Postfix to relay through Amazon SES is straightforward—until it isn’t. Common issues include misconfigured AWS region endpoints, hardcoded credentials, missing DKIM signing, untested sends, and hitting daily limits. These mistakes cause delivery failures, reputational damage, and throttling. Let’s walk through the most frequent ones and how to avoid them.

Configuration and credential risks

• Using the wrong AWS region endpoint (e.g., email.us-east-1.amazonaws.com instead of email.eu-west-1.amazonaws.com) will result in immediate connection timeouts. Always verify your SES region matches your AWS account's selected region.
• Hardcoding AWS access keys in main.cf or master.cf exposes them in plain text, increasing the risk of accidental exposure. Use encrypted credential storage or environment variables instead.
• Never treat SES credentials like passwords. They should rotate regularly and be scoped to the minimum required permissions—using an IAM role or user with SendEmail access only.

Sending and deliverability traps

• Missing DKIM signing causes many receivers to flag your messages as suspicious or spam. Enable DKIM in Amazon SES and ensure it's correctly configured in your DNS records. Without it, even legitimate emails may fail validation.
• Never send a full mailing list without testing first. A small batch of 10–20 messages lets you verify delivery, alignment, and content rendering before scaling up. This prevents mass bounces and helps you catch deliverability issues early.
• New SES accounts are limited to 140,000 emails per 24 hours by default. Exceeding this limit triggers throttling. Monitor your sending rate and consider using the SES sending limits dashboard in the AWS Console or third-party tools like Amazon SES documentation to track usage.

These issues are avoidable—but only if you validate before you scale. You can pre-check your list with real email verification tools. For example, MailTester’s bulk verification identifies invalid, disposable, and high-risk addresses before they hit your relay, improving your sender reputation from the start.

How MailTester improves deliverability after relay setup

Once your Postfix relayhost is configured to send through Amazon SES, using MailTester to clean your list before sending stops bounces, improves inbox placement, and protects your sender reputation. You’re not just sending to more addresses—you’re sending to better ones.

Pre-send list cleaning with bulk verification

Before sending transactional emails through your Postfix relay, verify your entire list with MailTester’s bulk verification tool. It checks each address for validity, catch-all status, and disposable domains in real time, so you’re not wasting SES sends on bad addresses. This directly reduces your bounce rate and helps maintain a strong sender reputation with major ISPs.

Target the right recipients

MailTester flags catch-all addresses—common in low-engagement domains—that accept any email but rarely open messages. Sending to them inflates your soft bounce rate and harms deliverability. The tool also identifies role-based addresses like admin@ or info@, which rarely engage and are often associated with poor inbox placement. Removing these improves your engagement signals.

Disposable domains—common in bot-driven signups—can hurt your reputation if included. MailTester detects them with high precision, so you avoid sending to temporary addresses that offer no deliverability value and may trigger spam filters. This is especially important when sending transactional emails, where inbox placement is critical.

Finally, use MailTester’s inbox-placement testing to confirm your messages land in the primary inbox tab across Gmail, Yahoo, Outlook, and other major inboxes. This test simulates real delivery conditions, giving you confidence that your Postfix + SES setup isn’t just technically correct—it’s actually working in practice.

For continuous verification, integrate MailTester’s API to check addresses at the point of signup. This prevents invalid or risky addresses from ever entering your system. You can find the full range of verification options, including real-time checks and integration setup, at our integrations page. If you're testing a small batch of addresses, use the email checker for instant results.

MailTester doesn’t replace SMTP or MTAs like Postfix—it enhances their reliability. By filtering out problematic addresses and validating delivery performance, it’s an essential step after setting up your relayhost. For more details on how verification impacts deliverability, refer to RFC 5321, which defines how MTAs handle message delivery. The core principle remains: send only to addresses you're confident will receive and engage.

Integrating MailTester with mail sending workflows

You can prevent bounces, improve deliverability, and save sending costs by validating email addresses before they enter your pipeline—whether during user signups, bulk campaigns, or automated workflows. Use MailTester’s real-time API in registration flows, run scheduled bulk checks on your list, leverage the in-app AI assistant to interpret results, and sync with top platforms like Mailchimp and SendGrid to verify before sending.

Core integrations for reliable sending

• Embed MailTester’s real-time verification API directly into your user registration or onboarding process to catch invalid or risky addresses before they’re stored.
• Run regular bulk verification jobs on your email list via MailTester’s bulk verification tool, using your existing list to flag hard bounces, catch-alls, and disposable domains before a campaign launches.
• Use the in-app AI assistant to quickly interpret complex verification verdicts—like "risky" or "catch-all"—and receive clear, actionable suggestions for cleaning or segmenting your list.
• Sync MailTester with platforms like Mailchimp, HubSpot, Klaviyo, and SendGrid through our native integrations to automatically verify list segments before each send, reducing inbox placement risk and protecting sender reputation.
• Test inbox placement in real inboxes using our inbox placement tester to see how your message performs across major providers before your first campaign.
• Check individual addresses before sending with the single-address email checker, especially useful in transactional workflows where delivery failure isn’t an option.

Practical considerations

MailTester’s 98.9% accuracy rate is based on real-world testing across domains, including role-based accounts, catch-alls, and temporary addresses. Real-time validation through the API adds milliseconds to signup flows—no user experience hit. Bulk runs take hours, not days, and results integrate cleanly into your CRM or ESP.

SMTP relay configurations (like AWS SES + Postfix) focus on delivery—but verification comes before the first connection. You can’t control how a domain treats your messages if you’re sending to invalid or abused addresses. That’s where pre-sending validation matters.

When combined with DMARC, SPF, and DKIM—industry-standard sender authentication practices—email verification ensures only legitimate, deliverable addresses are used. For context, RFC 5321 defines SMTP envelope behavior, including how receivers handle invalid recipients. Verification is the first line of defense.

Why sender reputation matters with Amazon SES relay

You’re not just sending emails with Amazon SES—you’re building a reputation. SES tracks your sending volume, bounce rates, and spam complaints in real time. A single spike in bounces or a surge in complaints can trigger throttling, limit your send volume, or even suspend your account. Keeping your sender reputation strong starts with clean data, not just technical setup.

Reputation is tied to behavior, not just configuration

Amazon SES doesn’t care about your Postfix relay configuration if your list is full of invalid or risky addresses. Even if your relay is perfectly set up, poor sending behavior—like emailing inactive users or sending to known spam traps—will degrade your reputation. This impacts inbox placement, deliverability, and your ability to scale.

High bounce rates or spam complaints are red flags. If your bounce rate exceeds 2% in a 24-hour window, SES may throttle your sending. A single complaint from a recipient can result in long-term scrutiny, even if the rest of your list is clean. It’s not enough to send emails. You must send responsibly.

Hygiene is the foundation of reputation health

Invalid addresses, disposable domains, and spam traps don’t just waste bandwidth—they actively hurt your sender score. Each bounce or complaint signals poor list management. The better your data, the lower your risk of triggering SES’s safety mechanisms.

MailTester’s 98.9% accuracy in identifying invalid, risky, or disposable addresses gives you a real-world edge. It doesn’t just verify syntax—it checks real mailbox behavior, catch-all domains, and known disposable domains in real time. Use it before sending to catch problematic addresses early.

Check your list with MailTester’s bulk verification tool to ensure every email is valid and safe to send: verify your bulk email list.

Proper list hygiene is not optional—it’s a prerequisite for long-term success with SES. Tools like MailTester help you maintain sender health without overhauling your entire infrastructure.

Maintain reliable delivery: monitor and optimize

Even with a correct Postfix relayhost configuration for Amazon SES, deliverability depends on consistent list hygiene and ongoing system monitoring.

Key practices for sustained inbox placement

• Regularly audit your email list with MailTester to identify and remove invalid, catch-all, or disposable addresses before sending.
• Use Amazon SES and AWS CloudWatch to track hard bounces, soft bounces, and complaint rates. Trends above 0.1% for complaints or 2% for hard bounces signal issues needing action.
• Warm up new domains gradually—start with low-volume sends over 7–14 days to signal reliability to recipient providers.
• Verify SPF, DKIM, and DMARC alignment for every sending domain. Misalignment causes authentication failures, even with proper relayhost setup.

Reliable transactional delivery isn't set and forgotten. It requires continuous oversight and adjustment based on real-time data.

Sources

• The platform-wide average cold email reply rate is 3.43%, while the top 25% of senders achieve 5.5%+ and the top 10% reach 10.7%+, based on billions of emails sent in 2025. — Instantly Cold Email Benchmark Report 2026 (via Satellyte) (2026)
• Adding a single follow-up email to a cold outreach sequence generates roughly 40–50% more replies than sending the initial email alone. — Instantly Cold Email Reply Rate Benchmarks (2026)

Keep reading

• Deliverability testing inside your ESP, CRM and sending platform (complete guide)
• Secure Email Sending with Mailchimp App Domain & Verification
• Return-Path and From Header Mismatch in AWS SES: How to Fix
• ActiveCampaign Authenticated Custom Domain for Email Tracking & Analytics
• Postfix Relayhost with Mailgun for Transactional Email Delivery and Verification

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What is Postfix relayhost and why use it with Amazon SES?

Postfix relayhost forwards outgoing mail through a designated SMTP server. Using it with Amazon SES lets you offload delivery, authenticate securely, and improve inbox placement.

Can I use Amazon SES without Postfix relayhost?

Yes, but you can use Amazon SES directly via its SMTP interface or SDK. Relayhost is helpful when you want to centralize outbound mail from multiple services under one authenticated path.

How often should I verify my email list?

Verify new lists before sending, and re-verify every 90 to 120 days to maintain accuracy and sender reputation.

What does a 'catch-all' email verification result mean?

A catch-all address accepts all messages, regardless of recipient. It often signals a weak or unverified email system, increasing the risk of spam complaints and poor deliverability.

Does MailTester work with AWS SES and Postfix?

Yes. MailTester’s real-time API and bulk list verification help ensure your recipient list is clean before sending via Postfix and Amazon SES.

Why are my emails going to spam with Postfix and Amazon SES?

Check SPF/DKIM/DMARC alignment, avoid sending to invalid or disposable addresses, and verify your list with MailTester to eliminate high-risk emails.

Can MailTester help detect disposable email domains?

Yes. MailTester identifies disposable and temporary domains that are commonly used by bots and should be removed from transactional lists.

How do I know if my Postfix relayhost is working?

Check Postfix logs for successful delivery to [email-smtp.region.amazonaws.com]. Test with a known email address and review AWS SES sending metrics.

What is the AWS SES sending limit for new accounts?

New accounts have a default limit of 140,000 emails per 24 hours and 14 messages per second. Limits can be increased via a request in the SES console.

Why do I need to verify my domain in Amazon SES?

Verification ensures you own the domain and helps prevent spoofing. It’s required for sending emails via SES unless using a verified individual email.

Can I use MailTester to verify domains or only addresses?

MailTester verifies individual email addresses for validity, catch-all status, risk level, and whether they are disposable or role-based. It does not verify domain infrastructure.

Do MailTester credits expire?

No. Once purchased, credits never expire. You start with 100 free verifications, and any purchased credits remain available indefinitely.