I run a virtual email server using Postfix that forwards emails addressed at domain.com to specific Gmail / Hotmail accounts. This same server also acts as a mail relay, and uses saslauthd to allow parties to log in and send emails under domain.com.

Currently, this mail relay only works with port 25 over TLS (you can access it by creating, for e.g., a send-only email address in Gmail). Should I open port 587 for this purpose instead of using port 25? If so, need I disable mail relay access over port 25 (since I read that 587 is used over 25 to reduce spam)?

How do I go about doing this? Is it as simple as adding the submission port to master.cf in Postfix?

1 Answer 1


The submission port 587 is not directly used to reduce spam, but the need for another port do arise from fighting spam: the SMTP port 25 is typically closed by the ISP on every consumer grade internet connections and on all other networks that shouldn't have any email servers. This prevents infected computers from directly communicating with the receiving servers, but as a side effect prevents your authenticated users from using the relay, too. The answer to the question "should I" depends on whether your users faces these problems. That's probably yes.

Aside, there's other reasons why using a separate port for submission becomes handy. For this kind of setup, you don't use port 25 for outbound mail at all, which enables you to use separate settings (e.g. smtpd_sender_restrictions / smtpd_recipient_restrictions) for SMTP and submission.

  • For incoming mail on 25 you usually perform many checks like SPF, DMARC, DNS BL. These checks are not very useful on authenticated connections, are they? You can simply skip them on them on submission.

    smtpd_recipient_restrictions =
        . . .
        check_policy_service unix:private/policy-spf,
        reject_rbl_client sbl-xbl.spamhaus.org,
        . . .

    Recipient restrictions?! Most of these are actually restrictions for the sender, but I like to fire them only after SMTP command RCPT TO for more debug information e.g. on false positives.

  • For email submission on 587 you may want different kind of checks for authenticated users. (These settings goes to master.cf and overrides the settings in main.cf. First we enable SASL authentication; this configuration is unfinished as it depends on your SASL provider. Dovecot?)

    submission inet n - - - - smtpd
      -o smtpd_tls_security_level=encrypt
      -o smtpd_sasl_auth_enable=yes
      . . .

    You don't want every user to be able to send mail on behalf of other users, do you? This is especially important if you DKIM sign the messages. It's possible to bind addresses to certain usersnames. In the following example these address/username pairs are already defined for virtual_alias_maps in a format we can also use here, but your setup most likely needs another mapping as you don't have local mailboxes.

      -o smtpd_sender_login_maps=hash:/etc/postfix/virtual
      -o smtpd_sender_restrictions=reject_sender_login_mismatch
      . . .

    Then, you don't want to accept mail to domains that doesn't exist etc, just like you didn't want to receive mail from that kind of domains on the smtpd_recipient_restrictions for port 25. Only that now they actually test recipient addresses. On the same line (the line break is merely for formatting) you can enforce SASL authentication by rejecting everything non-authenticated.

      -o smtpd_recipient_restrictions=reject_non_fqdn_recipient,
      . . .
  • Thanks @esa-jokinen, that's a really detailed and helpful answer there. I'm going to have to take some time to digest your response and implement the relevant parts of it on my server.
    – John Doe
    Commented Feb 18, 2019 at 6:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .