Postfix Relayhost Setup

Why Configure Postfix Relayhost for SMTP Relays?

You’re running a mail-enabled app. Your logs show emails stuck in the queue. No bounce, no delivery—just silence. You’ve checked DNS, SPF, DKIM, even your server’s IP reputation. It’s clean. So why won’t the mail go out?

Chances are, your server’s IP is blocked, blacklisted, or simply lacks a proven sender reputation. Postfix is built to route mail, not to deliver it at scale. When your infrastructure can’t reliably reach inbox providers, the only sustainable fix is to offload sending to an SMTP relay with a reputation you can trust.

That’s where Postfix relayhost configuration comes in. It redirects outgoing mail through a curated SMTP relay—like a trusted courier handling the last-mile delivery for your message. This isn’t just a workaround. It’s how systems without sender reputation maintain inbox placement, especially in bulk sending or hosted environments.

Key takeaways

Postfix relayhost configuration is essential when your server IP lacks proven deliverability or is blacklisted.
Offloading sending to a trusted SMTP relay improves inbox placement by leveraging established sender reputation.
This setup is mandatory for bulk email operations or hosted platforms unable to maintain consistent sending reputation.

]

What Is a Relayhost? How It Works in Postfix

You use a relayhost to send outbound email through an external SMTP server—like SendGrid, Amazon SES, or Mailgun—instead of your own mail server. Postfix forwards every outgoing message to this relayhost, which handles delivery, applies sender authentication checks (SPF, DKIM), and maintains reputation. This lets you bypass the need to warm up IP addresses or manage DMARC alignment from scratch. You’re relying on the relayhost’s established reputation and compliance practices, which is standard in production environments.

Why Use a Relayhost Instead of Direct Sending?

When you send directly from your own server, you’re responsible for maintaining a clean IP reputation, setting up proper DNS records, and avoiding spam traps. That’s hard, especially if your domain is new. A relayhost takes on those responsibilities. It verifies your identity, manages deliverability, and routes mail through high-performing infrastructure. This reduces the risk of your messages being rejected or labeled as spam.

For example, if your mail server isn’t properly authenticated or lacks a good sending history, major ISPs may reject your email or send it to spam folders. With a relayhost, you're leveraging a system that has already passed those barriers. According to industry best practices, sending through a reputable third-party SMTP service greatly improves inbox placement over self-hosted sending, which is why platforms like SendGrid and AWS SES are widely used for transactional and marketing emails.

How Postfix Handles the Relay Process

When configured properly, Postfix treats the relayhost as a destination for all outbound mail. You specify the relayhost in your configuration using relayhost = [smtp.relay-host.com]:587. Postfix then establishes an encrypted connection, performs any necessary authentication (like SASL), and hands off the message. The relayhost validates the sender’s identity using SPF, DKIM, and DMARC policies, then sends the message to the final recipient.

Importantly, the relayhost uses its own infrastructure and reputation—so your own IP address isn’t exposed or scrutinized. This is why many developers and system administrators use relayhosts even when they host their applications on dedicated servers or VPSs.

Before sending bulk mail, verifying your list can reduce bounces and protect your sender reputation. Use a service like bulk email verification to filter out invalid, catch-all, or disposable email addresses before sending. This helps avoid delivery issues even when using a trusted relayhost.

Postfix Relayhost Setup: Step-by-Step Configuration

You can configure Postfix to route outbound mail through an external SMTP relay by editing /etc/postfix/main.cf, setting the relayhost directive, enabling SASL authentication and TLS, and securing credentials via a hashed password map. This setup ensures your mail is sent through a trusted provider and helps avoid delivery issues from untrusted or poorly configured servers.

Edit the main configuration file: Run sudo nano /etc/postfix/main.cf to open the primary Postfix config file. This file governs how Postfix handles all mail routing and delivery policies.
Add the relayhost directive: Set relayhost = [smtp.relay.example.com]:587. Use brackets around the hostname to avoid DNS misinterpretation. The port 587 is standard for authenticated submission.
Enable SASL authentication: Add smtp_sasl_auth_enable = yes. This allows Postfix to authenticate with the relay server using a username and password, preventing unauthorized use.
Enable TLS encryption: Set smtp_use_tls = yes. TLS protects your credentials and message content during transmission. This is required by most modern SMTP services — RFC 8314 describes the security requirements for authenticated mail submission.
Set up password map: Use smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd to reference a file containing the relay server’s credentials. This file must be readable only by root.
Generate the hash: Run sudo postmap /etc/postfix/sasl_passwd. This creates a database file (sasl_passwd.db) that Postfix reads securely at runtime.
Restrict anonymous access: Add smtp_sasl_security_options = noanonymous to prevent unauthenticated connections. This enhances security by requiring valid credentials.
Reload the service: Run sudo systemctl reload postfix to apply the new configuration without disrupting existing connections.

The 8 steps described in “Postfix Relayhost Setup: Step-by-Step Configuration”, in order.

Verify Your Relayhost Configuration

After applying changes, test mail delivery using sendmail or mail. Check /var/log/mail.log or journalctl -u postfix for error messages. Look for successful TLS negotiation and authentication logs.

Security Notes

Never store plain-text passwords in configuration files. Use postmap to hash them. Restrict file permissions: chmod 600 /etc/postfix/sasl_passwd*. Ensure your relay provider allows submission from your IP address.

A well-configured relayhost reduces the risk of email rejection and improves deliverability by leveraging established sender reputation and infrastructure.

If you're sending emails at scale, consider validating recipient lists before sending. Tools like MailTester can help identify invalid, risky, or disposable email addresses before they hit your SMTP relay — helping you maintain sender reputation, avoid bounces, and improve inbox placement. Explore email list verification and inbox placement testing options with MailTester's bulk verification and inbox placement testing.

Configuring Authentication for Your SMTP Relay

You must configure Postfix to authenticate with your SMTP relay using SASL PLAIN or LOGIN, store credentials securely in /etc/postfix/sasl_passwd with the correct format, hash the file with postmap, and ensure only root can read it. Without proper authentication, your relay host will reject connection attempts, leading to delivery failures.

Setting Up the SASL Credential File

First, verify your relayhost supports authenticated connections—most production relays use SASL PLAIN or LOGIN. You’ll need a username and password provided by your service provider. Create or edit the file /etc/postfix/sasl_passwd and add a line in this exact format: [smtp.relay.example.com]:587 username:password. Replace the host, port, and credentials with your actual relay details.

Once saved, Postfix must convert this plain text file into a binary lookup database. Run postmap /etc/postfix/sasl_passwd. This creates a hashed file, usually named sasl_passwd.db, which Postfix uses at runtime. If you skip this step, Postfix won’t find your credentials, and authentication will fail.

Securing the Credentials File

Permissions are critical. Make sure only root can read the credentials file and its hash. Use chown root:root /etc/postfix/sasl_passwd and chmod 600 /etc/postfix/sasl_passwd. The same applies to the resulting sasl_passwd.db file. Any other user with read access could compromise your SMTP credentials.

After setup, reload Postfix with systemctl reload postfix or postfix reload to apply changes. Test the configuration by sending a test email through the relay. If it fails, check the mail log at /var/log/mail.log or /var/log/maillog for authentication errors—often, malformed credentials or permission issues are the root cause.

For teams managing large mailings, you’ll want to validate your sending list first. Email verification tools like MailTester help catch invalid or risky addresses before they hit your relay, improving deliverability and protecting your sender reputation. Use their bulk verification or API checker to detect catch-all, role-based, or disposable email addresses that may cause bounces or harm your domain’s standing.

The authentication process is simple but precise. Follow the steps exactly: correct format, proper hashing, tight permissions. These are not optional details—they're essential for reliable relay use. For reference, see the official SASL documentation in RFC 4616, which defines the PLAIN mechanism, and RFC 4954 for the LOGIN mechanism. These standards ensure interoperability across systems.

Validating Your Postfix Relayhost Configuration

After configuring Postfix to relay mail through an SMTP relay, test it with a single email, check logs for authentication and relay success, and confirm TLS and port settings. Then, validate sender reputation and email addresses before bulk sending to avoid bounces and deliverability issues.

Step-by-step validation checklist

Send a test message: echo 'Test' | mail -s 'Relay Test' [email protected] — this triggers Postfix to attempt delivery through your configured relayhost.
Monitor the mail log in real time: sudo tail -f /var/log/mail.log — look for lines indicating the relay was used, such as relay=smtp.relay.example.com or authentication success.
Check for rejected connections or TLS errors: common problems include misconfigured ports (25, 587, or 465), missing TLS negotiation, or expired credentials — each can cause SMTP handshakes to fail silently.
Verify the relayhost is accessible from your server: use telnet smtp.relay.example.com 587 or openssl s_client -connect smtp.relay.example.com:587 -starttls smtp to confirm connectivity and TLS handshake.
Review Postfix config for correct relayhost and authentication settings: ensure relayhost = [smtp.relay.example.com]:587, smtp_tls_security_level = may, and smtp_sasl_auth_enable = yes are set in /etc/postfix/main.cf.
Test sender legitimacy before sending bulk mail: use a real-time email verification tool to filter invalid, disposable, or high-risk addresses — this reduces bounce rates and protects sender reputation.

Prevent issues before they hit inboxes

Even a perfectly configured relay can fail if the sender address is blacklisted, a catch-all domain is misused, or the email list includes disposable domains. Verify individual addresses before sending to catch problems early. For bulk sends, run your entire list through our bulk verification tool — it checks validity, risk, and deliverability, so you’re not wasting resources on addresses that won’t be delivered.

For systems where email volume is high or delivery reliability is critical, run inbox placement tests to see how your messages land in real inboxes across major providers. This is not a substitute for proper relay setup, but it reveals how well your mail practices align with actual filtering behavior. Reliable mail flow starts with a correct setup — and ends with responsible sending.

MailTester’s Inbox Placement Testing: Verify Postfix Relay Deliverability

Even with a correct Postfix relayhost configuration, your emails might still end up in spam folders or fail to deliver entirely due to poor sender reputation, missing authentication headers, or aggressive spam filtering. Use MailTester’s inbox-placement test to validate that your mail actually reaches inboxes at Gmail, Outlook, Yahoo, and others—within 30 minutes—by simulating real delivery conditions and checking spam filter scores, authentication (SPF/DKIM/DMARC), and final folder placement. This confirms your full delivery path works, not just the relay setup.

Why Your Postfix Relay Might Still Fail

Configuring Postfix to relay through an SMTP provider handles network-level delivery, but it doesn’t guarantee inbox placement. Mail providers like Gmail use complex signals beyond routing—like historical engagement, link reputation, and envelope sender consistency—to decide whether to place mail in the inbox or quarantine it. A single misconfigured header, mismatched DKIM signature, or even a low sender score can block delivery despite a functional relay.

Test That Everything Works Together

MailTester’s inbox-placement test sends your actual message through your Postfix relay and checks how it lands across major providers in real time. It analyzes whether your messages pass SPF, DKIM, and DMARC checks—industry-standard authentication mechanisms outlined in RFC 7208, RFC 6376, and RFC 7672. It also evaluates spam scores and inbox delivery rates, giving you a clear signal whether your setup is effective or needs tuning.

For example, if your messages land in spam despite correct headers, the test can reveal whether the sender domain has a poor reputation. You can then use MailTester’s inbox placement tester to check specific domains, iterate your configuration, and confirm improvements before sending to real users.

This step is critical: verifying individual addresses with MailTester’s email checker or bulk list verification is only half the story. If your relay is configured but your reputation is low, even valid addresses won’t deliver reliably.

Common Relayhost Issues and How to Debug Them

When your Postfix relayhost fails, it’s rarely about the config being wrong from the start—it’s usually one of four clear issues: missing authentication, a blocked port, a broken TLS handshake, or SASL not set up. Let’s walk through each, spot the symptom, and fix it with precision.

Authentication and Connection Problems

“Relay Access Denied” means Postfix can’t authenticate. Double-check smtp_sasl_password_maps in main.cf and ensure the credentials for your relay host are correctly formatted and stored.
If you see “Connection Timed Out,” test connectivity using telnet or openssl s_client -connect relay.example.com:587. If it fails, your firewall or network rules may be blocking outgoing connections on port 587 or 465. This aligns with SMTP best practices outlined in RFC 5321.
“SSL/TLS Handshake Failed” often means the relay host’s certificate is expired, self-signed without proper trust, or the client doesn't support the required cipher suite. Use openssl s_client -connect relay.host:587 -starttls smtp to inspect the handshake directly.

Configuration and Server-Side Checks

“530 Authentication Required” confirms SASL is enabled on the server but missing in Postfix. Ensure smtp_sasl_auth_enable = yes and smtp_sasl_security_options = noanonymous are set in main.cf. Check logs at /var/log/mail.log for SASL authentication failures.
Verify the relay host domain resolves properly with dig or nslookup. A DNS resolution failure can mimic a relay issue.
Ensure your relayhost setting in main.cf is correctly formatted: relayhost = [smtp.relay.com]:587—note the square brackets for literal IPs or domains, which prevent DNS lookup confusion.
Restart Postfix immediately after changes: systemctl restart postfix. A stale config can cause misleading errors.

Authentication errors are the most common relay issues. Fix them early—once your server can speak to the relay, other problems become easier to isolate.

Before sending to tens of thousands of users, you can catch invalid or poorly configured addresses early with real-time email checks. Use MailTester’s email checker to verify individual addresses, or bulk verify your entire list to prevent relay abuse and reduce bounce rates.

Security and Best Practices for Postfix Relayhost Use

Always use TLS encryption when connecting to your relayhost, avoid storing passwords in plain text, restrict access to trusted domains, monitor logs for anomalies, and ensure relayhost configuration files are only accessible to authorized users. These steps prevent unauthorized use, protect credentials, and reduce the risk of being blacklisted or exploited.

Essential Configuration Practices

Enforce TLS encryption: Set smtp_use_tls = yes in your Postfix configuration to prevent man-in-the-middle attacks and ensure transmitted data remains secure.
Use sasl_passwd for authentication: Never hardcode passwords in main.cf. Instead, store credentials in the sasl_passwd hash file and use postmap /etc/postfix/sasl_passwd to compile it securely.
Restrict relayhost access: Limit which domains or IP addresses can use your relayhost by configuring access controls in Postfix’s smtpd_recipient_restrictions and smtpd_client_restrictions policies.
Monitor logs regularly: Check /var/log/mail.log or your system’s journal for failed login attempts, sudden spikes in message volume, or unauthorized relay usage—common signals of compromise.
Protect configuration files: Ensure /etc/postfix/sasl_passwd and its hash file are readable only by root. Use chown root:root and chmod 600 to limit access.

Operational Discipline and Trust

Even with proper setup, misconfigurations or leaks can expose your system. Regularly audit your relayhost configuration and check for unexpected outbound traffic. If you’re sending bulk emails, consider verifying your list quality first—invalid or spoofed addresses increase bounce rates and harm sender reputation.

For that, MailTester’s bulk email list verification helps detect invalid, role, or disposable addresses before they hit your relay. It runs real SMTP checks and returns deliverability insights with 98.9% accuracy.

Secure email delivery isn’t just about technical setup. It’s about process. Let’s treat relayhost access like a sensitive privilege. And when in doubt, consult the RFCs—SMTP and SASL define the baseline for secure email transmission. A single flaw can turn your server into an open relay. Keep it locked down.

Integrating List Hygiene with Postfix Mail Sending

Before sending mail through your Postfix relayhost, verify your list with MailTester’s bulk verification to catch invalid, catch-all, disposable, and role-based addresses. This reduces bounces, protects your IP reputation, and improves inbox placement—critical for sustainable deliverability. Let’s look at how clean data powers reliable SMTP delivery.

Why Sending to Bad Addresses Hurts Your Sender Reputation

Sending to outdated or invalid email addresses increases bounce rates, which ISPs monitor closely. A high bounce rate signals poor list hygiene and can trigger rate limiting or outright blocking. Even one bad address in a large send can hurt your sender reputation over time, especially if those bounces are hard or persistent.

Role-based addresses (like postmaster@ or admin@) often don’t accept mail and may be flagged as risky. Disposable email domains are commonly used for fake signups and are frequently blocked. Catch-all addresses accept anything, but sending to them wastes bandwidth and may appear spammy to reputation systems.

How MailTester Cleans Your List Before Postfix Sends

MailTester’s bulk verification checks each address in your list using real SMTP connections and DNS lookups. You’ll identify invalid, catch-all, disposable, or role-based addresses with 98.9% accuracy—based on internal validation against known patterns, domain behavior, and real-time feedback loops.

This pre-send cleanup ensures your Postfix relayhost only delivers to active, legitimate recipients. Lower bounce rates and fewer spam complaints help maintain a healthy sender reputation. This is especially important when using shared or dedicated IP addresses with third-party relays.

Use the bulk verification tool to test entire lists before deploying through Postfix. You can integrate it into your workflow via the real-time API, or validate individual addresses with the email checker. Test inbox placement with inbox placement testing to see how your final message lands in real inboxes.

For teams, integrations with SendGrid, Mailchimp, HubSpot, and Klaviyo let you automate list scrubbing before every send. Clean data isn’t just a good practice—it’s a deliverability necessity.

Ultimately, treating your Postfix relayhost like a precision instrument means feeding it clean data. That starts with a proactive verification step, not reactive troubleshooting. For guidance on how mail flows from your server through relays, see the RFC 5321 specification on SMTP transaction flow on IETF’s site.

How MailTester’s API and Integrations Fit Into the Workflow

You can automate email validation in your Postfix relayhost workflow by verifying addresses before they enter your mail queue. Use MailTester’s API to check every address in bulk or in real time, integrate with platforms like Mailchimp, HubSpot, or Klaviyo to run checks before campaign sends, and ensure only valid, deliverable emails are relayed through your SMTP server. This lowers bounce rates, improves sender reputation, and increases inbox placement.

Preventing Bounces with Real-Time Verification

Let’s say your system adds new contacts to a mailing list. Instead of sending immediately, hook MailTester’s verification API into the pipeline. It checks syntax, domain validity, MX records, and whether the mailbox accepts messages—catching invalid, disposable, or role-based addresses before they hit Postfix.

For high-volume senders, bulk verification via MailTester’s bulk tool can process thousands of emails at once. You’ll see a clear breakdown of valid, invalid, catch-all, and risky addresses—so you don’t just send more, you send smarter. This step is a critical filter before any email reaches your relayhost, reducing the risk of hard bounces, spam complaints, and blacklisting.

Seamless Integrations and Smart Cleanup

When you connect MailTester to platforms like Mailchimp, Klaviyo, or SendGrid, verification happens automatically before a campaign sends. No manual checks, no wasted sends. You’re not just cleaning the list; you’re enforcing hygiene at the source.

If an address returns as “risky” or “catch-all,” the in-app AI assistant helps you interpret the result. It might flag a high-risk domain or suggest removing a role account like admin@ or support@. This guidance is based on patterns seen in email deliverability studies, and it aligns with industry-standard practices around sender reputation and message routing.

Once cleanup is done, your verified list moves securely through Postfix to the configured relayhost. By eliminating invalid destinations before transmission, you improve deliverability metrics and avoid sending to domains that may reject your messages or report you as spam. This is a proven approach—studies from SANS Institute and email deliverability reports from Return Path consistently highlight list hygiene as a top factor in inbox placement.

Final Thoughts: Reliable Email Delivery Requires Verification and Configuration

Configuring a relayhost in Postfix ensures your mail server can send messages through an external SMTP relay. But this alone does not guarantee inbox placement. Technical delivery is only the first step.

Your sender reputation and list quality determine whether messages land in inboxes or spam folders. A well-configured relayhost handles volume and reliability, but only verified addresses prevent bounces, protect reputation, and improve deliverability.

Use Postfix with a trusted relay for scalable, consistent delivery. Pair it with MailTester to validate every address before it leaves your system. This two-step process—correct configuration paired with rigorous verification—is how systems at scale maintain high inbox placement and sender trust.

Sources

Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

How do I configure a Postfix relayhost to use Gmail as an SMTP relay?

Set relayhost = [smtp.gmail.com]:587, enable smtp_sasl_auth_enable and smtp_use_tls, then configure sasl_passwd with your Gmail credentials and hash the file using postmap.

Can I use Postfix relayhost with multiple SMTP relays?

Yes, but use transport maps to route specific domains through different relays. This requires advanced configuration and is uncommon in most setups.

What ports does Postfix use for relayhost SMTP connections?

Typically 587 (submission with TLS) or 465 (SMTPS). Avoid port 25 unless explicitly allowed by the relay provider.

Why is my Postfix relayhost connection being rejected?

Common causes include incorrect credentials, missing TLS, firewall blocking, or the relay host rejecting your IP due to poor reputation.

Does using a relayhost affect email authentication headers?

Yes—SPF checks may fail if the relay host’s IP is not authorized by the sender’s domain. Use SPF alignment or ensure the relay host has approved sending rights.

Can I test if my Postfix relayhost works without sending real mail?

Yes—use the 'sendmail' command with a test address or verify configuration with 'postfix check' and examine mail log outputs.

How often should I verify emails before sending through a relay host?

Verify immediately before sending or during list ingestion. Re-verify for long-term campaigns that span months.

What happens if I send to a catch-all or disposable email address via relayhost?

The relay host may accept the message, but delivery will fail or bounce later. Verification prevents such waste.

Is there a limit to how many emails Postfix can send through a relayhost?

Yes—relay hosts enforce rate limits and sending quotas. Check your provider’s documentation for specifics.

How can I ensure my sender reputation remains clean when using a relayhost?

Only send to verified, engaged recipients. Avoid spam traps, report bounces promptly, and never use harvested lists.

Can MailTester detect if my Postfix relayhost is misconfigured?

It doesn’t test configuration directly, but by delivering test emails through MailTester’s inbox placement service, you can see if messages land in the inbox.

Do purchased MailTester credits expire?

No—purchased credits never expire. You get 100 free verifications to start, and additional credits remain available indefinitely.