How to Configure Postfix Mail Transfer Agent with SASL Authentication and TLS Encryption on Ubuntu Server

Architectural Foundation of Postfix MTA and Dovecot SASL Integration

In Unix and Linux systems engineering, Postfix is the premier enterprise Mail Transfer Agent (MTA). Designed by Wietse Venema as a secure, high-performance alternative to Sendmail, Postfix employs a modular, decoupled architecture consisting of multiple single-purpose daemons (such as smtpd, qmgr, cleanup, pickup, and anvil) governed by the master orchestrator (master.cf).

To operate a modern, RFC-compliant mail submission endpoint, Postfix must integrate with two essential security subsystems: Simple Authentication and Security Layer (SASL) and Transport Layer Security (TLS). Rather than implementing redundant user authentication databases, Postfix connects to Dovecot’s authentication service over a sandboxed Unix domain socket. Dovecot verifies user credentials against system PAM, SQL, or LDAP catalogues, returning cryptographic auth tokens to Postfix. Concurrently, Postfix enforces modern cipher suites (TLS 1.2 and TLS 1.3) to prevent eavesdropping and credential sniffing across untrusted public networks.

Service Port	Network Protocol	Postfix Service Name	Encryption Mechanism	Authentication Requirement
Port 25	Server-to-Server SMTP	smtp	Opportunistic STARTTLS	No auth (Relay restricted to local domains)
Port 587	Client Message Submission	submission	Mandatory STARTTLS	Mandatory SASL authentication
Port 465	Secure SMTP Submission	submissions (smtps)	Implicit TLS / SSL wrapper	Mandatory SASL authentication

Installing Postfix and Dovecot SASL Packages on Ubuntu Server

Install Postfix along with Dovecot’s core authentication and utility packages. When prompted by the Debian debconf interface, select Internet Site and enter your server’s Fully Qualified Domain Name (e.g., mail.example.internal).

# Update package repository and install Postfix + Dovecot SASL
sudo apt-get update
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
    postfix postfix-pcre dovecot-core dovecot-imapd libsasl2-modules certbot

Configuring Dovecot to Expose a Postfix SASL Socket

Postfix operates chrooted inside /var/spool/postfix/. To permit Postfix to communicate with Dovecot, configure Dovecot to construct a listener socket inside the Postfix spool directory.

Editing /etc/dovecot/conf.d/10-master.conf:

Open /etc/dovecot/conf.d/10-master.conf and locate the service auth block. Configure the Unix listener socket:

service auth {
  # Postfix smtp-auth socket listener
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
  }
}

Editing /etc/dovecot/conf.d/10-auth.conf:

Ensure plaintext authentication mechanisms are authorized exclusively when wrapped inside an encrypted TLS session:

# Enforce SSL/TLS for all password handshakes
disable_plaintext_auth = yes
auth_mechanisms = plain login

Restart Dovecot to initialise the socket:

sudo systemctl restart dovecot
sudo ls -l /var/spool/postfix/private/auth

Configuring Postfix Parameters in /etc/postfix/main.cf

The primary configuration file /etc/postfix/main.cf dictates domain handling, TLS certificate paths, SASL authentication bindings, and anti-relay access policies.

# Backup the default configuration
sudo cp /etc/postfix/main.cf /etc/postfix/main.cf.orig

# Apply production-hardened Postfix configuration
sudo postconf -e "myhostname = mail.example.internal"
sudo postconf -e "mydomain = example.internal"
sudo postconf -e "myorigin = /etc/mailname"
sudo postconf -e "inet_interfaces = all"
sudo postconf -e "inet_protocols = ipv4"
sudo postconf -e "mydestination = \$myhostname, example.internal, localhost.localdomain, localhost"

# 1. TLS Encryption Configuration (Modern TLS 1.2 / TLS 1.3)
sudo postconf -e "smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.internal/fullchain.pem"
sudo postconf -e "smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.internal/privkey.pem"
sudo postconf -e "smtpd_tls_security_level = may"
sudo postconf -e "smtpd_tls_auth_only = yes"
sudo postconf -e "smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1"
sudo postconf -e "smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1"
sudo postconf -e "smtpd_tls_ciphers = high"

# 2. Dovecot SASL Authentication Configuration
sudo postconf -e "smtpd_sasl_type = dovecot"
sudo postconf -e "smtpd_sasl_path = private/auth"
sudo postconf -e "smtpd_sasl_auth_enable = yes"
sudo postconf -e "smtpd_sasl_security_options = noanonymous"
sudo postconf -e "smtpd_sasl_local_domain = \$myhostname"
sudo postconf -e "broken_sasl_auth_clients = yes"

# 3. Access Controls and Anti-Relay Hardening
sudo postconf -e "smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination"
sudo postconf -e "smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination"

Activating Secure Submission Ports (587 & 465) in master.cf

By default, Ubuntu leaves ports 587 (Submission) and 465 (SMTPS) commented out. Open /etc/postfix/master.cf and activate both services to support authenticated mail submission from mobile clients and web applications.

# ====================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
# ====================================================================

# Port 587: Submission with STARTTLS
submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

# Port 465: SMTPS with Implicit TLS Wrapper
submissions inet n      -       y       -       -       smtpd
  -o syslog_name=postfix/submissions
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

Validating, Starting, and Testing Postfix Deployment

Verify that syntax passes parsing validation and test authenticated submission using OpenSSL:

# Check configuration syntax
sudo postfix check

# Restart and enable Postfix systemd unit
sudo systemctl restart postfix
sudo systemctl enable postfix

# Verify network socket listeners on 25, 465, and 587
sudo ss -tulpn | grep -E ':(25|465|587)'

# Test TLS handshake on port 587 using OpenSSL client
openssl s_client -starttls smtp -connect 127.0.0.1:587 -crlf

Managing Mail Queues and Diagnostic Commands

Administrators audit and purge mail queues using dedicated Postfix control utilities:

# Inspect mail queue status and pending messages
sudo postqueue -p

# Force immediate queue flush (attempt immediate delivery)
sudo postqueue -f

# Inspect raw headers and envelope of queued message by Message-ID
sudo postcat -q <Queue_ID>

# Purge a specific stuck message from queue
sudo postsuper -d <Queue_ID>

# Purge all deferred messages from queue
sudo postsuper -d ALL deferred

Troubleshooting Postfix and Dovecot SASL Faults

Observed Fault	Probable Root Cause	Technical Diagnostic Method	Remediation Protocol
Relay access denied (554 5.7.1)	Client not authenticated or sending from IP outside mynetworks	Check /var/log/mail.log for NOQUEUE: reject	Ensure client authenticates via SASL before transmitting RCPT TO, or add IP to mynetworks
fatal: no SASL authentication mechanisms	Dovecot auth socket inaccessible or missing SASL module libraries	Check permissions of /var/spool/postfix/private/auth	Install libsasl2-modules; verify Dovecot service auth block owner is postfix
SSL_accept error: certificate verification failed	Self-signed certificate untrusted or intermediate CA missing from chain	Run openssl s_client -connect mail.example.internal:465	Point smtpd_tls_cert_file to fullchain.pem (never to raw cert.pem)
warning: SASL: Connect to private/auth failed: No such file or directory	Postfix chroot enabled but socket placed outside chroot path	Inspect socket path definition in main.cf	Specify relative path private/auth, resolving to /var/spool/postfix/private/auth
Port 25 blocked by Cloud Provider	Outbound port 25 blocked by ISP or AWS/GCP to prevent spam	Run nc -zv smtp.gmail.com 25	Configure external authenticated relay host via relayhost = [smtp.sendgrid.net]:587