Postfix configurations

Most of the configurations of the postfix are included in main.cf and master.cf files (/etc/postfix/). These files are the main configuration files of Postfix. Configurations are already commented in the mentioned files when installing postfix. You can uncomment or add necessary configurations in order to your requirement.

main.cf

This configuration file specifies a very small subset of all parameters that control the operations of Postfix mail system. Initially, they are left with initial values.

• compatibility_level

  • A safety net that causes Postfix to run with backwards-compatible default settings after an upgrade to a newer Postfix version. We have disabled the backward compatibility by assigning value 2.

• smtpd_banner

  • The text that follows the 220 status code in the SMTP greeting banner. Some people like to see the mail version advertised. By default, Postfix shows no version

• biff

  • Whether or not to use the local biff service. This service sends "new mail" notifications to users who have requested new mail notification with the UNIX command "biff y". For compatibility reasons this feature is on by default. On systems with lots of interactive users, the biff service can be a performance drain. Specify "biff = no" to disable.

• append_dot_mydomain

  • With locally submitted mail, append the string ".$mydomain" to addresses that have no ".domain" information. With remotely submitted mail, append the string ".$remote_header_rewrite_domain" instead. This feature is enabled by default. If disabled, users will not be able to send mail to "user@partialdomainname" but will have to specify full domain names instead.

• readme_directory

  • The location of Postfix README files that describe how to build, configure or operate a specific Postfix subsystem or feature.

• smtpd_tls_cert_file

  • File with the Postfix SMTP server RSA certificate in PEM format. Public Internet MX hosts without certificates signed by a "reputable" CA must generate, and be prepared to present to most clients, a self-signed or private-CA signed certificate. The client will not be able to authenticate the server, but unless it is running Postfix 2.3 or similar software, it will still insist on a server certificate.

• smtpd_tls_key_file

  • File with the Postfix SMTP server RSA private key in PEM format. The private key must be accessible without a pass-phrase, i.e. it must not be encrypted. File permissions should grant read-only access to the system superuser account ("root"), and no access to anyone else.

• smtpd_use_tls

  • Opportunistic TLS: announce STARTTLS support to remote SMTP clients, but do not require that clients use TLS encryption.

• smtpd_tls_auth_only

  • Mandatory TLS: announce STARTTLS support to remote SMTP clients, and require that clients use TLS encryption. According to RFC 2487 this MUST NOT be applied in case of a publicly-referenced SMTP server. This option is therefore off by default.

• smtp_tls_security_level

  • The default SMTP TLS security level for the Postfix SMTP client. When a non-empty value is specified, this overrides the obsolete parameters smtp_use_tls, smtp_enforce_tls, and smtp_tls_enforce_peername.
    • Its value "may" means - Use TLS if this is supported by the remote SMTP server, otherwise use plaintext. Since sending in the clear is acceptable.

• smtpd_tls_security_level

  • The SMTP TLS security level for the Postfix SMTP server; when a non-empty value is specified, this overrides the obsolete parameters smtpd_use_tls and smtpd_enforce_tls. This parameter is ignored with "smtpd_tls_wrappermode = yes".
    • Its value "may" means - Opportunistic TLS: announce STARTTLS support to remote SMTP clients, but do not require that clients use TLS encryption.

• smtpd_sasl_type

  • The SASL plug-in type that the Postfix SMTP server should use for authentication. Our solution use "Dovecot".

• smtpd_sasl_path

  • Implementation-specific information that the Postfix SMTP server passes through to the SASL plug-in implementation that is selected with smtpd_sasl_type. Typically this specifies the name of a configuration file or rendezvous point.

• smtpd_sasl_auth_enable

  • Enable SASL authentication in the Postfix SMTP server. By default, the Postfix SMTP server does not use authentication.

• smtpd_client_restrictions (default: empty)

  • Optional restrictions that the Postfix SMTP server applies in the context of a client connection request. The default is to allow all connection requests.

• smtpd_helo_restrictions

  • Optional restrictions that the Postfix SMTP server applies in the context of a client HELO command. The default is to permit everything.

• myhostname

  • The internet hostname of this mail system. The default is to use the fully-qualified domain name (FQDN) from gethostname(), or to use the non-FQDN result from gethostname() and append ".$mydomain". $myhostname is used as a default value for many other configuration parameters.

• alias_maps

  • The alias databases that are used for local delivery.

• alias_database

  • The alias databases for local delivery that are updated with "newaliases" or with "sendmail -bi". This is a separate configuration parameter because not all the tables specified with $alias_maps have to be local files.

• myorigin

  • The domain name that locally-posted mail appears to come from, and that locally posted mail is delivered to. The default, $myhostname, is adequate for small sites. If you run a domain with multiple machines, you should change this to $mydomain and set up a domain-wide alias database that aliases each user to [email protected].

• mydestination

  • The list of domains that are delivered via the $local_transport mail delivery transport. By default this is the Postfix local delivery agent which looks up all recipients in /etc/passwd and /etc/aliases. The SMTP server validates recipient addresses with $local_recipient_maps and rejects non-existent recipients. The default mydestination value specifies names for the local machine only. On a mail domain gateway, you should also include $mydomain.

• message_size_limit

  • The maximal size in bytes of a message, including envelope information.

• mailbox_size_limit

  • The maximal size of any local individual mailbox or maildir file, or zero (no limit). In fact, this limits the size of any file that is written to upon local delivery, including files written by external commands that are executed by the local delivery agent. This limit must not be smaller than the message size limit.

• recipient_delimiter

  • The set of characters that can separate a user name from its extension (example: user+foo), or a .forward file name from its extension (example: .forward+foo). Basically, the software tries user+foo and .forward+foo before trying user and .forward. This implementation recognizes one delimiter character and one extension per email address or .forward file name.
    • "recipient_delimiter = +" means, Handle Postfix-style extensions.

• relayhost

  • The next-hop destination of non-local mail; overrides non-local domains in recipient addresses. On an intranet, specify the organizational domain name. If your internal DNS uses no MX records, specify the name of the intranet gateway host instead.

• mynetworks

  • The list of "trusted" remote SMTP clients that have more privileges than "strangers".

• inet_interfaces

  • The network interface addresses that this mail system receives mail on. This parameter specifies to "all" means, receive mail on all network interfaces (default), and "loopback-only" to receive mail on loopback network interfaces only.

• virtual_transport

  • The default mail delivery transport and next-hop destination for final delivery to domains listed with $virtual_mailbox_domains.

• virtual_mailbox_domains

  • Postfix is final destination for the specified list of domains; mail is delivered via the $virtual_transport mail delivery transport. By default this is the Postfix virtual delivery agent. The SMTP server validates recipient addresses with $virtual_mailbox_maps and rejects mail for non-existent recipients. This parameter expects the same syntax as the mydestination configuration parameter.

• virtual_mailbox_maps

  • Optional lookup tables with all valid addresses in the domains that match $virtual_mailbox_domains.

• virtual_alias_maps

  • Optional lookup tables that alias specific mail addresses or domains to other local or remote address.

• milter_protocol

  • The mail filter protocol version and optional protocol extensions for communication with a Milter application. Postfix sends this version number during the initial protocol handshake. It should match the version number that is expected by the mail filter application (or by its Milter library).

• milter_default_action

  • The default action when a Milter (mail filter) application is unavailable or mis-configured. (accept - Proceed as if the mail filter was not present)

• smtpd_milters

  • A list of Milter (mail filter) applications for new mail that arrives via the Postfix smtpd server.

• non_smtpd_milters

  • A list of Milter (mail filter) applications for new mail that does not arrive via the Postfix smtpd server.

• milter_mail_macros

  • The macros that are sent to Milter (mail filter) applications after the SMTP MAIL FROM command.

master.cf

The Postfix mail system is implemented by small number of (mostly) client commands that are invoked by users, and by a larger number of services that run in the background. Postfix services are implemented by daemon processes. They run in the background under control of the master process. The Postfix master daemon launches all of the other Postfix services as they are needed. The various services, and how they are run, are specified in the master.cf file.

There is a unique way to initialize a service in this file. It has table like a structure to do so. This structure has mandatory parameters and all the parameters must be define when entering a service or else a dash (-) in the related column indicates the default setting for that column. Some default values come from parameters in main.cf file.

Columns of the structure is like below.

service	type	private	unpriv	chroot	wakeup	maxproc	command