Postfix Mail Gateway
Server Training - Mail Server

Postfix Mail Gateway

The purpose of a Mail Gateway is to create a mail server that accepts mail for the internal mail server, thus protecting the internal mail server from outside attacks. Mail Gateways are typically on a separate network from the internal network. The gateway will show up in the DNS records as the final destination for mail even though it is transferred into the internal mail server.


Related Postfix Training
Postfix Configuration
Postfix Mail Server Design
Control SPAM with Postfix
Postfix Mailbox Changes
Postfix Mail Gateway
Postfix Mail Server Course
 Postfix Mail Statistics

8 Week Course for $499.95  ORDER NOW

 Don't Outsource Your Mail Server, Learn how to run it yourself!
Postfix Training

We specialize in helping companies become independent of outsourcing Linux services.
8 Week Course for $499.95  ORDER NOW







One thing that the gateway can do for you is to do the spam filtering and virus filtering before it gets into your internal network. One important advantage to this set up is that you only need to manage filters on one mail server as it could do all the heavy work before relaying to your other mail server.

The implementation of the gateway is fairly simple. The basic set up only takes a few lines of changes. The more advanced set up requires additional time but is probably a good idea as it will provide enhanced security for the gateway which will certainly be under greater attack. The other issue to be aware of is that the more requirements you have for the gateway in terms of scanning for spam and anti-virus will always require more RAM and CPU resources as well. However, this requirement will then lead to less required RAM and CPU resources on the internal mail server.

postfix mail server

Step #1: Set Gateway Relay Permissions

You must set your gateway so that it can relay mail for the internal mail server. This can be done by adding the internal mail server IP Address to the mynetworks setting.

mynetworks =

It is important to limit the gateway to only the IP Addresses of the mail server and the localhost. This will disable the internal network users from using your gateway as a relay when they should really use the internal mail server.

Step #2: Configure the Relay Domain on the Gateway

The gateway must know for which domains it can receive mail from the Internet. Therefore the domain that is represented on the inside must be set up in the relay_domains parameter.

relay_domains =

Step #3: Configure the Internal Mail Host on the Gateway

The gateway needs to know where to send the mail once it receives it. In order to do this you should create a transport map that contains the information to where the mail is begin transferred. Create a map file called /etc/postfix/transport. This map should have a line that looks like this: smtp:[]

Several things are notable in this line. First, the smtp transfers mail using smtp to the internal mail server. This transport type, as the others, is defined in the The brackets are necessary so that you do not create a loop. The brackets actually prevent a MX lookup. Remember that to create a map you must run the postmap command on it:

postmap hash:/etc/postfix/transport

Now also set the transport_maps parameter in the file.

transport_maps = hash:/etc/postfix/transport

Step #4: Configure Relay Recipients

The final step in the basic configuration is to set up those recipients that will receive mail. The greatest advantage with this step is it will eliminate all spam and virus laden mail that is not sent to one of the users on the internal network. It is more work to set this list up but over time it will eliminate a great deal of network activity, server resources and trouble on the internal network. This list can be setup with the relay_recipient_maps parameter. Create a file called /etc/postfix/relay_recipients and in that file list each user with an OK on the right hand side.

This e-mail address is being protected from spambots. You need JavaScript enabled to view it OK

This e-mail address is being protected from spambots. You need JavaScript enabled to view it OK

This e-mail address is being protected from spambots. You need JavaScript enabled to view it OK

Remember that maps must have a left hand side and a right hand side.

Add this line to your file:

relay_recipient_maps = hash:/etc/postfix/relay_recipients

Build your map file with this command:

postmap hash:/etc/postfix/relay_recipients

Step #5: Enhance Gateway Security

There are several significant ways to enhance the security of the Gateway. In most situations, you will not need to deliver mail locally to the Gateway so it is a good idea to stop all local delivery to protect the system. Set the Postfix gateway so it knows that it is not the final destination.

mydestination =

This will help Postfix understand that there is no local destination.

Next, disable the local recipients. Again, by setting the local_recipient_maps to nothing will disable local recipients.

local_recipient_maps =

Mail servers are required to except mail for postmaster and abuse so these must be forwarded to the internal server. Create a map to use for virtual_alias_maps. You can call that map virtual and enter the information aliases one line at a time.

postmaster This e-mail address is being protected from spambots. You need JavaScript enabled to view it

abuse This e-mail address is being protected from spambots. You need JavaScript enabled to view it

Save the file in /etc/postfix/virtual_alias_maps and create the hash with:

postmap hash:/etc/postfix/virtual_alias_maps

Now include a line in for the new map.

virtual_alias_maps = hash:/etc/postfix/virtual_alias_maps

You may want to create an error message if any mail does get sent to the local users on the gateway. To do this add this line to the

local_transport = error: local mail delivery not available


Of course, you want the local mail that is created for administrators or services to be sent somewhere. Therefore, if you change the myorigin parameter you will be able to send those emails to your domain,.

myorigin =

This will transfer all of the system mail to your internal server.

Now edit your and comment out the local delivery option. Save the file and restart Postfix.

showq unix n - n - - showq

error unix - - n - - error

discard unix - - n - - discard

#local unix - n n - - local

virtual unix - n n - - virtual

lmtp unix - - n - - lmtp

anvil unix - - n - 1 anvil

These settings will help lock down Postfix so that it is more secure and dependable.


Copyright CyberMontana Inc. and
All rights reserved. Cannot be reproduced without written permission. Box 1262 Trout Creek, MT 59874