How to Completely Disable the ‘postfix’ (Mail Transfer Agent) Daemon in Ubuntu Server

The postfix daemon is a highly capable Mail Transfer Agent (MTA) used to route and deliver electronic mail. While it is an essential component for dedicated email servers, it is frequently installed by default (or pulled in as a dependency by packages like mailutils or cron) on standard Ubuntu Server web or database nodes. If your server is not explicitly designed to send or receive email, leaving an MTA running—even if it is bound only to localhost (127.0.0.1)—wastes system resources and creates a potential vector for local privilege escalation or spam relaying if misconfigured.

This guide explains how to completely disable the postfix daemon in Ubuntu Server, ensuring the system cannot act as an active mail transfer agent.

Stop and Disable the Postfix Daemon

To secure the server and stop it from listening on port 25 (SMTP), we must halt the daemon and explicitly mask it via systemd.

1. Log into your Ubuntu Server via SSH or local console using an account with sudo privileges.
2. First, stop the active service to immediately close the SMTP listening port:

   sudo systemctl stop postfix.service

3. Next, disable the service so it does not initialize during the next system boot:

   sudo systemctl disable postfix.service

4. To guarantee that no other dependent service (like a local cron job trying to send a status report) can accidentally wake the MTA, mask the service unit entirely:

   sudo systemctl mask postfix.service

Verify the Port Closure

By masking the service, you have effectively neutralized the MTA without needing to purge the package, which satisfies strict dependency chains on older systems.

To verify the lockdown is successful, run the following command to check the status of the unit:

systemctl status postfix.service

The output will clearly state that the service is masked (symlinked to /dev/null) and the Active state will read inactive (dead). More importantly, execute the sudo ss -tlnp | grep 25 command. The output should be completely blank, confirming that your Ubuntu Server is no longer listening for inbound SMTP connections (even on localhost), successfully eliminating that potential attack vector and conserving RAM.