Configure Postfix to Send Email Using External SMTP Servers

Postfix is a mail transfer agent (MTA) that handles sending, routing, and delivering email on Unix-like systems. Most VPS setups only need a send-only SMTP server. Something that takes outgoing mail from your applications and hands it off to a real provider. That’s exactly what configuring Postfix to send email using external SMTP servers gives you: a lightweight local relay that forwards everything through Brevo, Mailgun, Amazon SES, or another provider you trust.

This postfix send-only SMTP server setup is useful for everything from cron job notifications to sending email alerts from your Linux server. Below you’ll get the full configuration, an automated script, and the troubleshooting I wish I’d had the first time around.

Why use Postfix with an external SMTP service

Running your own mail server that delivers directly to recipients is a headache you don’t want. IP reputation management, blacklist monitoring, DKIM key rotation. It’s a full-time job. External SMTP providers handle all of that. Here’s why the relay pattern works:

• Better deliverability. Providers like Brevo and Mailgun maintain relationships with Gmail, Outlook, and Yahoo. Your emails actually reach inboxes instead of spam folders.
• Reduced server load. Postfix hands off the message to the provider’s servers. Your VPS doesn’t maintain outbound SMTP connections to dozens of recipient domains.
• Simplified maintenance. No SPF/DKIM key management on your server, no IP blacklist monitoring, no reverse DNS configuration. The provider handles it.
• Cost-effective. Free tiers from Brevo (300/day) or SMTP2GO (1,000/month) cover most personal and small-business workloads.
• Scalability. Need to send 50,000 emails? Your VPS config doesn’t change. You just upgrade your provider plan.
• Compliance. External providers help with GDPR, CAN-SPAM, and CASL requirements through built-in unsubscribe handling and consent tracking.

SMTP relay services you can use with Postfix

Not all SMTP providers are equal on pricing, deliverability, and ease of setup. Here’s a comparison of the ones worth considering, then details on each.

Brevo free SMTP relay

Brevo (formerly Sendinblue) remains the best free SMTP relay for Postfix. The permanent free tier gives you 300 emails per day (about 9,000 per month) with no credit card required.

• SMTP server: smtp-relay.brevo.com:587
• Good deliverability rates across major providers
• Email tracking and templating on the free plan
• API access if you need more than SMTP

For most personal projects and small VPS workloads, Brevo’s free tier is enough. I default to it unless there’s a reason not to.

Mailgun SMTP relay

Mailgun updated its free tier. It’s now 100 emails per day on a permanent free plan (no expiration). Previously it was 5,000 emails for 3 months, which sounded better but had a time limit.

• Powerful API for developers who need more than basic SMTP
• Good documentation and support
• Email validation and domain authentication included
• Flexible pricing if you outgrow the free tier

Amazon SES SMTP relay

Amazon SES pricing changed significantly. The old “62,000 free emails from EC2” tier was replaced in August 2023. The current model:

• 3,000 message charges per month free for the first 12 months after you start using SES
• After that: $0.10 per 1,000 emails (plus data transfer)
• New AWS customers (as of July 2025) can get up to $200 in Free Tier credits across AWS services, valid for 12 months

SES is the cheapest option at scale but requires more setup (IAM policies, sandbox mode exit). Best if you’re already running on AWS and need high volume.

mail.baby SMTP relay

mail.baby is the budget option: $1/month plus $0.20 per 1,000 emails. No free tier, but the pricing is hard to beat for low-volume paid email. Unlimited domains on all plans, simple setup, 24/7 support.

For more details, see the detailed mail.baby review.

SMTP2GO

SMTP2GO is a solid alternative now that SendGrid killed its free tier. The free forever plan includes 1,000 emails per month with no credit card required. Setup is straightforward, deliverability is good, and the dashboard is clean.

Resend

Resend is a newer, API-first SMTP provider aimed at developers. Free tier: 3,000 emails/month (100/day). The modern developer experience and React Email integration make it appealing if you’re building apps, though it works fine as a plain SMTP relay too.

Zeptomail SMTP relay

Zeptomail from Zoho no longer has a perpetual free tier. You get one free credit (10,000 emails) valid for 1 month as a trial. After that, it’s credit-based pricing (1 credit = 10,000 emails, credits valid for 6 months). Pricing is not publicly listed in USD. You contact sales.

Good if you’re in the Zoho ecosystem. For a step-by-step ZeptoMail SMTP relay guide, see the dedicated article.

SendGrid SMTP (trial only)

SendGrid is owned by Twilio. It’s still a capable platform with high deliverability and solid APIs. But at $19.95/month minimum, it’s no longer the go-to for hobby projects. I’d pick Brevo or SMTP2GO for free-tier needs.

Prerequisites

Before configuring Postfix, make sure you have:

Install required packages

sudo apt update && sudo apt install -y postfix libsasl2-modules mailutils

Also make sure CA certificates are installed (for TLS verification):

sudo apt install -y ca-certificates

Verify: Run postconf -m | grep sasl. You should see SASL mechanisms listed (LOGIN, PLAIN, etc.). If the command returns nothing, libsasl2-modules is missing.

DNS records (SPF, DKIM, DMARC)

Your emails will land in spam regardless of your Postfix configuration if DNS records are missing. Your SMTP provider gives you the specific values to add. At minimum, you need:

• SPF TXT record: authorizes your provider to send on behalf of your domain (e.g., v=spf1 include:brevo.com ~all)
• DKIM public key: added as a TXT record so recipient servers can verify message signatures
• DMARC policy: tells receiving servers what to do with messages that fail SPF/DKIM checks

Each provider has its own documentation for these. Set them up before testing. Otherwise your test emails will go straight to spam.

VPS port requirements

Many budget VPS providers block outbound ports 25, 587, and 465 by default to prevent spam. This includes Hetzner, OVH, Contabo, and Netcup. You’ll need to open a support ticket asking them to unblock port 587 (STARTTLS) for your server.

To check if your SMTP ports are reachable, use nc:

nc -zv smtp-relay.brevo.com 587

A successful connection shows Connection to smtp-relay.brevo.com 587 port [tcp/submission] succeeded!. If it hangs, your provider is blocking the port.

Configure Postfix as an external SMTP relay

There are two paths: manual configuration or an automated script. Both produce the same result.

sudo nano /etc/postfix/main.cf

compatibility_level = 3.11
relayhost = [smtp-relay.brevo.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = may
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
inet_interfaces = loopback-only
header_size_limit = 4096000

sudo nano /etc/postfix/sasl_passwd

[smtp-relay.brevo.com]:587 your_username:your_password

# Postfix 3.11+ (lmdb):
sudo postmap lmdb:/etc/postfix/sasl_passwd

# Older Postfix (hash):
# sudo postmap hash:/etc/postfix/sasl_passwd

sudo chown root:root /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db
sudo chmod 0600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db

sudo nano /etc/postfix/sender_canonical

/.+/    your_email@example.com

sudo nano /etc/postfix/smtp_header_checks

/From:.*/ REPLACE From: your_email@example.com

sudo postconf -e 'sender_canonical_classes = envelope_sender, header_sender'
sudo postconf -e 'sender_canonical_maps = regexp:/etc/postfix/sender_canonical'
sudo postconf -e 'smtp_header_checks = regexp:/etc/postfix/smtp_header_checks'

echo "yourdomain.com" | sudo tee /etc/mailname
sudo systemctl restart postfix

curl -sSL https://utils.bitdoze.com/scripts/postfix-setup.sh -o postfix-setup.sh

chmod +x postfix-setup.sh
bash postfix-setup.sh

root@cloud:/var/log# bash postfix-setup.sh
[2024-09-18 06:04:42] Step 1: Make sure you have already set up your domain with your SMTP provider and added any necessary DNS records (like SPF, DKIM, and CNAME).
Enter your SMTP Username: bitdoze1@gmail.com
Enter your SMTP Password:
Enter the domain you are using with your SMTP provider (e.g. example.com): bitdoze.ro
Enter the sender email address (optional, press Enter to skip):
Enter your Postfix hostname (e.g. yourdomain.com): bitdoze.ro
Enter your SMTP server with port (e.g. [smtp.provider.com]:587): [smtp-relay.brevo.com]:587
[2024-09-18 06:05:20] Step 2: Updating system and installing Postfix...
[2024-09-18 06:05:23] Step 3: Configuring Postfix...
[2024-09-18 06:05:23] Backed up /etc/postfix/main.cf to /etc/postfix/main.cf.bak
[2024-09-18 06:05:23] Step 4: Creating /etc/postfix/sasl_passwd file with SMTP credentials...
[2024-09-18 06:05:23] Backed up /etc/postfix/sasl_passwd to /etc/postfix/sasl_passwd.bak
[2024-09-18 06:05:23] Securing /etc/postfix/sasl_passwd and creating hash...
[2024-09-18 06:05:25] Step 5: Configuring sender address settings...
[2024-09-18 06:05:25] Resetting sender address configuration...
[2024-09-18 06:05:25] Step 6: Configuring /etc/mailname...
[2024-09-18 06:05:25] Backed up /etc/mailname to /etc/mailname.bak
[2024-09-18 06:05:25] Step 7: Restarting Postfix...
postfix/postfix-script: refreshing the Postfix mail system
[2024-09-18 06:05:27] All done! Postfix has been configured with your SMTP settings.

YouTube embed of the one-click setup walkthrough:

Port 465 with implicit TLS (optional)

Port 587 with STARTTLS is the most common and well-tested setup. But many providers (including Brevo) also support port 465 with implicit TLS (sometimes called SMTPS or wrappermode). RFC 8314 now recommends port 465 for implicit TLS alongside 587 for STARTTLS.

To use port 465, change your relayhost and add one line to main.cf:

relayhost = [smtp-relay.brevo.com]:465
smtp_tls_wrappermode = yes

That’s it. The rest of the config stays the same.

Testing and verifying your Postfix SMTP relay

After configuration (whether manual or script), verify everything works before trusting it for real email.

Send a test email

echo "Postfix relay test" | mail -s "Test Email" recipient@example.com

With a custom sender address:

echo "Postfix relay test" | mail -s "Test Email" -r sender@yourdomain.com recipient@example.com

Replace recipient@example.com with an address you can check.

Check the mail log

Watch the log in real time while sending:

tail -f /var/log/mail.log

Or check recent entries:

tail -100 /var/log/mail.log

A successful delivery looks like:

Jul 17 10:30:45 hostname postfix/smtp[12345]: 1AB2C3D4E5F: to=<recipient@example.com>, relay=smtp-relay.brevo.com[1.2.3.4]:587, delay=0.8, delays=0.02/0.00/0.5/0.28, dsn=2.0.0, status=sent (250 2.0.0 OK 1234567890abcdef)

The key is status=sent. If you see status=bounced, status=deferred, or status=failed, read the error message that follows. It usually tells you exactly what’s wrong.

You can also use journalctl:

journalctl -u postfix -f

Verify deliverability

1. Send to multiple domains: test with Gmail, Outlook, and Yahoo. Each has different spam filters.
2. Check spam folders: even with correct config, new domains/IPs sometimes land in spam until reputation builds up.
3. Use mail-tester.com: send a test email to the address they give you, then check their score. They’ll flag SPF/DKIM/DMARC issues, blacklists, and content problems.
4. Check IP reputation: use MXToolbox to verify your VPS IP isn’t on any blacklists (this is separate from your SMTP provider’s reputation).

Troubleshooting common Postfix SMTP relay errors

This is the section I wish existed when I first set up Postfix relay. Here are the errors you’re most likely to hit.

“No worthy mechs found”: SASL authentication failure

Symptom: In /var/log/mail.log:

warning: SASL authentication failure: No worthy mechs found

Cause: libsasl2-modules is not installed. This is the most common failure for new Postfix relay setups.

Fix:

sudo apt install -y libsasl2-modules
sudo systemctl restart postfix

Verify SASL mechanisms are available: postconf -m | grep sasl

“Authentication failed”: wrong credentials

Symptom: SASL authentication failed or authentication failed in the mail log.

Cause: Incorrect username or password in /etc/postfix/sasl_passwd. Some providers (Brevo, Gmail) require app-specific passwords or SMTP keys, not your regular login password.

Fix:

1. Verify your credentials by logging into your provider’s dashboard
2. Check the sasl_passwd file: sudo cat /etc/postfix/sasl_passwd
3. Regenerate the lookup table: sudo postmap lmdb:/etc/postfix/sasl_passwd
4. Restart: sudo systemctl restart postfix

“Connection timed out”: blocked SMTP ports

Symptom: Connection timed out or Network is unreachable in the mail log.

Cause: Your VPS provider is blocking outbound SMTP traffic.

Fix: Open a support ticket with your hosting provider asking to unblock port 587. To verify, test the connection: nc -zv smtp-relay.brevo.com 587

“Relay access denied”

Symptom: relay access denied in the mail log.

Cause: The relayhost directive is missing or misconfigured, or SASL authentication isn’t working (Postfix tries to deliver directly and gets rejected by the recipient server).

Fix: Verify relayhost is set in /etc/postfix/main.cf:

postconf relayhost

Should return something like [smtp-relay.brevo.com]:587. If empty, add it and restart Postfix.

Emails landing in spam

Symptom: Emails are sent successfully (status=sent in the log) but recipients don’t see them in their inbox.

Cause: Missing or incorrect SPF, DKIM, or DMARC DNS records. This is a DNS configuration issue, not a Postfix issue.

Fix:

1. Log into your SMTP provider’s dashboard and check domain authentication status
2. Verify SPF, DKIM, and DMARC records exist in your domain’s DNS zone
3. Use mail-tester.com to get a detailed deliverability report
4. Check MXToolbox for DNS and blacklist issues

Conclusions

Configuring Postfix to relay through an external SMTP server is the reliable path for VPS email delivery. You get the flexibility of a local MTA without the pain of managing your own mail server reputation. Brevo remains my default recommendation for free-tier needs. 300 emails/day covers most workloads.

Always test thoroughly before relying on the setup for production email. Check the mail log, verify deliverability across multiple providers, and make sure your DNS records are solid.

If you also need to send WordPress emails via SMTP, the same SMTP provider credentials work with plugins like FluentSMTP. For next steps on securing your server, see the Docker security guide, or harden your Linux server with the SSH hardening walkthrough.