Set Up Postfix Send-Only SMTP Server for Multiple Domains on Ubuntu 18.04, 16.04, 20.04

In this article, I will show you how to set up Postfix as a send-only SMTP server on Ubuntu 18.04, 16.04, 20.04. I will first show you how to do it for a single domain, then you can apply the steps for multiple domains if you need to.

Use Case

You have a website/web application that needs to send transactional emails to users (such as password-reset email). Most likely, there’s no need for users to reply to these emails, or if they reply, the reply emails will be sent to your dedicated mail server. In this case, you can set up a send-only SMTP server on the web server using Postfix, which is a popular SMTP server software.


In order to send emails from your server, port 25 (outbound) must be open. Many ISPs and hosting companies such as DigitalOcean block port 25 to control spam. I recommend using Hostwinds, because it doesn’t block port 25 (outbound). Once you have a Hostwinds server, install Ubuntu on it and follow the instructions below.

Setting up Postfix send-only SMTP server for multiple domains isn’t difficult actually. First, we need to configure it for one domain, then set it up for multiple domains.

Step 1: Set Hostname and PTR Record

By default, Postfix uses your server’s hostname to identify itself when communicating with other SMTP Servers. Some SMTP servers will reject your email if your hostname isn’t valid. You should set a full-qualified domain name (FQDN) like below.

sudo hostnamectl set-hostname

To check the hostname of your server, run

hostname -f

You need to log out and log back in to see hostname change at the command prompt. This hostname should have a DNS A record pointing to the IP address of your server.

Also, you need to set a PTR record (aka, pointer record), which maps an IP address to an FQDN. It’s the counterpart to the A record. Many SMTP server will reject your email if your server’s IP address doesn’t have PTR record.

Because you get IP address from your hosting provider or ISP, not from your domain registrar, so you must set PTR record for your IP in the control panel of your hosting provider, or ask your ISP. For example, in Hostwinds, you can set PTR record by clicking the Domains tab and clicking the Manage rDNS link. Although you can set PTR record to any hostname, for best practice, you should use the FQDN you just set.

To see if your PTR record is set properly, run the following command. Replace with your own IP address.


Note that if your server uses IPv6 address, it’s also a good idea to add AAAA record for your FQDN and set PTR record for your IPv6 address.

Step 2: Install Postfix on Ubuntu

Run the following commands to install Postfix from the default Ubuntu repository.

sudo apt-get update

sudo apt-get install postfix -y

You will be asked to choose a mail server configuration type. Press the Tab key, then press Enter.

postfix send only smtp server

In the next screen, press Enter to select the default option: Internet Site.

postfix send only ubuntu

Next, enter your domain name for the system mail name, i.e. the domain name after @ symbol.

postfix send only multiple domains

Step 3: Disable Receiving Email in Postfix

By default, Postfix SMTP server listens on all active interfaces on the machine. Since the Postfix SMTP server is only used for sending transactional emails to users, we can make it listens on localhost only, so bad actors can’t send spam to it.

Edit the Postfix main configuration file.

sudo nano /etc/postfix/

Find the following line.

inet_interfaces = all

Change it to:

inet_interfaces = loopback-only

Save and close the file. Restart Postfix for the change to take effect.

sudo systemctl restart postfix

Step 4: Install and Configure OpenDKIM

DKIM stands for DomainKeys Identified Mail. You can install OpenDKIM on your server and use it to add signatures to emails sent from your domain, with your private key. Receiving SMTP servers verify the signature by using the corresponding public key, which is published by you in the DNS. Adding DKIM signature is a must if you want your emails get into recipient’s inbox.

First install OpenDKIM from the default Ubuntu repository.

sudo apt-get install opendkim opendkim-tools

Then add postfix user to opendkim group.

sudo adduser postfix opendkim

Edit OpenDKIM main configuration file.

sudo nano /etc/opendkim.conf

Find the following lines.

#Canonicalization     simple
#Mode                 sv
#SubDomains           no

Uncomment them and replace simple with relaxed/simple. Change the mode from sv to s, because there’s no inbound email to verify signature.

Canonicalization     relaxed/simple
Mode                 s
SubDomains           no

Add the following lines at the end of this file. (On Ubuntu 18.04, the UserID is already set to opendkim)

#OpenDKIM user
# Remember to add user postfix to group opendkim
UserID             opendkim

# Map domains in From addresses to keys used to sign messages
KeyTable           refile:/etc/opendkim/key.table
SigningTable       refile:/etc/opendkim/signing.table

# A set of internal hosts whose mail should be signed
InternalHosts       /etc/opendkim/trusted.hosts

Save and close the file.

Create Signing Table, key Table and Trusted Hosts File

Create a directory structure for OpenDKIM.

sudo mkdir /etc/opendkim

sudo mkdir /etc/opendkim/keys

Change owner from root to opendkim and make sure only opendkim user can read and write to the keys directory.

sudo chown -R opendkim:opendkim /etc/opendkim

sudo chmod go-rw /etc/opendkim/keys

Create the signing table.

sudo nano /etc/opendkim/signing.table

Add the following line to the file. This means that if the From: header in an email contains, then use the sendonly DKIM selector. You can change sendonly to your preferred DKIM selector name and it should be unique in your DNS.


Save and close the file. Then create the key table.

sudo nano /etc/opendkim/key.table

Add the following line. This means that for the sendonly DKIM selector, use the private key saved in /etc/opendkim/keys/ to sign the email.

Save and close the file. Next, create the trusted hosts file.

sudo nano /etc/opendkim/trusted.hosts

Add the following lines to the newly created file.


The above means that messages coming from the above IP addresses and domains will be trusted and signed.

Generate Private/Public Keypair

We need to generate a private key to sign outgoing emails and a public key for receiving SMTP servers to verify the DKIM signature. Public key will be published in DNS.

Create a separate folder for the domain.

sudo mkdir /etc/opendkim/keys/

Generate keys using opendkim-genkey tool.

sudo opendkim-genkey -b 2048 -d -D /etc/opendkim/keys/ -s sendonly -v

The above command will create 2048 bits keys. -d (domain) specifies the domain. -D (directory) specifies the directory where the keys will be stored and we use sendonly as the selector (-s). Once the command is executed, the private key will be saved in sendonly.private and sendonly.txt will be the TXT record that contains public key.

Make opendkim as the owner of the private key.

sudo chown opendkim:opendkim /etc/opendkim/keys/

Add Public Key in DNS Records

Display the public key

sudo cat /etc/opendkim/keys/

The string after the p parameter is the public key. In your DNS manager, create a TXT record for the second domain. Enter sendonly._domainkey in the Name field. Copy everything in the parentheses and paste into the value field. Delete all double quotes. (You can paste it into a text editor first, delete all double quotes, the copy it to your DNS manager. Your DNS manager may require you to delete other invalid characters, such as carriage return.)

postfix send only DKIM

Once the DNS record is published, enter the following command on your Ubuntu server to test your key.

sudo opendkim-testkey -d -s sendonly -vvv

If everything is OK, you will see

key OK

If you see key not secure message, don’t panic. This is because DNSSEC isn’t enabled on your domain name.

Step 5: Connect Postfix with OpenDKIM

Postfix can talk to OpenDKIM via a Unix socket file. The default socket file used by OpenDKIM is /var/run/opendkim/opendkim.sock, as shown in /etc/opendkim.conf file. But the postfix SMTP daemon shipped with Ubuntu runs in a chroot jail, which means the SMTP daemon resolves all filenames relative to the Postfix queue directory (/var/spool/postfix). So we need to change the socket file.

Edit the OpenDKIM main configuration file.

sudo nano /etc/opendkim.conf

Find the following line:

Socket local:/var/run/opendkim/opendkim.sock

Replace it with the following line. (If you can’t find the above line, then add the following line.)

Socket local:/var/spool/postfix/opendkim/opendkim.sock

Create a directory to hold the OpenDKIM socket file and only allow opendkim user and postfix group to access it.

sudo mkdir /var/spool/postfix/opendkim

sudo chown opendkim:postfix /var/spool/postfix/opendkim

If you can find the following line in /etc/default/opendkim file.




Change it to


After that, we need to edit Postfix main configuration file.

sudo nano /etc/postfix/

Add the following lines at the end of this file to connect Postfix with OpenDKIM.

# Milter configuration
milter_default_action = accept
milter_protocol = 6
smtpd_milters = local:opendkim/opendkim.sock
non_smtpd_milters = $smtpd_milters

Save and close the file. Restart OpenDKIM and Postfix.

sudo systemctl restart opendkim postfix

OpenDKIM won’t produce any message if it fails to restart. Run the following command to check its status. Make sure it’s running.

systemctl status opendkim

Step 6: Create SPF DNS Record

SPF (Sender Policy Framework) record specifies which hosts or IP addresses are allowed to send emails on behalf of a domain. In your DNS management interface, create a new TXT record like below. Use your own IPv4 address and IPv6 address of your server.

TXT  @   v=spf1 mx ip4: ip6:2600:3c01::f03c:93d8:f2c6:78ad ~all

Step 7: Set the From Address, From Name and Return-Path

You can set custom From address, From name and Return-Path in your website/web application. Let’s use WordPress as an example. You can add the following lines in your WordPress theme’s functions.php file to override the default From address, From name and return-path. Replace the red text as necessary.

// Function to change From email address
function wpb_sender_email( $original_email_address ) {
    return '';

// Function to change sender name
function wpb_sender_name( $original_email_from ) {
    return 'LinuxBabe';

// Set return-path the same as From address
function fix_my_email_return_path( $phpmailer ) {
    $phpmailer->Sender = $phpmailer->From;

// Hooking up our functions to WordPress filters
add_filter( 'wp_mail_from', 'wpb_sender_email' );
add_filter( 'wp_mail_from_name', 'wpb_sender_name' );
add_action( 'phpmailer_init', 'fix_my_email_return_path' );

Save the file and you are done.

Step 8: Enable TLS Encryption for Outgoing Emails

By default, Postfix doesn’t use TLS encryption when sending outgoing emails. To enable TLS encryption, open the /etc/postfix/ file and add the following two lines at the end of this file.

smtp_tls_security_level = may
smtp_tls_loglevel = 1

The first line enables TLS encryption for the Postfix SMTP client. The second line will log the TLS connection in /var/log/mail.log file, so you can check if TLS encryption is working. Save and close the file. Restart Postfix for the changes to take effect.

sudo systemctl restart postfix

Since Postfix doesn’t receive incoming emails, there’s no need to configure a valid TLS certificate for the Postfix SMTP daemon.

Step 9: Testing Sender Score

Now go to You will see a unique email address. Send an email from your website on the Postfix SMTP server to this address and then check your score. As you can see, I got a perfect score. In the test result, you should check if your PTR record, SPF and DKIM record is valid.


You can also open the /var/log/mail.log file to check if TLS encryption is used. For example, the following line shows the connection to is encrypted.

Anonymous TLS connection established to[]:25: TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)

What if Your Emails Are Still Being Marked as Spam?

I have more tips on email deliverability for you in this article: How to stop your emails being marked as spam. Although it will take some time and effort, your emails will eventually be placed in the inbox after applying these tips.

How to Configure Postfix Send-only SMTP Server For Multiple Domains

By default, Postfix allows you to use any domain name in the From header and return path address to send outgoing emails. If your server hosts multiple websites, you just need to create SPF DNS record for your other domains, which is very easy to do, and configure OpenDKIM for your other domains.

To configure OpenDKIM for other domains, you need to add the other domains in the signing table, key table and trusted hosts file like below.

Signing table:


Key table:

Trusted hosts:


Then generate the DKIM Private/Public keypair by following the same steps as mentioned above for other domains and add the DKIM public key in DNS. Restart OpenDKIM and you are done. Don’t forget to test your sender score.


If your message is not signed and DKIM check failed, you may want to check postfix log (/var/log/mail.log) to see what’s wrong in your configuration. If you see the following message in the mail log,

warning: connect to Milter service local:opendkim/opendkim.sock: No such file or directory

you may want to check if the opendkim systemd service is actually running.

systemctl status opendkim

If opendkim is running and you still see the above error, you might need to change smtpd_milters = local:opendkim/opendkim.sock to smtpd_milters = local:/opendkim/opendkim.sock in /etc/postfix/ file.


I hope this tutorial helped you set up a Postfix send-only SMTP server on Ubuntu for multiple domains. As always, if you found this post useful, then subscribe to our free newsletter to get more tips and tricks. Take care 🙂

Rate this tutorial
[Total: 4 Average: 5]

41 Responses to “Set Up Postfix Send-Only SMTP Server for Multiple Domains on Ubuntu 18.04, 16.04, 20.04

  • Daniel Gutiérrez
    2 years ago

    Wow wow!! Thx LinuxBabe!!!! You’re the best in the world!! Thanks four your kindness, I will follow your excellent tutorial and let you know!

  • Michael
    2 years ago

    Very informative, I learn something new each time you post something!

    Also, the service is something that I didn’t know about, very nice.

  • Connor
    1 year ago

    Loved the walkthrough, went perfectly for me. I just wanted to correct 1 item in your tutorial. In the section where you specify the SPF records, the formatting is incorrect. It should not be ipv4:, it should be ip4: If you use the wrong one, the SPF record declares your server is not authorized to send from that address and it is -3 points in the mailtester site. Figured you and your readers would want to know. Again, excellent tutorial.

    • Thanks. Corrected this mistake.

    • Thank you for this Conner. My score went from -1/10 to 9/10 simply by making the edit you suggested.

      However, mail from my second domain was being sent unencrypted, causing Google to show a warning “This message wasn’t encrypted”.

      To fix that I had to edit my /etc/postfix/ file by replacing
      smtpd_use_tls=yes with smtp_use_tls=yes.

      Now the messages are sent with TLS encryption and the from address is correctly showing

      However, Google still shows that the message was mailed by
      Any ideas hot to fix that if possible?

      • That’s because you are stilling using the first domain’s DKIM key to sign emails for the second domain. Have you followed the “multiple domains” section at the end of this article?

  • Will most of this guide work for centos8 ?

  • OMG! Thank you! However, I’m having trouble.

    I last ran a postfix install about 8 years ago and I’ve forgotten most of it.

    First, is I want to both send and receive mail. So, I think that’s easy enough, just leave inet_interfaces = all.

    Second, I named the keys and table entries as “” but I assume I could just name it “myDomain._domainkey”

    Regardless of those two issues, when I tested the key, “opendkim-testkey -d -s sendonly -vvv” the response is “record not found.”

    Any ideas?

  • This worked great for us, we got a 10/10 score! Awesome and well done!

  • Thank you so much for this wonderful guide!
    I followed step by step all the instructions to configure a send-only SMTP server .. but i have this problem:

    dkim=neutral (invalid public key) header.s=sendonly header.b="mH+/+dxE";

    Any ideas?

    • Your domain name doesn’t have DKIM record, or it’s not propagated to the Internet.

      • Thank you Xiao for you reply! 🙂
        If i test with “sudo opendkim-testkey -d -s sendonly -vvv”

        using default configfile /etc/opendkim.conf
        checking key ''
        key not secure
        key OK

        … also using mxtoolbox the TXT record with “” seems ok.

        Thank you for your kindness.

    • I can only see SPF record on your domain name. No DKIM record is found.

      dig TXT @ +short


      "v=spf1 a mx ip4: -all"
    • You can check DNS record propagation using this DNS propagation checker tool.

      • Xiao….
        i found the problem… my provider DNS does not support the 2048 key ….. I created 1024 key and now it work! :/
        Thank you so much.
        I wish you good health and all the best! 🙂

  • How can I send test mail with command line?

  • Uddin Nasir
    5 months ago

    The article is the best article I have ever read about send only mail server on postfix with SPF DKIM ,
    I have done almost and my spam score 8/10 now. could you please help me how to assign SPF for other domain.
    Thank you in advance from Vietnam !!

  • Rahul Sharma
    4 months ago

    Thx for tutorial, but i have questions .

    1. How to install TLS Certificate in Postfix using let’s encrypt standalone key.?
    Like in your iredmail setup tutorial

    2. How to install & setup fail2ban in smtp server.?

    • There’s no need to install Let’s Encrypt TLS certificate on a send-only SMTP server.

      There’s no need to set up fail2ban for a send-only SMTP server.

  • Rahul Sharma
    4 months ago

    How to use postfix smtp in gmail ” Send mail as “.?

  • Hello,

    Any reason why I would be getting this error, after following steps for OpenDKIM setup?

    opendkim.service: PID file /var/run/opendkim/ not readable (yet?)


  • The guide provided is quite detailed! But after Following your guide up until the point of checking the keys: sudo opendkim-testkey. Kept getting “No key”. DNS zone file record is perfect cos I checked to certain that key was added accurately in the zone file.

  • i did exactly what you say, all the dns records works with spf and dmarc, but detected like spam when i dont use realy. When i use realy works, without relay spam. In mail test the result with realy and without is the same.

    The IP from the server never used before in records and internet list.

    The finding in spam assasin mail-tester is

    -1.985 PYZOR_CHECK Similar message reported on Pyzor (
    Please test a real content, test Newsletters will always be flagged by Pyzor
    Adjust your message or request whitelisting (

    -0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
    This rule is automatically applied if your email contains a DKIM signature but other positive rules will also be added if your DKIM signature is valid. See immediately below.

    but in the another section spf, dkim, dmard is ok

  • Hello everyone,
    I have a small problem I would like to know after following all this process it is possible to use this smtp server with an application like
    Atomic Mail Sender? and what are the parameters entered in the smtp part.
    thank you for the job done.

  • cat dev/random
    3 months ago

    I came here to ask exactly this…

    (Well, RHEL 8. I’m running RHEL 8, exactly the same thing.)

  • Hi there! What a great tutorial!!!
    I’ve added 2 domains to my postfix and followed the scripts to generate the second DKIM, is there anyway I can map a specific user to always send from ?

    All my postfix users end up sending

    • Simone
      1 week ago

      I think you can set same priority in your MX records and load balance the email sending, assigning a specific user to a server I would do it through software on app side but maybe there’s a configuration solution for postfix.


  • aharown
    2 weeks ago

    Everything seemed to work great until the final test. fails and the mail error log shows “signing table references unknown key ‘’

    I’ve gone over signing table and key table and can’t see any errors… but I’m not 100% clear on the logic of the variables etc., so I could be looking right at it. But it seems to match the tutorial.

    • aharown
      2 weeks ago

      OK, got past that one. Was missing the underscore before domainkey in the key table entry.
      But mail test says my test email was “not signed with DKIM.” So any tips on why that might be happening would be appreciated.

      • aharown
        2 weeks ago

        Solved. The “not signed with DKIM” was leftover from earlier attempt when key table had a typo. Retest passed.

        Thanks for the extremely helpful tutorial!

  • Hi dear xiao

    Thank you so much for these tutorials…
    These are the best…
    We used ubuntu 18.04 with your tutorials for making our full mail server and its work well… then we start using LDAP as authenticate module for our domain with sssd and we have no problem until my collaborator carelessly use do-release-upgrade and our server is 20.04 now… everything is down…
    I set up mail server tutors again… but we have a problem:
    – I can send email to my yahoo account but unable to receive a message..
    – I cannot send email to my gmail and unable to receive any mail from gmail
    but our users can mail to each other… from every where!
    we have no error in postfix and have 1 error in dovecot…

    auth[92797]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=user rhost=  user=user
    auth[92797]: pam_sss(dovecot:auth): authentication success; logname= uid=0 euid=0 tty=dovecot ruser=user rhost= user=user

    This is my dovecot.socket status:

    sudo systemctl status dovecot.socket 
    ● dovecot.socket - Dovecot IMAP/POP3 email server activation socket
         Loaded: loaded (/lib/systemd/system/dovecot.socket; disabled; vendor preset: enabled)
         Active: inactive (dead)
       Triggers: ● dovecot.service
         Listen: (Stream)
                 [::]:143 (Stream)
                 [::]:993 (Stream)

    and this is my dovecot -n entry:

    sudo dovecot -n
    # (3c910f64b): /etc/dovecot/dovecot.conf
    # Pigeonhole version ()
    # OS: Linux 5.4.0-52-generic x86_64 Ubuntu 20.04.1 LTS 
    # Hostname:
    auth_mechanisms = plain login
    auth_username_format = %Ln
    mail_location = maildir:~/Maildir
    mail_privileged_group = mail
    namespace inbox {
      inbox = yes
      location = 
      mailbox Drafts {
        auto = create
        special_use = \Drafts
      mailbox Junk {
        auto = create
        special_use = \Junk
      mailbox Sent {
        auto = create
        special_use = \Sent
      mailbox Trash {
        auto = create
        special_use = \Trash
      prefix = 
    passdb {
      driver = pam
    protocols = imap lmtp imap lmtp pop3
    service auth {
      unix_listener /var/spool/postfix/private/auth {
        group = postfix
        mode = 0660
        user = postfix
    service lmtp {
      unix_listener /var/spool/postfix/private/dovecot-lmtp {
        group = postfix
        mode = 0600
        user = postfix
    ssl = required
    ssl_cert = </etc/letsencrypt/live/mydomain/fullchain.pem
    ssl_client_ca_dir = /etc/ssl/certs
    ssl_dh = # hidden, use -P to show it
    ssl_key = # hidden, use -P to show it
    ssl_min_protocol = TLSv1.2
    ssl_prefer_server_ciphers = yes
    userdb {
      driver = passwd

    Please help me…

Leave a Comment

  • Comments with links are moderated by admin before published.
  • Your email address will not be published.
  • Use <pre> ... </pre> HTML tag to quote the output from your terminal/console.
  • Please use the community ( for questions unrelated to this article.
  • I don't have time to answer every question. Making a donation would incentivize me to spend more time answering questions.

The maximum upload file size: 2 MB.
You can upload: image.