Quoted from the documentation:


The internet hostname of this mail system. The default is to use the fully-qualified domain name (FQDN) from gethostname(), or to use the non-FQDN result from gethostname() and append ".$mydomain". $myhostname is used as a default value for many other configuration parameters.


The internet domain name of this mail system. The default is to use $myhostname minus the first component, or "localdomain" (Postfix 2.3 and later). $mydomain is used as a default value for many other configuration parameters.

I'm confused that FQDN postfix should be equivalent as SSL FQDN or not. For now, let's assume /etc/postfix/main.cf configuration is

myhostname = mail.pelersapi.id
mydomain = pelersapi.id
myorigin = $mydomain

Now the question is: can I create a SSL certificate with domain mail.pelersapi.id while keep the [email protected] address valid?

Currently, I'm using Let's Encrypt to make the certificate

sudo certbot certonly                                                            \
    --dns-cloudflare                                                             \
    --dns-cloudflare-credentials /etc/letsencrypt/cloudflare/pelersapi.id.ini    \
    --dns-cloudflare-propagation-seconds 30                                      \
    -d mail.pelersapi.id                                                         \
    -m [email protected]

My previous attempt was keeping SSL FQDN and myhostname same as mydomain, then it's successfully authenticated. For the scenario explained above, I'm afraid misunderstanding the theory could causes spam score worsen.

2 Answers 2


If mail.pelersapi.id is defined in DNS as the MX for pelersapi.id, and if there is an A record that points mail.pelersapi.id at your Postfix server, then having a certificate for mail.pelersapi.id on that server will validate all mail addresses [email protected]. (If there is a second mailer mail2.pelersapi.id it will need a certificate for itself, of course.)

  • Okay, then the DNS Server should be configured as MX record of pelersapi.id to mail.pelersapi.id and A record of mail.pelersapi.id to right? Thanks for the concisely helpful clue! Dec 10, 2023 at 9:39
  • 1
    Yes. The only other tip is that you need to set a priority in your MX record; 10 is a good value for that. (Priority is used to allow for additional, failover mail servers; lower-numbered servers are used first, and higher-numbered ones if the low-numbered ones don't respond.)
    – tsc_chazz
    Dec 10, 2023 at 15:46

Yes, in simple cases like this, you want the SSL certificate to contain mail.pelersapi.id, just like myhostname. The fact that this happens to be a subdomain of your mail domain is just a bonus.

Remember this certificate is presented when you are receiving messages. People you are sending messages to do not see this (they use SPF/DKIM/DMARC to establish sender authority). Your cert presented on your MX only even starts to matter as they reply (or bounce).

Look for the separate manual page, or possibly a text document in /usr/share/doc/postfix/TLS_README referenced from that documentation, specifically for the TLS related discussions:

DNS names in the SubjectAlternativeName certificate extension are used to verify the remote SMTP server name

If you read through that explanation you will see, it used to be and still is quite a bit more complicated than just that, but a configuration that covers most of the edge cases is not that complicated: MX record, $myhostname match and appear in SAN.DNSName of the certificate, which is signed by some Mozilla-trusted CA just like any website certificate, done.

  • So in a nutshell, SSL is just for receiving and SPF/DKIM/DMARC are for sending mail? Anyway, thanks for the additional information! Dec 10, 2023 at 9:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .