A Postfix server left on default settings is a magnet for spammers. Within hours of going online, bots will probe it for open relays, hammer it with authentication attempts, and try to use it to blast spam — which can get your IP blocklisted and your domain's reputation destroyed. Learning how to secure postfix properly is not optional if you run your own mail server. This guide covers the essential hardening steps, from closing relays to rate limiting and intrusion blocking.
Step 1: Close the Open Relay
An open relay lets anyone send mail through your server to any destination. Postfix is not an open relay by default, but misconfiguration can easily create one. The key setting is smtpd_relay_restrictions: it should permit mail only from trusted networks (mynetworks) and authenticated users, and reject everything else. Test your server with an online open-relay checker after every configuration change. Never add broad IP ranges to mynetworks, and never trust a network you do not control.
Step 2: Enforce SMTP Authentication
Remote users must authenticate before sending. Enable SASL authentication with Dovecot or Cyrus, and require it for all submission traffic. Disable plaintext authentication on unencrypted connections by setting smtpd_tls_auth_only = yes, so credentials never travel in the clear. Use strong, unique passwords for every mailbox, and consider disabling password authentication entirely for accounts that only need to receive mail.
Step 3: Require TLS Encryption
Configure Postfix with a valid TLS certificate — a free Let's Encrypt certificate works fine — and enable opportunistic TLS for both inbound and outbound mail. TLS protects credentials and message content in transit, and major providers increasingly expect it. While you are at it, disable old, broken protocols (SSLv2, SSLv3) and weak ciphers in your TLS settings.
Step 4: Rate Limit Sending
Even authenticated accounts get compromised. Rate limits contain the damage. Postfix's built-in anvil service tracks connection and message rates per client, and you can cap them with settings like smtpd_client_message_rate_limit and smtpd_client_connection_rate_limit. For per-user limits, tools like postfwd or policyd give finer control. Set limits that fit your real traffic: a typical user sends a handful of messages per minute, so a limit of 100 per hour per account is generous for humans and crippling for a spam bot.
Step 5: Block Bots With Postscreen and RBLs
Postscreen is Postfix's built-in shield against spam bots. It greets connecting clients, checks them against DNS blocklists, and drops connections from known bad actors before they ever reach your SMTP daemon. Enable postscreen on port 25 and configure it with reputable DNS blocklists such as Spamhaus Zen and Barracuda. Add reject_rbl_client checks to your recipient restrictions as a second layer. Used together, postscreen and RBLs reject the majority of spam connections outright, saving CPU and log space.
Step 6: Add Fail2ban and Monitoring
Fail2ban watches your Postfix logs for repeated authentication failures and bans offending IPs at the firewall. It is the single most effective defense against brute-force attacks on your mail accounts. Install fail2ban, enable the postfix and postfix-sasl jails, and set sensible ban times — a few hours for repeat offenders. Also monitor your mail queue daily: a sudden queue spike is often the first sign of a compromised account. Tools like pflogsumm give you a daily summary of rejected mail, top senders, and warnings worth reading.
Step 7: Harden the Server Around Postfix
Mail security is not just Postfix. Keep the host OS patched, run a firewall (UFW works well) that exposes only the ports you need — 25, 587, 465, 993, and 995 — and disable password logins for SSH in favor of keys. If your VPS provider offers it, set a PTR record for your mail hostname and publish SPF, DKIM, and DMARC records for every sending domain. These authentication records do not just improve deliverability; they also make it much harder for attackers to impersonate your domain. A hardened VPS from a provider like Contabo or RackNerd gives you a clean, controllable base to build on.
Testing Your Hardening
After applying these steps, verify the result. Run an open-relay test from an external network, send a test message and confirm it passes SPF, DKIM, and DMARC at the receiving end, and deliberately trigger a few failed logins to confirm fail2ban bans the source IP. Review your mail logs for a day after hardening: legitimate traffic should flow normally while bot connections drop sharply. Revisit these settings after every Postfix upgrade, since package updates can reset configuration files or change default behavior.
Key Takeaways
- Never run an open relay: restrict relaying to trusted networks and authenticated users only.
- Require SASL authentication and TLS-only logins so credentials are never exposed.
- Rate-limit per client and per user to contain the damage from compromised accounts.
- Use postscreen plus DNS blocklists to drop most spam bots before they reach Postfix.
- Add fail2ban for brute-force protection and monitor your queue daily for abuse signals.
- Harden the host too: firewall, SSH keys, patches, and proper SPF, DKIM, and DMARC records.