Postfix on CentOS: A Legacy Setup Guide with 2026 Security Notes

Publication date: January 4, 2021

Updated: July 29, 2026

Overview

This historical procedure installs and starts Postfix on CentOS 7 and configures the message submission port.

Configure Dovecot integration after securing Postfix.

Postfix is for sending mail and Dovecot is for receiving mail. Those who need to send mail should install Postfix, and those who want to receive mail should install Dovecot as well.

Tested versions:

1. install

This section describes the configuration of Postfix from installation to startup.

1-1. Installing Postfix

The historical CentOS procedure installed Postfix with yum from an administrative shell.

[username@hostname ~]$ su -

[root@hostname ~]# yum -y install postfix

1-2. Startup Confirmation

Check the startup to confirm that it has been successfully installed.

[root@hostname ~]# /usr/sbin/postfix start

[root@hostname ~]# ps aux | grep postfix

root      1485  0.7  0.2  89744  2128 ?        Ss   16:02   0:00 /usr/libexec/postfix/master -w

postfix   1486  0.2  0.4  89848  4080 ?        S    16:02   0:00 pickup -l -t unix -u

postfix   1487  0.2  0.4  89916  4104 ?        S    16:02   0:00 qmgr -l -t unix -u

root      1489  0.0  0.1 112824   964 pts/0    S+   16:02   0:00 grep --color=auto postfix

If the output shows a process running as the postfix user, the initial startup succeeded. Stop the service before continuing with the configuration.

[root@hostname ~]# /usr/sbin/postfix stop

2. Legacy Postfix configuration walkthrough

2-1. initialization

The primary Postfix settings in this walkthrough are in /etc/postfix/main.cf. The effective configuration can include defaults and other files, so inspect it with the tools provided by the installed Postfix package.

[root@hostname ~]# vi /etc/postfix/main.cf

Apply the following change:

#

#myhostname = host.domain.tld

#myhostname = virtual.domain.tld

～omission～

#

#mydomain = domain.tld

～omission～

#myorigin = $myhostname

#myorigin = $mydomain

～omission～

#inet_interfaces = all

#inet_interfaces = $myhostname

#inet_interfaces = $myhostname, localhost

inet_interfaces = localhost

～omission～

mydestination = $myhostname, localhost.$mydomain, localhost

#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,

#       mail.$mydomain, www.$mydomain, ftp.$mydomain

～omission～

#mynetworks = 168.100.189.0/24, 127.0.0.0/8

#mynetworks = $config_directory/mynetworks

#mynetworks = hash:/etc/postfix/network_table

～omission～

#

#home_mailbox = Mailbox

#home_mailbox = Maildir/

#

myhostname = example.com

#myhostname = virtual.domain.tld

～omission～

#

mydomain = example.com

～omission～

#myorigin = $myhostname

myorigin = $mydomain

～omission～

inet_interfaces = all

#inet_interfaces = $myhostname

#inet_interfaces = $myhostname, localhost

#inet_interfaces = localhost

～omission～

#mydestination = $myhostname, localhost.$mydomain, localhost

mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,

#       mail.$mydomain, www.$mydomain, ftp.$mydomain

～omission～

mynetworks = 127.0.0.0/8, 192.168.100.0/24

#mynetworks = $config_directory/mynetworks

#mynetworks = hash:/etc/postfix/network_table

～omission～

#

#home_mailbox = Mailbox

home_mailbox = Maildir/

"myhostname", "mydomain", and "myorigin" are settings related to the domain. The "example.com" should be set to the domain name of the server. The "example.com" part of "https://example.com/" is the domain name.

The email address is username@example.com.

"mynetworks" is a setting related to the network. This is an IP address that can be connected to postfix. If the mail server and the server to be linked are different servers, modify this value accordingly.

"home_mailbox" is the mail directory. It stores sent e-mails.

2-2. OS user, or reject if not defined in $alias_maps

Set up the OS user and the user listed in $ALIAS_MAPS to send mail. An OS user is a user added by useradd.

[root@hostname ~]# vi /etc/postfix/main.cf

Apply the following change:

#local_recipient_maps = unix:passwd.byname $alias_maps

#local_recipient_maps = proxy:unix:passwd.byname $alias_maps

#local_recipient_maps =

local_recipient_maps = unix:passwd.byname $alias_maps

#local_recipient_maps = proxy:unix:passwd.byname $alias_maps

#local_recipient_maps =

Add the following to the end of main.cf

### MAIL SIZE  (20Mbyte)

message_size_limit = 20971520

### TLS

smtpd_use_tls = yes

smtpd_tls_cert_file = /etc/pki/tls/certs/localhost.crt

smtpd_tls_key_file = /etc/pki/tls/private/localhost.key

Set smtpd_tls_cert_file and smtpd_tls_key_file to a valid certificate chain and its protected private key. Plan automated renewal and confirm that Postfix reloads the renewed material.

The related Apache article contains a historical certificate example, not a current mail-certificate recipe. Use the certificate authority and Postfix documentation appropriate for the deployment.

Initial configuration required from installation of Apache on CentOS to startup

2-3. postfix submission port settings

Configure the settings for sending mail using the submission port.

[root@hostname ~]# vi /etc/postfix/master.cf

Note: Note that the file to be edited is not "main.cf" but "master.cf", so the file names are similar.

Apply the following change:

#submission inet n - n - - smtpd

～omission～

#-o smtpd_sasl_auth_enable=yes

～omission～

#-o smtpd_client_restrictions=$mua_helo_restrictions

～omission～

#-o smtpd_sender_restrictions=$mua_sender_restrictions

～omission～

#-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject

submission inet n - n - - smtpd

～omission～

-o smtpd_sasl_auth_enable=yes

～omission～

-o smtpd_client_restrictions=permit_sasl_authenticated

～omission～

-o smtpd_sender_restriction=permit_sasl_authenticated

～omission～

-o smtpd_recipient_restrictions=permit_sasl_authenticated

Install the necessary libraries for SASL authentication with yum.

[root@hostname ~]# yum -y install cyrus-sasl

[root@hostname ~]# yum -y install cyrus-sasl-plain

[root@hostname ~]# yum -y install cyrus-sasl-md5

[root@hostname ~]# yum -y install cyrus-sasl-devel

Edit saslauthd to use UNIX accounts for authentication.

[root@hostname ~]# vi /etc/sysconfig/saslauthd

Apply the following change:

#MECH=pam

MECH=shadow

2-4. Enable SASL

Enable SASL.

[root@hostname ~]# systemctl enable saslauthd

[root@hostname ~]# systemctl is-enabled saslauthd

enabled

[root@hostname ~]# systemctl list-unit-files --type=service | grep saslauthd

saslauthd.service                                enabled

[root@hostname ~]# systemctl daemon-reload

2-5. Startup Confirmation

Check if Postfix starts.

[root@hostname ~]# /usr/sbin/postfix start

[root@hostname ~]# ps aux | grep postfix

root      1838  0.0  0.1  89744  2080 ?        Ss   18:14   0:00 /usr/libexec/postfix/master -w

postfix   1839  0.0  0.3  89848  3988 ?        S    18:14   0:00 pickup -l -t unix -u

postfix   1840  0.0  0.3  89916  4008 ?        S    18:14   0:00 qmgr -l -t unix -u

root      1845  0.0  0.0 112824   968 pts/0    S+   18:15   0:00 grep --color=auto postfix

If a process runs as the postfix user, the service started. That does not prove mail routing, relay restrictions, DNS, TLS, or delivery are correct; review logs and run controlled end-to-end tests before exposing SMTP.

[root@hostname ~]# /usr/sbin/postfix stop

2-6. Automatic startup setting

Enable the service with the unit supplied by the operating-system package. Unit names and commands vary by distribution; do not create a duplicate service definition.

Check if "/usr/lib/systemd/system/postfix.service" exists. If not, create "postfix.service" as follows Execute as root user.

[root@hostname ~]# touch /etc/systemd/system/postfix.service

[root@hostname ~]# vi /etc/systemd/system/postfix.service

Use the following settings:

[Unit]

#Description.

Description=Postfix

#Control before and after execution

#Before=xxx.service

After=syslog.target network.target

[Service]

#User and group designation

User=root

Group=root

#Once activated, set the status to Activated.

Type=oneshot

RemainAfterExit=yes

#Start, stop, reload

ExecStart=/usr/sbin/postfix start

ExecStop=/usr/sbin/postfix stop

ExecReload=/usr/sbin/postfix reload

[Install]

#runlevel3 equivalent setting

WantedBy=multi-user.target

Next, register and enable the service with systemctl.

[root@hostname ~]# systemctl enable postfix

[root@hostname ~]# systemctl is-enabled postfix

enabled

[root@hostname ~]# systemctl list-unit-files --type=service | grep postfix

postfix.service                                enabled

[root@hostname ~]# systemctl daemon-reload

3. Conclusion

The historical walkthrough covers package installation, basic identity and routing, TLS, Dovecot integration, startup, and firewall access. A current mail server also requires supported packages, anti-relay controls, DNS records, certificate renewal, abuse monitoring, and deliverability testing.

Official references

• Red Hat deploying mail servers guide
• Postfix basic configuration README
• Postfix SASL authentication guidance