SMTP Relay Setup with Postfix on VPS

June 2026 · 8 min read

Sending emails directly from a VPS often results in messages landing in spam because cloud server IPs are blacklisted by default. SMTP Relay solves this problem by using Postfix as a Mail Transfer Agent (MTA) to forward emails through a trusted SMTP provider like Gmail, AWS SES, or SendGrid. This approach ensures higher deliverability without managing email infrastructure yourself.

Install Postfix

sudo apt update
sudo apt install postfix mailutils -y

# During setup wizard, choose "Satellite system"
# Enter system mail name = yourvps.yourdomain.com

Configure SMTP Relay via Gmail (App Password)

sudo nano /etc/postfix/main.cf

# Add or modify these lines
relayhost = [smtp.gmail.com]:587
smtp_use_tls = yes
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_security_level = encrypt

# Create credential file
sudo nano /etc/postfix/sasl_passwd
[smtp.gmail.com]:587 [email protected]:your_16char_app_password

# Hash and secure the file
sudo postmap /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db

sudo systemctl restart postfix

Configure SMTP Relay via AWS SES

sudo nano /etc/postfix/main.cf

relayhost = [email-smtp.ap-southeast-1.amazonaws.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_use_tls = yes
smtp_tls_security_level = encrypt
smtp_tls_note_starttls_offer = yes

sudo nano /etc/postfix/sasl_passwd
[email-smtp.ap-southeast-1.amazonaws.com]:587 AKIAIOSFODNN7EXAMPLE:wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

sudo postmap /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db
sudo systemctl restart postfix

Test Email Sending

# Send test email
echo "Test from VPS" | mail -s "SMTP Relay Test" [email protected]

# View mail queue
mailq

# View delivery log
sudo tail -f /var/log/mail.log

Configure Canonical Sender (Prevent Root Sending)

sudo nano /etc/postfix/main.cf
# Add:
sender_canonical_maps = hash:/etc/postfix/sender_canonical

sudo nano /etc/postfix/sender_canonical
root    [email protected]
@yourvps yourdomain.com    [email protected]

sudo postmap /etc/postfix/sender_canonical
sudo systemctl reload postfix

Tip: Before sending emails from your VPS, set up SPF records in your domain to improve deliverability and prevent spam filtering. You can verify your SPF, DKIM, and DMARC records at dnsxray.com/mailtest

Verify SMTP Relay is Working Correctly

# Test SMTP connection to relay
telnet smtp.gmail.com 587

# Check Postfix queue
mailq

# Force delivery of queued messages
sudo postqueue -f

# View real-time logs
sudo tail -f /var/log/mail.log

# Verify Postfix configuration has no errors
sudo postfix check

Tip: If you see status=sent (250 2.0.0 OK) in mail.log, it means SMTP relay is working properly and the email has been accepted by the relay provider.

Common Issues & Troubleshooting

Error: "SASL authentication failed"

Gmail App Password is incorrect or 2FA is not enabled:

# Gmail requires App Password (not regular password)
# Go to: Google Account > Security > 2-Step Verification > App passwords
# Generate App Password for "Mail" > "Linux computer"
sudo nano /etc/postfix/sasl_passwd
# Update with new App Password
sudo postmap /etc/postfix/sasl_passwd
sudo systemctl restart postfix

Email Sent But Lands in Spam

Set up SPF record in your domain and check blacklist status:

# Add SPF record to DNS TXT record:
# v=spf1 include:_spf.google.com ~all
# (if using Gmail relay)

# Check email header received at destination
# Look for "Received-SPF" and "Authentication-Results"

Error: "Connection timed out" to Relay

ISP or VPS provider blocking port 587. Try port 465 instead:

sudo nano /etc/postfix/main.cf
relayhost = [smtp.gmail.com]:465
smtp_tls_wrappermode = yes
sudo systemctl restart postfix
# Test connection
telnet smtp.gmail.com 465

Postfix Queue Not Flushing

Verify relay provider accepts connections:

sudo mailq
sudo postqueue -f
sudo tail -50 /var/log/mail.log
# If errors repeat, purge queue and fix config first
sudo postsuper -d ALL

Frequently Asked Questions

What's the difference between SMTP Relay and a full email server?

SMTP Relay is an MTA that accepts emails from local applications and forwards them through a trusted provider. It doesn't receive external emails or maintain user mailboxes. A full email server handles both receiving and sending, with storage for user accounts. SMTP Relay is ideal for application notifications where you only need to send emails.

Should I use Gmail Relay or AWS SES?

Gmail Relay can send up to 500 emails per day, suitable for low-volume applications. AWS SES is better for high-volume scenarios like e-commerce notifications, pricing at $0.10 per 1,000 emails with excellent deliverability rates.

Which AWS SES region should I choose for a Thai VPS?

Use ap-southeast-1 (Singapore) as the closest region with low latency. You must verify your domain and sender email address in the SES console before use. In the initial period, you'll need to request production access to exit sandbox mode.

For those looking for a Thai VPS that supports full email setup and DirectAdmin, asiagb.com offers VPS services in Thailand with complete email configuration support, 99% SLA, and Thai language support.