Skip to content
SendPoint / Education
Sending infrastructure

Postfix TLS and relay configuration review

Inspect the running configuration and review narrowly scoped settings before deployment.

SendPoint referenceUpdated 2 min read

Inspect the installed configuration

Bash
postconf mail_version
postconf -n
postconf smtp_tls_security_level smtpd_tls_security_level
postconf smtpd_relay_restrictions mynetworks

Run these on the Postfix host with appropriate read access. Review locally before sharing output because configuration can reveal internal routing and account details. Use the manual for the installed release; defaults can change between versions.

Understand client and server settings

PrefixRole
smtp_The SMTP client delivering outbound mail
smtpd_The SMTP server accepting inbound connections

Outbound opportunistic TLS

The following main.cf setting enables opportunistic TLS for the SMTP client. It does not require encryption or authenticate every remote server. Review destination-specific policy and the installed version before applying it.

main.cf setting
smtp_tls_security_level = may

Review relay authorization

For Postfix versions supporting smtpd_relay_restrictions, the documented pattern permits trusted networks and authenticated clients, then defers unauthorized destinations. Its safety depends on correctly restricted mynetworks and working authentication.

main.cf relay restriction pattern
smtpd_relay_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    defer_unauth_destination

Validate through your change process

  1. Back up the configuration and document the intended behavior and rollback.
  2. Review TLS, authentication and destination restrictions together, including service overrides in master.cf.
  3. Run the installed Postfix configuration checks with the required privileges, then use a controlled reload.
  4. Verify intended relay authorization and denial from appropriate test clients and inspect actual delivery logs.

Sources