Setting Up Postfix Mail Server on CentOS

Postfix is a practical mail transfer agent for organisations needing control over delivery, mailboxes and logs. Australian teams in Sydney, Melbourne and Brisbane often use Microsoft 365 or Google Workspace, but self-hosted mail still suits specialist hosting and internal systems. A fair dinkum setup starts with DNS and network access.

This guide uses CentOS Stream 9 with Dovecot, TLS and authenticated submission. Replace the example addresses and use a fixed public IP with reverse DNS. CentOS 7 is end-of-life and should not underpin a new service.

Choose the server role

Decide the server role first. A full server accepts inbound Internet mail, stores mailboxes and relays authenticated messages; an outbound-only relay skips local delivery. Both need careful DNS and TLS, but not identical firewall or mailbox settings.

The site's Linux administration guides cover useful CentOS command-line fundamentals. For a learning deployment, choose a cloud VM with a fixed address: Australian home NBN connections often use dynamic addresses, and some providers block port 25.

This document provides a comparison of core components and their main uses across different deployment roles, ranging from a full mail server and outbound relay to an internal hub.

Role	Core components	Main use
Full mail server	Postfix, Dovecot, TLS, DNS	Hosted mailboxes and inbound delivery
Outbound relay	Postfix, TLS, SPF, DKIM, DMARC	Controlled sending from a fixed IP
Internal hub	Postfix and internal DNS	Local delivery without external exposure

Selecting the appropriate role and its corresponding core components ensures that the deployment matches the intended use, whether that involves full inbound delivery, controlled outbound sending, or purely local messaging.

Prepare the CentOS host

Create a dedicated VM, set its hostname and keep time synchronised. On a minimal CentOS Stream 9 installation, install Postfix and Dovecot, then enable both daemons.

sudo dnf install -y postfix dovecot
sudo systemctl enable --now postfix dovecot
sudo hostnamectl set-hostname mail.example.com.au

Add the fully qualified hostname to /etc/hosts and ensure its public A record matches the VM. Ask the provider to configure the matching PTR record because receivers reject mail when forward and reverse DNS disagree. Open ports 25, 465, 587 and 993 in any active firewalld ruleset and the provider's security group. Confirm SELinux labels 465 and 587 for SMTP.

sudo firewall-cmd --permanent \
  --add-port=25/tcp --add-port=465/tcp \
  --add-port=587/tcp --add-port=993/tcp
sudo firewall-cmd --reload

Configure Postfix delivery and relaying

Add the following to /etc/postfix/main.cf; the example assumes IPv4 only.

myhostname = mail.example.com.au
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, localhost
home_mailbox = Maildir/
inet_protocols = ipv4
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_relay_restrictions = permit_mynetworks,permit_sasl_authenticated,defer_unauth_destination

These settings accept Internet SMTP, deliver to local accounts and authenticate client submissions. Keep mynetworks narrow, validate with sudo postfix check, then restart Postfix.

Secure transport and establish DNS trust

Install a trusted certificate for the mail hostname. Let's Encrypt is common, although Australian IT teams may use a managed commercial certificate for easier renewal. Copy the chain and key into /etc/postfix/ssl, with Postfix-readable key ownership.

sudo dnf install -y certbot
sudo certbot certonly --standalone -d mail.example.com.au

Set smtpd_tls_security_level=may, smtp_tls_security_level=may, smtpd_tls_cert_file=/etc/postfix/ssl/fullchain.pem and smtpd_tls_key_file=/etc/postfix/ssl/privkey.pem in main.cf, then restart Postfix.

Publish an MX record, an A record for the mail host, SPF for authorised senders, and DKIM for outbound signatures. Start DMARC at p=none, review reports, then strengthen it. Treat DNS, certificates and firewall changes like a colour correction workflow: prepare dependencies, apply one controlled change and verify the result. Australian commercial mail must meet the Spam Act 2003 and ACMA guidance on consent and identification.

Add mailboxes and client submission

Create /etc/dovecot/private and copy the chain and key there as dovecot.pem and dovecot.key. Configure Dovecot for Maildir delivery, IMAPS and the Postfix authentication socket; disable plaintext passwords outside TLS.

# /etc/dovecot/dovecot.conf
mail_location = maildir:~/Maildir
disable_plaintext_auth = yes
ssl = required
ssl_min_protocol = TLSv1.2
ssl_cert = </etc/dovecot/private/dovecot.pem
ssl_key = </etc/dovecot/private/dovecot.key

service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
  }
}

Create a non-privileged account and set its password. Dovecot creates the Maildir on first login, so check ownership if login fails.

sudo useradd -m -s /bin/bash alice
sudo passwd alice

Run a submission service on port 587 that requires TLS and SASL authentication. This prevents the server becoming an open relay.

# /etc/postfix/master.cf
submission inet n - y - - smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_authentication=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject

sudo systemctl restart dovecot postfix

Verify operation and routine checks

Run tests from the VM and a separate external network; local checks can pass while filtering or a closed port remains hidden. Install bind-utils and swaks if needed.

Pre-launch checks

The sudo systemctl status postfix dovecot command confirms both daemons are active. Additionally, sudo postfix check catches many configuration errors. You can also run openssl s_client -connect mail.example.com.au:587 -starttls smtp to verify TLS. Finally, swaks --server mail.example.com.au --port 25 --quit-after EHLO checks inbound SMTP; repeat with --port 587 --auth LOGIN for submission.

Routine monitoring

The sudo journalctl -u postfix -u dovecot command reveals warnings and failed logins. The postqueue -p command shows delayed mail. Additionally, dig +short MX example.com.au checks the published exchanger.

Resolve one warning at a time and inspect logs after every change. Keep setup tests on a separate hostname so early reputation problems do not attach to the production domain.

Maintain a dependable mail service

Apply package updates on a schedule, rotate certificates before expiry and keep a tested configuration copy. Monitor disk space, queue length and authentication failures. Restrict administration with SSH keys, and document renewal hooks that copy certificates and reload both daemons.

Back up mail according to retention rules and rehearse recovery. Australian organisations should align mailbox retention and access controls with the Privacy Act 1988 and sector requirements where applicable, especially when staff work across states.

Remember that Postfix is only one layer: reliable mail depends on DNS, TLS, relay controls, mailbox permissions and monitoring working together.