How to Install Postfix on Ubuntu 24.04

Install Postfix

You install Postfix from the standard Ubuntu repositories. Use an account that can run commands with sudo, and have your server’s domain name ready, because the setup screens ask for it.

1. Open a terminal on the server.
2. Run the apt update command to refresh the package list. You should see apt contact the Ubuntu repositories and finish without errors.
3. Run the apt install postfix command. Apt downloads the mail server files and sets up the basic delivery tools. When it asks for confirmation, type Y and press Enter.
4. When the setup screen appears, press Enter to accept the default No configuration option. This lets the installation finish without trouble, and you configure Postfix by hand in the steps below.

sudo apt update
sudo apt install postfix sasl2-bin

On the following screen, choose the general mail configuration type. Use the arrow keys to move through the list, then press Enter to confirm. For a server that sends and receives mail directly for your domain, Internet Site is the usual choice when your list offers it. If the installer then asks for a system mail name, enter your domain name. The selection is shown below.

                     ┌─────┤ Postfix Configuration ├─────┐
                     │ General mail configuration type:  │ 
                     │                                   │ 
                     │     No configuration              │ 
                     │     Internet Site                 │ 
                     │     Internet with smarthost       │ 
                     │     Satellite system              │ 
                     │     Local only                    │ 
                     │                                   │ 
                     │                                   │ 
                     │      <Ok>          <Cancel>       │ 
                     │                                   │ 
                     └───────────────────────────────────┘

The package installation only puts the software on the system. The environment still needs to be configured by hand, and that is what the next steps do. Work in order, because each step builds on the previous one.

Start by copying the default template to create a working configuration file. This gives you a complete file with every common option already present, so you edit values instead of writing the file from scratch. Run the command shown below. If a configuration file already exists, check what it contains first so you don’t overwrite settings you want to keep.

sudo cp /usr/share/postfix/main.cf.dist /etc/postfix/main.cf

Next, open the new file in a text editor and make the required parameter changes. Editing the file needs root rights, so run the editor with sudo.

1. Open the file with the command shown below.
2. Find each parameter listed in the example and change its value to match your server and domain.
3. If a parameter is missing from the file, add it on a new line.

Take a backup copy of the file before you edit it, so you can undo any mistake.

sudo nano /etc/postfix/main.cf

These settings control which network interfaces Postfix listens on and which networks it trusts. Be careful with them. If you trust too wide a range of addresses, your server can end up relaying spam for strangers. Use the values shown below and adjust them to your own network.

# QUEUE AND PROCESS OWNERSHIP
#
mail_owner = postfix

# INTERNET HOST AND DOMAIN NAMES
#
myhostname = srv1.example.com

# The mydomain parameter specifies the local internet domain name.
#
mydomain = example.com

# Debian GNU/Linux specific:The Debian default is /etc/mailname.
#myorigin = /etc/mailname
#myorigin = $myhostname
myorigin = $mydomain

# The inet_interfaces parameter specifies the network interface
# addresses that this mail system receives mail on.
inet_interfaces = all

# Specify a list of host or domain names, /file/name or type:table
#
#mydestination = $myhostname, localhost.$mydomain, localhost
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

# Details are described in the LOCAL_RECIPIENT_README file.
# 
local_recipient_maps = unix:passwd.byname $alias_maps

# Specify "mynetworks_style = host" when Postfix should "trust"
# 
#mynetworks_style = class
mynetworks_style = subnet

# Specify an explicit list of network/netmask patterns, where the
#mynetworks = 168.100.3.0/28, 127.0.0.0/8
mynetworks = 192.168.156.0/24, 127.0.0.0/8

# ALIAS DATABASE
#
# The alias_maps parameter specifies the list of alias databases used
# by the local delivery agent. The default list is system dependent.
#alias_maps = dbm:/etc/aliases
alias_maps = hash:/etc/aliases

#alias_database = dbm:/etc/aliases
#alias_database = dbm:/etc/mail/aliases
alias_database = hash:/etc/aliases

# DELIVERY TO MAILBOX
#
# The home_mailbox parameter specifies the optional pathname of a
# mailbox file relative to a user's home directory. The default
# mailbox file is /var/spool/mail/user or /var/mail/user.  Specify
# "Maildir/" for qmail-style delivery (the / is required).
#
#home_mailbox = Mailbox
home_mailbox = Maildir/

# SHOW SOFTWARE VERSION OR NOT
#
# The smtpd_banner parameter specifies the text that follows the 220
# code in the SMTP server's greeting banner.
#smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
#smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_banner = $myhostname ESMTP

# INSTALL-TIME CONFIGURATION INFORMATION
# sendmail_path: The full pathname of the Postfix sendmail command.
# This is the Sendmail-compatible mail posting interface.
# 
sendmail_path = /usr/sbin/postfix

# newaliases_path: The full pathname of the Postfix newaliases command.
# This is the Sendmail-compatible command to build alias databases.
#
newaliases_path = /usr/bin/newaliases

# mailq_path: The full pathname of the Postfix mailq command.  This
# is the Sendmail-compatible mail queue listing command.
# 
mailq_path = /usr/bin/mailq

# setgid_group: The group for mail submission and queue management
# commands.
setgid_group = postdrop

# add the remaining lines below to the end of the file.
disable_vrfy_command = yes

# require HELO command to sender hosts
smtpd_helo_required = yes

# limit an email size to 10M bytes limit
message_size_limit = 10240000

# SMTP-Auth settings
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_recipient_restrictions =
  permit_mynetworks,
  permit_sasl_authenticated,
  reject_unauth_destination

Save your changes and close the editor. In nano, press Ctrl+O and then Enter to write the file, and press Ctrl+X to exit. In vim, type the save-and-quit command instead. Back at the prompt, the file is saved but Postfix is not using it yet. That happens in the next step.

Apply the configuration changes by restarting the service. Postfix reads its configuration when it starts, so a restart is needed after every edit. Run the restart command shown below, then check the status output that follows. It should report the service as active. If it shows an error, re-open the configuration file and look for typos in the lines you changed.

sudo newaliases
sudo  systemctl restart postfix

The messaging service is now active and listening for connections. If you plan to receive mail from the internet, make sure your firewall allows inbound traffic on the mail port, and check whether your hosting provider blocks outbound port 25. Many providers do by default, and you may need to ask them to lift the block.

Additional SPAM protection

Adding spam protection to Postfix on Ubuntu 24.04 stops unwanted junk mail by checking sender domains before the server accepts messages. You do this in the main configuration file at /etc/postfix/main.cf, by adding specific validation rules at the bottom. This extra layer blocks unknown clients that fail forward and reverse lookup tests. Legitimate mail servers normally pass these tests, so most real mail is unaffected.

Paste the filtering parameters at the bottom of the configuration file.

1. Open /etc/postfix/main.cf in your editor with sudo.
2. Scroll to the end of the file.
3. Paste the lines shown below on new lines, without changing the existing settings above them.
4. Save the file and close the editor.

Postfix uses the last value it finds, so a duplicate line can quietly replace the earlier one.

# reject unknown clients that forward lookup and reverse lookup of their hostnames on DNS do not match
smtpd_client_restrictions = permit_mynetworks, reject_unknown_client_hostname, permit

# rejects senders that domain name set in FROM are not registered in DNS or 
# not registered with FQDN
smtpd_sender_restrictions = permit_mynetworks, reject_unknown_sender_domain, reject_non_fqdn_sender

# reject hosts that domain name set in FROM are not registered in DNS or 
# not registered with FQDN when your SMTP server receives HELO command
smtpd_helo_restrictions = permit_mynetworks, reject_unknown_hostname, reject_non_fqdn_hostname, reject_invalid_hostname, permit

Restart the mail server daemon to load the new filters, using the command shown below. Check that the service still reports active. To undo the filtering, remove the lines you added, or put back your backup copy of the file, and restart Postfix again.

The messaging infrastructure is now fully operational, with a working configuration and basic spam checks in place.

Configuring Postfix gives you a secure foundation for mail delivery. Review these core points:

• User-Friendly Installation: The installation process requires just a few commands.
• Secure Email Management: Postfix supports TLS encryption to ensure secure communications.
• Customizable Configuration: You can easily modify the main configuration file to suit your needs. Keep a backup before each change.
• SPAM Protection: Additional configurations can enhance security by reducing SPAM and validating sender identities.
• Integration Ready: Postfix can be integrated with tools like Dovecot and SpamAssassin to create a comprehensive mail handling system.
• Active Maintenance: Regular updates and maintenance will keep your email server running efficiently.

Following these deployment steps gives you a working mail server for your domain. From here, the next jobs are adding TLS encryption and a mailbox service such as Dovecot, so users can read their mail.