How to Configure the Ubuntu Postfix Mail Server to Relay Emails via Amazon SES

Many web applications running on Ubuntu servers need to send outbound emails (such as password resets or notifications). Configuring a local Postfix server to send emails directly to the internet is increasingly difficult due to strict spam filters and IP reputation requirements. The industry standard practice is to configure your local Postfix server as a “smarthost” that relays all outbound mail through a trusted transactional email provider, such as Amazon Simple Email Service (SES).

Step 1: Install Postfix and Required Modules

First, update your package list and install Postfix along with the necessary SASL modules for authentication.

sudo apt update
sudo apt install postfix libsasl2-modules

During installation, you will see a configuration prompt. Choose Internet Site. For the “System mail name”, enter your server’s fully qualified domain name (e.g., web1.example.com).

Step 2: Configure Amazon SES Credentials

Before proceeding, you must have an AWS account and have generated SMTP credentials in the SES console. Note: Your SMTP credentials are not the same as your AWS API access keys.

Create a file to store these credentials:

sudo nano /etc/postfix/sasl_passwd

Add the following line, replacing the placeholder values with your SES SMTP endpoint and credentials (separated by a colon):

[email-smtp.us-east-1.amazonaws.com]:587 SMTPUSERNAME:SMTPPASSWORD

Save the file and convert it into a database format that Postfix can read:

sudo postmap hash:/etc/postfix/sasl_passwd

Secure the files so only root can read them:

sudo chown root:root /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db
sudo chmod 0600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db

Step 3: Configure Postfix Main Settings

Now, edit the main Postfix configuration file to tell it to use the relay host and the credentials you just created.

sudo nano /etc/postfix/main.cf

Find the relayhost line and change it to your SES endpoint:

relayhost = [email-smtp.us-east-1.amazonaws.com]:587

Then, add the following lines at the very end of the file to enable authentication and TLS encryption:

# SES Authentication Settings
smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_use_tls = yes
smtp_tls_security_level = encrypt
smtp_tls_note_starttls_offer = yes
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

Step 4: Restart and Test

Save the configuration file and restart the Postfix service to apply the changes:

sudo systemctl restart postfix

To verify the configuration is working, you can send a test email from the command line using the sendmail command. Ensure the “From” address is a domain or email address you have already verified in the Amazon SES console.

sendmail [email protected]
From: [email protected]
Subject: SES Relay Test

This is a test email sent from Ubuntu via Amazon SES.
.

Check the mail log (sudo tail -f /var/log/mail.log) to confirm the message was successfully handed off to the Amazon SES relay.