SMTP relay through a smarthost: sending mail from a VPS or from an application

E-mail·· 2 views· 4 min read

This article is for people with a VPS or server with root access, or an application that sends e-mail. The short answer: instead of your server delivering mail straight to each destination over port 25, it hands it to a mail server that is already trusted (the smarthost), with a username and password, over 587 or 465. That server makes the final delivery. It solves three problems at once: outbound port 25 blocked by the network, a VPS IP with no reputation or reverse DNS, and an SPF record that does not include the VPS.

Direct sending or through a smarthost

What Direct (port 25) Through a smarthost (587 or 465)
Who delivers to the destination The VPS itself, connecting to each recipient MX. The mail server where you have your mailbox, or a sending service.
Outbound port 25, which many networks and providers block outbound. 587 (STARTTLS) or 465 (SSL/TLS), the authenticated submission ports.
Reputation and reverse DNS Those of the VPS IP. A new IP, or one without PTR, often ends up in spam: PTR and reverse DNS. Those of the smarthost.
SPF and DKIM The domain SPF must include the VPS IP, and DKIM signing must happen on the VPS. Those of the delivering server count, if the domain already has them set up for it.
Limits Those of the VPS and the IP reputation. Those of the smarthost: an ordinary mailbox is not a bulk sending service.

Setting up Postfix with a smarthost

1 Create a mailbox just for sending (a notifications address, for example) and use it as the sender. Many servers refuse, or flag as suspicious, a sender that differs from the authenticated account.
2 Check that the VPS reaches the port: openssl s_client -starttls smtp -connect mail.yourdomain:587 -quiet If it hangs with no answer, it is the VPS or network firewall: ports and firewall on a VPS.
3 In /etc/postfix/main.cf, add (or change) these lines: relayhost = [mail.yourdomain]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt The square brackets tell Postfix to use the name as it is, without looking up its MX.
4 Store the credentials in /etc/postfix/sasl_passwd, on a single line, and protect the file: [mail.yourdomain]:587 sender@yourdomain:the-password
chmod 600 /etc/postfix/sasl_passwd
postmap /etc/postfix/sasl_passwd
systemctl reload postfix On Red Hat family distributions Postfix needs the cyrus-sasl-plain package to authenticate; on Debian and Ubuntu, libsasl2-modules.
5 Send a test and read the log (/var/log/maillog or /var/log/mail.log, depending on the distribution, or journalctl -u postfix). Look for relay=mail.yourdomain and status=sent. A 535 error is the username or password; “no mechanism available” is the missing SASL package.
Copy main.cf before you touch it and reload Postfix only after checking the syntax with postfix check. And use the smarthost for system and application mail, not for newsletters: a mailbox that sends in bulk gets blocked, and takes the domain normal mail down with it.
An application does not need Postfix: nearly all of them take an SMTP server in their settings (server, port, username, password). It is the same smarthost, set up in the application itself. To choose between SMTP and a service with an API, see sending by SMTP or through an e-mail API.

The smarthost relay will not authenticate, or mail still lands in spam? Send us the Postfix log lines, without the password.

Open a support ticket

SEE ALSO

Sending e-mail by SMTP or through an e-mail API: which suits your application

PTR and reverse DNS: why your e-mail depends on it

Ports and firewall on a VPS: why your app is not reachable

Creating your SPF record, step by step

SMTP ports 465, 587 and 25: SSL, STARTTLS and which one to use

Testing IMAP, POP3 and SMTP by hand with openssl s_client: a guide for technical users

RECOMMENDED PRODUCT

VPS server with root access

Resources of your own, the OS you choose, reinstall whenever you like. from $8.40/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

E-mail 1 550 How to access your webmail You don't need to install anything to check your e-mail - the webmail works straight from your browser, on any device. A...
E-mail 1 678 How to set up your e-mail on Android Set your e-mail up once on Android and it keeps syncing in the background, on Wi-Fi or mobile data. Setting it up 1 Open...
E-mail 1 475 How to set up your e-mail on iPhone or iPad The Mail app on iPhone and iPad can hold your professional e-mail alongside any personal accounts, each syncing independ...
E-mail 1 603 How to set up your e-mail in Thunderbird Thunderbird can detect this server's settings automatically - you only need to type your name, e-mail and password. Auto...
E-mail 1 003 How to set up your e-mail in the new Outlook for Windows The new Outlook for Windows tries to configure itself automatically. If it can't, it falls back to the same manual setti...
E-mail 1 036 How to set up your e-mail in Outlook 2016 and 2019 Outlook 2016 and 2019 share the same account wizard. It may configure itself automatically; if not, switch to manual set...