How to Configure a Postfix SMTP Relay (Step by Step)

Published October 12, 2024 · Updated August 22, 2026 · Guides & Tutorials

Postfix is the most popular mail server on Linux, and one of its most useful roles is as a relay — a "null client" that hands all outbound mail to a trusted smart host instead of delivering it itself. A server sending mail directly usually fails: no reputation, filtered ports, blocked IPs. Configuring Postfix to relay through an authenticated smart host gives every application on the box trusted, authenticated delivery through one clean IP. Here is exactly how to configure it.

Key relay directives

In /etc/postfix/main.cf, set:

relayhost = [smtp-host]:587 — where all outbound mail is sent.
smtp_sasl_auth_enable = yes — turn on authentication.
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd — your credentials file.
smtp_tls_security_level = encrypt — force TLS.

Apply and test

Run postmap /etc/postfix/sasl_passwd against your password file.
Secure it: chmod 600 on the password file.
Reload Postfix: systemctl reload postfix.
Test with echo | mail -s test [email protected].
If mail still fails, check the maillog — authentication and TLS errors show up there clearly.

Lock it down

Never leave Postfix as an open relay. Restrict mynetworks to the local networks that should be allowed to inject mail, and keep the SASL password file readable only by root (chmod 600). An unrestricted Postfix is an open relay waiting to be abused.

Tip: A Postfix null client sends all outbound mail to a smart host and accepts no local delivery — ideal for app servers that only need to send, not receive.

A quick log check after setup
Tail the mail log (tail -f /var/log/mail.log) while sending your first test — watching the relay attempt happen in real time makes any authentication or connection error immediately visible instead of guessing from a delayed bounce.
Note: Keep a copy of your working main.cf once tested — a known-good reference makes recovering from an accidental config change much faster.
If you manage several servers relaying through the same smart host, keep their individual main.cf configurations backed up together — makes disaster recovery faster if any one of them needs rebuilding.
Related reading: Linux SMTP relay · GoDaddy SMTP relay · SMTP restrictions on cPanel

Dedicated SMTP relay

Skip the caps, the shared IPs, and the DNS wrangling

Dedicated IP, unlimited sending, and SPF/DKIM/DMARC configured on signup. From $39.99/mo, cancel anytime.

See the unlimited SMTP server →Get started now

Frequently asked questions

How do I configure Postfix as a relay?

Set relayhost to your smart host on port 587, enable SASL authentication and TLS, run postmap on the password file, secure it, and reload Postfix.

What is a Postfix null client?

A Postfix setup that sends all outbound mail to a smart host and accepts no local delivery — ideal for app servers that only need to send.

Why is my Postfix relay failing?

Usually authentication or TLS. Check the maillog, and confirm your credentials, port 587, and smtp_tls_security_level = encrypt are all correct.

What smart host should Postfix relay through?

A dedicated SMTP with its own IP and full authentication, so your relayed mail is trusted and delivered rather than flagged as coming from an unknown server.