Building a Modern Postfix SMTP Relay: Rate Limiting, Mandatory TLS, and SASL Auth

Running an internal Postfix relay server gives engineering teams complete control over transactional email pipelines (user signups, password resets, billing invoices) without paying exorbitant per-message charges to third-party SaaS vendors. However, if an outbound relay is misconfigured, it risks becoming an open relay exploited by spammers, causing your VPS IP to be immediately blacklisted across Spamhaus, Barracuda, and Microsoft SNDS.

Building a production-ready Postfix SMTP relay requires three non-negotiable security layers: Cyrus SASL authentication on port 587, mandatory TLS encryption for credentials, and destination-based outbound throttling to prevent rate-limit bans from major email providers like Google and Microsoft.

Understanding Postfix's modular architecture reveals how it maintains reliability under heavy load. Rather than running a monolithic server process, Postfix separates concerns across distinct internal daemons connected via local Unix domain sockets and FIFO queues:

• **smtpd:** The network listener that accepts incoming SMTP submissions and performs access control.
• **cleanup:** Canonicalizes message headers, strips unwanted internal routing IP tags, and rewrites sender envelopes.
• **qmgr (Queue Manager):** Evaluates message destinations, manages active and deferred delivery pools, and schedules deliveries across transport workers.
• **smtp:** The outbound client daemon that resolves destination MX records, negotiates TLS, and transmits mail to recipient servers.

Expand

Securing Postfix Submission Port and Enforcing SASL

In /etc/postfix/master.cf, enable the submission daemon (port 587) with mandatory TLS and client authentication:

# /etc/postfix/master.cf
submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

The option smtpd_tls_security_level=encrypt is vital. It guarantees that the submission listener rejects any plain-text authentication attempts over unencrypted channels, protecting application passwords from local sniffing.

Configuring Main Parameters and Outbound Throttling

In /etc/postfix/main.cf, configure queue retention parameters, TLS ciphers, and per-destination rate limits:

# /etc/postfix/main.cf
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
inet_interfaces = all
inet_protocols = ipv4

# Prevent Open Relay
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination

# Outbound TLS Configuration
smtp_tls_security_level = dane
smtp_dns_support_level = dnssec
smtp_tls_loglevel = 1
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

# Throttling to prevent IP reputation burnout
default_destination_concurrency_limit = 5
default_destination_rate_delay = 1s
smtp_destination_rate_delay = 1s
smtp_extra_recipient_limit = 10

Setting smtp_tls_security_level = dane combined with dnssec support instructs Postfix to verify DANE TLSA DNS records when connecting to receiving mail exchanges, protecting outgoing email from opportunistic STARTTLS stripping attacks.

The throttling directive default_destination_rate_delay = 1s prevents your relay from blasting hundreds of simultaneous connections to a single destination domain (such as gmail.com). Most large email receivers interpret connection bursts from new or un-warmed IP addresses as spam activity and will issue temporary 421 4.7.0 rate limit deferrals. Throttling outbound bursts ensures a smooth, predictable sending cadence that maintains high IP reputation.

Monitoring Outbound Queues and Flush Controls

Manage and monitor mail delivery queues:

# Inspect mail queue status and recipient backlogs
mailq
postqueue -p

# Flush queue to force immediate redelivery attempts
sudo postqueue -f

# Inspect detailed transaction logs
sudo tail -f /var/log/mail.log | grep -E "status=sent|status=deferred"

Configuring Postfix with strict authentication and destination throttling guarantees reliable, reputation-safe transactional mail delivery.

You can spin up an Ubuntu 24.04 instance on Netbay in under 60 seconds with Intel Xeon Platinum compute and high-speed SSD storage in Lucknow — netbayhosts.in.