Configure Postfix SMTP Relay to Send Email from VPS

June 2026 · 8 min read

Most web applications need to send email—password resets, order confirmations, notifications, and alerts. Postfix is a popular MTA (Mail Transfer Agent) that you can easily configure as an SMTP relay to forward email through an external SMTP service. This prevents your email from landing in spam folders.

Install Postfix

sudo apt update
sudo apt install postfix mailutils -y

# When prompted for the configuration type, select "Internet Site" and enter your server hostname

Configure Relay via Gmail SMTP

Note: Gmail requires you to create an App Password first (2FA must be enabled). Go to myaccount.google.com → Security → App passwords

sudo nano /etc/postfix/main.cf

# Add or modify these lines
relayhost = [smtp.gmail.com]:587
smtp_use_tls = yes
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

# Create the password file
sudo nano /etc/postfix/sasl_passwd

# Add:
[smtp.gmail.com]:587  [email protected]:YOUR_APP_PASSWORD

# Hash the file and set permissions
sudo postmap /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db

# Restart postfix
sudo systemctl restart postfix

Test Sending Email

# Send a test email
echo "Test from VPS $(hostname)" | mail -s "Postfix Test" [email protected]

# Check the log to verify successful delivery
sudo tail -f /var/log/mail.log

Configure PHP mail() to Use Postfix

sudo nano /etc/php/8.3/fpm/php.ini

# Set sendmail_path
sendmail_path = /usr/sbin/sendmail -t -i

# Or use SMTP directly (if using PHPMailer)
# MAIL_HOST=localhost
# MAIL_PORT=25

Tip: For production systems sending high volumes of email, use a transactional email service like SendGrid, Mailgun, or Amazon SES instead of Gmail. Gmail is limited to 500 emails/day and is best suited for testing or internal alerts.

Verify Postfix is Working Correctly

# Check service status
systemctl status postfix

# View mail queue
mailq

# View logs in real-time
sudo tail -f /var/log/mail.log

# Test SMTP connection
telnet smtp.gmail.com 587

Tip: If email lands in spam, check your domain's SPF, DKIM, and DMARC records using dnsxray.com → Email Check. You'll see your deliverability score and which records are missing.

Common Issues & Troubleshooting

Error: "SASL authentication failed" in mail.log

The password is incorrect or the App Password is invalid. Create a new App Password and update the file:

# Update the password
sudo nano /etc/postfix/sasl_passwd
# Edit with the new password
sudo postmap /etc/postfix/sasl_passwd
sudo systemctl reload postfix

Email sends but lands in spam every time

Your VPS IP may be on a blacklist, or your domain lacks SPF/DKIM records. Check your IP reputation first:

# Check if your IP is on a blacklist
# Use mxtoolbox.com/blacklists or
curl -s "https://www.stopforumspam.com/api?ip=YOUR_VPS_IP&f=json"

Postfix won't send email because port 25 is blocked

Most VPS providers block outbound port 25 to prevent spam. Use port 587 (STARTTLS) or port 465 (SSL) for relay instead:

# Check if port 25 is available
nc -zv smtp.gmail.com 25 2>&1
nc -zv smtp.gmail.com 587 2>&1
# If port 25 fails but 587 works = relay is your only option

PHP mail() returns true but email never arrives

mail() returning true only means the email reached the MTA, not that delivery succeeded. Check the mail log and queue:

# View mail queue
mailq

# Force flush the queue
sudo postfix flush

# See details of queued messages
sudo postcat -q MESSAGE_ID

Frequently Asked Questions

What's the difference between a Postfix relay and a full mail server?

A full mail server (Postfix + Dovecot + SpamAssassin) receives and sends its own email. It's complex to manage and you must maintain deliverability yourself. A SMTP relay just receives email from your application and forwards it through another service (Gmail, SendGrid). It's simpler and has better deliverability for transactional emails.

Should I use SendGrid or Gmail for production?

SendGrid/Mailgun is better for production because it offers a dashboard showing delivery rates, bounces, and spam complaints. You get a dedicated IP and higher limits. Gmail is limited to 500 emails/day (free) and is best for testing or internal alerts only.

How do I set up SPF records to prevent email from landing in spam?

SPF tells mail servers which servers are authorized to send email on behalf of your domain. If using Gmail relay: v=spf1 include:_spf.google.com ~all. If using SendGrid: v=spf1 include:sendgrid.net ~all. Add this as a TXT record with your DNS provider.