How To Install Postfix on CentOS Stream 10

In this tutorial, we will show you how to install Postfix on CentOS Stream 10. Postfix is a powerful Mail Transfer Agent (MTA) that provides a robust solution for sending, receiving, and routing emails in Linux environments. As businesses and individuals increasingly rely on stable email infrastructure, having a properly configured mail server becomes essential. In this comprehensive guide, we’ll walk through the complete process of installing and configuring Postfix on CentOS Stream 10, from basic setup to advanced security features and performance optimization.

Table of Contents

Understanding Postfix

What is Postfix?

Postfix is a popular mail server designed for sending, receiving, and routing emails in Linux- and Unix-based systems. Developed as a more secure alternative to Sendmail, Postfix offers high performance, flexibility, and robust security features. It efficiently processes thousands of emails per minute using multi-threaded processes and optimized queues.

The key features of Postfix include:

Support for various authentication mechanisms
Spam filtering capabilities
Protection against DDoS attacks
Ability to work with multiple domains
TLS encryption support
Integration with various databases (MySQL, PostgreSQL)
Support for LDAP and SASL authentication

Why Choose Postfix?

Compared to other MTAs like Sendmail and Exim, Postfix offers several advantages:

Better security architecture through process separation
More intuitive configuration files
Higher performance under heavy loads
Excellent documentation and community support

Postfix is widely used for corporate mail servers, SMTP gateways, marketing platforms, and web hosting environments.

Prerequisites

Before installing Postfix on CentOS Stream 10, ensure your system meets these requirements:

A functioning CentOS Stream 10 installation with root or sudo access
Minimum hardware: 1GB RAM, 1 CPU core, and 10GB disk space
A static IP address
Properly configured hostname and DNS settings
Basic understanding of Linux commands

Pre-Installation Steps

Update Your System

Always begin by updating your system packages to ensure you have the latest security patches:

sudo dnf update -y

Remove Existing Mail Servers

If you have Sendmail or another mail server installed, remove it to prevent conflicts:

sudo dnf remove sendmail -y

Configure Hostname

Proper hostname configuration is crucial for a mail server:

Check your current hostname:
```
hostname
```
Set a fully qualified domain name (FQDN) if needed:
```
sudo hostnamectl set-hostname mail.example.com
```

Edit the hosts file:

sudo nano /etc/hosts

Add or modify this line:

127.0.0.1   mail.example.com mail localhost

Set Up Firewall Rules

Configure your firewall to allow mail-related traffic:

sudo firewall-cmd --permanent --add-service=smtp
sudo firewall-cmd --permanent --add-port=587/tcp
sudo firewall-cmd --permanent --add-port=465/tcp
sudo firewall-cmd --reload

Installation Process

Installing Postfix

Now, let’s install Postfix and the necessary dependencies:

sudo dnf install -y postfix mailx cyrus-sasl cyrus-sasl-plain

This installs Postfix along with mailx (for testing email functionality) and the Cyrus SASL libraries (for authentication).

Starting and Enabling Postfix

Configure Postfix to start automatically at boot and start the service:

sudo systemctl enable postfix
sudo systemctl start postfix

Verifying Installation

Check that Postfix is running correctly:

sudo systemctl status postfix

You should see output indicating Postfix is active and running. If not, check for errors in the system journal:

sudo journalctl -u postfix

Basic Postfix Configuration

The main Postfix configuration file is located at /etc/postfix/main.cf. Let’s configure the essential settings:

Open Configuration File

sudo nano /etc/postfix/main.cf

Essential Configuration Parameters

Add or modify the following parameters:

# Server hostname
myhostname = mail.example.com

# Domain for local mail
mydomain = example.com

# Domain for locally posted mail
myorigin = $mydomain

# Network interfaces to listen on
inet_interfaces = all

# Domains to receive mail for
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

# Trusted networks
mynetworks = 127.0.0.0/8, 192.168.1.0/24

Make sure to replace example.com with your actual domain name and adjust the network settings according to your environment.

Validating Configuration

After making changes, check for syntax errors:

sudo postfix check

If no errors are reported, restart Postfix to apply the changes:

sudo systemctl restart postfix

Advanced Configuration Options

Once basic configuration is complete, you can implement more advanced options to enhance your mail server.

Mail Queue Management

Control how Postfix processes the mail queue by adding these settings to main.cf:

# Maximum message size (10MB)
message_size_limit = 10485760

# Queue lifetime settings
maximal_queue_lifetime = 1d
bounce_queue_lifetime = 1d

Setting Up Virtual Domains

To host multiple domains on your mail server:

Create a virtual domains file:
```
sudo nano /etc/postfix/virtual_domains
```
Add domains:
```
example.com OK
example.org OK
```

Add to main.cf:

virtual_mailbox_domains = /etc/postfix/virtual_domains

Create the hash table:

sudo postmap /etc/postfix/virtual_domains

Configuring Mail Aliases

Set up mail forwarding with aliases:

Edit the aliases file:
```
sudo nano /etc/aliases
```

Add aliases:

webmaster: admin@example.com
support: help@example.com

Update the alias database:
```
sudo newaliases
```

Implementing Security Measures

A secure mail server is crucial to protect against various threats. Let’s implement essential security features.

SMTP Authentication

Configure SMTP authentication to prevent unauthorized relay:

# Enable SASL authentication
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes

# Allow mail relaying only for authenticated users
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination

This configuration ensures that only authorized users can send emails through your server.

TLS/SSL Encryption

Implement TLS encryption for secure email transmission:

Generate or obtain SSL certificates:

sudo mkdir -p /etc/postfix/ssl
sudo openssl req -new -x509 -days 365 -nodes -out /etc/postfix/ssl/postfix.pem -keyout /etc/postfix/ssl/postfix.key

Configure TLS in main.cf:

# TLS parameters
smtpd_tls_cert_file = /etc/postfix/ssl/postfix.pem
smtpd_tls_key_file = /etc/postfix/ssl/postfix.key
smtpd_tls_security_level = may
smtp_tls_security_level = may

# Enforce TLS for authentication
smtpd_tls_auth_only = yes

These settings enable TLS encryption for incoming and outgoing mail.

Preventing Email Spoofing

Restrict users to only use their own email addresses:

# Prevent sender address spoofing
smtpd_sender_restrictions = reject_sender_login_mismatch

This prevents authenticated users from sending mail with forged sender addresses.

Additional Anti-Spam Measures

Add these restrictions to block common spam techniques:

# Anti-spam measures
smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination,
    reject_invalid_hostname,
    reject_non_fqdn_hostname,
    reject_non_fqdn_sender,
    reject_unknown_sender_domain

Configuring Postfix for External SMTP Relay

In some scenarios, you may need to configure Postfix to relay through an external SMTP server.

Basic Relay Configuration

To relay through an external SMTP server:

relayhost = [smtp-server-address]:587

The square brackets prevent MX lookups for the relay host.

Adding Authentication for Relay

If your relay server requires authentication:

Create a password file:
```
sudo nano /etc/postfix/sasl_passwd
```

Add credentials:

[smtp-server-address]:587 username:password

Generate the hash database:
```
sudo postmap /etc/postfix/sasl_passwd
```

Secure the files:

sudo chmod 600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db

Configure SASL authentication in main.cf:

smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_use_tls = yes
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

These settings enable authentication and TLS encryption for the SMTP relay connection.

Testing Your Postfix Installation

After configuration, it’s essential to test that your mail server works correctly.

Sending Test Emails

Send a test email using the command line:

echo "Test mail from postfix" | mail -s "Test Postfix" recipient@example.com

Replace recipient@example.com with a valid email address.

For a more detailed test, install and use the s-nail utility:

sudo dnf install -y s-nail
echo "Test email body" | s-nail -v -s "Test Subject" recipient@example.com

The -v flag provides verbose output useful for troubleshooting.

Checking Mail Logs

Monitor the mail logs to see if your test email was processed correctly:

sudo tail -f /var/log/maillog

Look for messages indicating successful delivery or errors.

Examining the Mail Queue

Check if any messages are stuck in the queue:

sudo postqueue -p

Troubleshooting Common Issues

Even with careful configuration, mail server issues can arise. Here’s how to address common problems:

Service Not Running

If Postfix isn’t running, check if any errors occurred during startup:

sudo journalctl -u postfix

Common causes include syntax errors in configuration files or port conflicts.

Authentication Problems

If users can’t authenticate, verify your SASL configuration:

sudo postconf -n | grep sasl

Ensure Cyrus SASL packages are installed and properly configured.

Connection Refused Errors

If you see “connection refused” errors in logs:

Check that Postfix is listening on the correct interfaces:
```
sudo ss -tlnp | grep master
```
Verify firewall settings:
```
sudo firewall-cmd --list-all
```

Email Delivery Issues

If emails aren’t being delivered:

Check for errors in the mail log:
```
sudo grep -i error /var/log/maillog
```

Verify relay and destination configurations:

sudo postconf -n | grep -E 'relay|destination'

Test SMTP connection manually:
```
telnet localhost 25
```

Performance Optimization

For busy mail servers, performance optimization is important for efficient operation.

Queue Processing Configuration

Optimize mail queue processing:

# Process more recipients per delivery
default_destination_recipient_limit = 50

# Queue run frequency
queue_run_delay = 300s

Process and Memory Management

Control Postfix process utilization:

# Process limits
default_process_limit = 100

Caching Techniques

Implement caching to improve performance:

# DNS lookup cache
smtp_address_preference = ipv4
disable_dns_lookups = no

Regular monitoring and benchmarking are crucial to finding the optimal settings for your specific environment.

Maintenance and Best Practices

Maintaining a healthy mail server requires ongoing attention and following best practices.

Regular Updates

Keep your system and Postfix updated:

sudo dnf update -y

Schedule regular maintenance windows for updates to minimize service disruption.

Backup Configuration

Regularly back up your Postfix configuration:

sudo mkdir -p /backup/postfix/$(date +%Y-%m-%d)
sudo cp -r /etc/postfix/* /backup/postfix/$(date +%Y-%m-%d)/

Log Management

Configure log rotation to prevent disk space issues:

sudo nano /etc/logrotate.d/postfix

Ensure logs are rotated regularly and old logs are compressed or deleted.

Regular Monitoring

Implement monitoring to detect issues early:

Check queue size regularly:
```
sudo postqueue -p | grep -c "^[A-F0-9]"
```

Monitor log files for unusual patterns:

sudo grep -i "warning\|error" /var/log/maillog | wc -l

Congratulations! You have successfully installed Postfix. Thanks for using this tutorial for installing the latest version of the Postfix mail server on CentOS Stream 10 Linux system. For additional help or useful information, we recommend you check the official Postfix website.

VPS Manage Service Offer

If you don’t have time to do all of this stuff, or if this is not your area of expertise, we offer a service to do “VPS Manage Service Offer”, starting from $10 (Paypal payment). Please contact us to get the best deal!