Postfix Installation - Revision history

Wikisailor: /* Address Rewriting */

2026-02-24T21:19:12Z

Address Rewriting

← Older revision		Revision as of 21:19, 24 February 2026
Line 123:		Line 123:
	then to apply the changes and restart postfix:		then to apply the changes and restart postfix:
	sudo postconf -e "sender_canonical_maps = regexp:/etc/postfix/sender_canonical_regexp"		sudo postconf -e "sender_canonical_maps = regexp:/etc/postfix/sender_canonical_regexp"
	~~sudo postmap /etc/postfix/sender_canonical_regexp~~
	sudo systemctl restart postfix		sudo systemctl restart postfix
	From this moment on any email sent from raisin with the from field as default someone@raisin.seaoffate.net or someone@raisin.seaoffate.local will have the from field rewritten to someone@seaoffate.net, we also included the localhost rewrite rule because some apps insist on sending from localhost. It is also possible to have specific, static rewrite rules using:		From this moment on any email sent from raisin with the from field as default someone@raisin.seaoffate.net or someone@raisin.seaoffate.local will have the from field rewritten to someone@seaoffate.net, we also included the localhost rewrite rule because some apps insist on sending from localhost. It is also possible to have specific, static rewrite rules using:

Wikisailor: /* Simplified Configuration */

2026-02-24T21:16:26Z

Simplified Configuration

← Older revision		Revision as of 21:16, 24 February 2026
Line 100:		Line 100:
	To allow any Virtual machine to send email we could set it up to forward directly to Brevo but it is a lot simpler to have the extras send their email through Plum's Postfix. To install Postfix on another host go through the same installation procedure as listed above and choose Satellite System as the type. Set the relay host to Plum’s internal IP (use the square brackets ):		To allow any Virtual machine to send email we could set it up to forward directly to Brevo but it is a lot simpler to have the extras send their email through Plum's Postfix. To install Postfix on another host go through the same installation procedure as listed above and choose Satellite System as the type. Set the relay host to Plum’s internal IP (use the square brackets ):
	sudo postconf -e "relayhost = [192.168.100.22]"		sudo postconf -e "relayhost = [192.168.100.22]"
	'''''Note''' Plum must be configured to accept email from the client host or email will be dropped''. On plum check the /etc/postfix/main.cf file to make sure that the client's ip address is allowed		'''''Note''' Plum must be configured to accept email from the client host or email will be dropped''.

			On plum check the /etc/postfix/main.cf file to make sure that the client's ip address is allowed
	sudo nano /etc/postfix/main.cf		sudo nano /etc/postfix/main.cf
	search for the line starting with		search for the line starting with

Wikisailor: /* Simplified Configuration */

2026-02-24T21:15:45Z

Simplified Configuration

← Older revision		Revision as of 21:15, 24 February 2026
Line 98:		Line 98:

	====Simplified Configuration====		====Simplified Configuration====
	To allow any Virtual machine to send email we could set it up to forward directly to Brevo but it is a lot simpler to have the extras send their email through Plum's Postfix. To install Postfix on another host go through the same installation procedure as listed above and choose Satellite ~~Systemas~~ the type. Set the relay host to Plum’s internal IP (use the square brackets ):		To allow any Virtual machine to send email we could set it up to forward directly to Brevo but it is a lot simpler to have the extras send their email through Plum's Postfix. To install Postfix on another host go through the same installation procedure as listed above and choose Satellite System as the type. Set the relay host to Plum’s internal IP (use the square brackets ):
	sudo postconf -e "relayhost = [192.168.100.22]"		sudo postconf -e "relayhost = [192.168.100.22]"
	'''''Note''' Plum must be configured to accept email from the client host or email will be dropped''. On plum check the /etc/postfix/main.cf file to make sure that the client's ip address is allowed		'''''Note''' Plum must be configured to accept email from the client host or email will be dropped''. On plum check the /etc/postfix/main.cf file to make sure that the client's ip address is allowed

Wikisailor: /* Simplified Configuration */

2026-02-24T21:12:15Z

Simplified Configuration

← Older revision		Revision as of 21:12, 24 February 2026
Line 100:		Line 100:
	To allow any Virtual machine to send email we could set it up to forward directly to Brevo but it is a lot simpler to have the extras send their email through Plum's Postfix. To install Postfix on another host go through the same installation procedure as listed above and choose Satellite Systemas the type. Set the relay host to Plum’s internal IP (use the square brackets ):		To allow any Virtual machine to send email we could set it up to forward directly to Brevo but it is a lot simpler to have the extras send their email through Plum's Postfix. To install Postfix on another host go through the same installation procedure as listed above and choose Satellite Systemas the type. Set the relay host to Plum’s internal IP (use the square brackets ):
	sudo postconf -e "relayhost = [192.168.100.22]"		sudo postconf -e "relayhost = [192.168.100.22]"
	'''''Note''' Plum must be configured to accept email from the client host or email will be dropped''. On plum check		'''''Note''' Plum must be configured to accept email from the client host or email will be dropped''. On plum check the /etc/postfix/main.cf file to make sure that the client's ip address is allowed
			sudo nano /etc/postfix/main.cf
			search for the line starting with
			mynetworks =
			make sure that it includes the IP or IP domain for the client if it is missing add a space then the IP or IP domain eg to add infra VLAN (192.168.110.0/24) the existing line:
			mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.100.0/24
			becomes
			mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.100.0/24 192.168.110.0/24

	=== Validated Domain===		=== Validated Domain===

Wikisailor: /* Simplified Configuration */

2026-02-24T21:03:51Z

Simplified Configuration

← Older revision		Revision as of 21:03, 24 February 2026
Line 100:		Line 100:
	To allow any Virtual machine to send email we could set it up to forward directly to Brevo but it is a lot simpler to have the extras send their email through Plum's Postfix. To install Postfix on another host go through the same installation procedure as listed above and choose Satellite Systemas the type. Set the relay host to Plum’s internal IP (use the square brackets ):		To allow any Virtual machine to send email we could set it up to forward directly to Brevo but it is a lot simpler to have the extras send their email through Plum's Postfix. To install Postfix on another host go through the same installation procedure as listed above and choose Satellite Systemas the type. Set the relay host to Plum’s internal IP (use the square brackets ):
	sudo postconf -e "relayhost = [192.168.100.22]"		sudo postconf -e "relayhost = [192.168.100.22]"
			'''''Note''' Plum must be configured to accept email from the client host or email will be dropped''. On plum check

	=== Validated Domain===		=== Validated Domain===

Wikisailor: /* Address Rewriting */

2026-02-24T21:00:45Z

Address Rewriting

← Older revision		Revision as of 21:00, 24 February 2026
Line 134:		Line 134:
	* When an email is sent, Postfix performs a lookup like this:		* When an email is sent, Postfix performs a lookup like this:
	** Check sender_canonical (Hash): Is there an exact match for nigel? If yes, use the specific value you wrote there (e.g., nigelsplum@seaoffate.net) and stop looking.		** Check sender_canonical (Hash): Is there an exact match for nigel? If yes, use the specific value you wrote there (e.g., nigelsplum@seaoffate.net) and stop looking.
	** Check sender_canonical_regexp (RegEx): If no exact match was found, does the address fit the pattern /^([^@]+)@~~plum~~\.seaoffate\.local$/? If yes, rewrite it to ${1}@seaoffate.net.		** Check sender_canonical_regexp (RegEx): If no exact match was found, does the address fit the pattern /^([^@]+)@raisin\.seaoffate\.local$/? If yes, rewrite it to ${1}@seaoffate.net.
	** Default: If neither matches, it sends the mail as-is (which usually results in a Brevo rejection).		** Default: If neither matches, it sends the mail as-is (which usually results in a Brevo rejection).

Wikisailor: /* Address Rewriting */

2026-02-24T20:58:43Z

Address Rewriting

← Older revision		Revision as of 20:58, 24 February 2026
Line 131:		Line 131:
	No need to postmap the regexp file, just restart to load the config		No need to postmap the regexp file, just restart to load the config
	sudo systemctl restart postfix		sudo systemctl restart postfix
			How the "Double Map" Works
			* When an email is sent, Postfix performs a lookup like this:
			** Check sender_canonical (Hash): Is there an exact match for nigel? If yes, use the specific value you wrote there (e.g., nigelsplum@seaoffate.net) and stop looking.
			** Check sender_canonical_regexp (RegEx): If no exact match was found, does the address fit the pattern /^([^@]+)@plum\.seaoffate\.local$/? If yes, rewrite it to ${1}@seaoffate.net.
			** Default: If neither matches, it sends the mail as-is (which usually results in a Brevo rejection).

Wikisailor: /* Postfix configuration for other hosts */

2026-02-24T20:56:55Z

Postfix configuration for other hosts

← Older revision		Revision as of 20:56, 24 February 2026
Line 94:		Line 94:

	==Postfix configuration for other hosts==		==Postfix configuration for other hosts==

			For servers that do not need to talk to Brevo directly, we configure them as Null Clients. They simply "hand off" all mail to Plum over the local network. This centralizes your Brevo credentials and troubleshooting to one machine.

			====Simplified Configuration====
			To allow any Virtual machine to send email we could set it up to forward directly to Brevo but it is a lot simpler to have the extras send their email through Plum's Postfix. To install Postfix on another host go through the same installation procedure as listed above and choose Satellite Systemas the type. Set the relay host to Plum’s internal IP (use the square brackets ):
			sudo postconf -e "relayhost = [192.168.100.22]"

			=== Validated Domain===

			Microsoft, Gmail and other big companies will only allow emails that have a sort of validation to give evidence that it is not spam or malicious. To be on the "nice list" email must come from an actual domain and have DKIM (DomainKeys Identified Mail) setup. The simplest method is to have Brevo place a text file on the domain listing in Clouflare, in Brevo look at home->settings from the top right menu, thenSenders, Domains & Dedicated IPs->Domains from the left panel and add a domain. The authentication is virtually automated but needs to login to Cloudflare and allow it to post the text file in the correct domain. DKIM (DomainKeys Identified Mail) allows you to sign your emails with your own domain, just like signing a letter. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a protocol that protects a domain from unauthorized use, such as phishing or spoofing. A DMARC policy can be setup to determine what happen to emails that fail the DMARC authentication checks.

			====Address Rewriting====
			Brevo only accepts validated domains and the only domains that has been validated by Brevo is the seaoffate.net, seaoffate.uk and seaoffate.co.uk. Brevo will reject any email where the "From" domain is not validated including subdomains eg someone@vmhostname.seaoffate.net is not accepted but someone_vmhostname@seaoffate.net is accepted. Each host will by default it's own FQDN eg raisin.seaoffate.net and will therefore be rejected by Brevo when it is eventually received by them. To fix the subdomain problem and make emails acceptable to Brevo we can use '''Canonical Mapping''' to mask the internal hostname with our valid domain. First Create the mapping file:
			sudo nano /etc/postfix/sender_canonical_regexp
			Add the RegEx rule to preserve the username but fix the domain to seaoffate.net add the lines:
			/^([^@]+)@raisin\.seaoffate\.(local\|net)$/ ${1}@seaoffate.net
			/^([^@]+)@localhost$/ ${1}@seaoffate.net
			then to apply the changes and restart postfix:
			sudo postconf -e "sender_canonical_maps = regexp:/etc/postfix/sender_canonical_regexp"
			sudo postmap /etc/postfix/sender_canonical_regexp
			sudo systemctl restart postfix
			From this moment on any email sent from raisin with the from field as default someone@raisin.seaoffate.net or someone@raisin.seaoffate.local will have the from field rewritten to someone@seaoffate.net, we also included the localhost rewrite rule because some apps insist on sending from localhost. It is also possible to have specific, static rewrite rules using:
			sudo nano /etc/postfix/sender_canonical
			and adding some fixed rewrite rules
			nigel sailor@seaoffate.net
			root sailor@seaoffate.net
			@raisin.seaoffate.local sailor@seaoffate.net
			To apply these rules use either the following to just use the fixed rules and not the regex rules:
			sudo postmap /etc/postfix/sender_canonical
			sudo postconf -e "sender_canonical_maps = hash:/etc/postfix/sender_canonical"
			sudo systemctl restart postfix
			or alternatively, to use both the fixed and the regex rules so that there is specific rewrite for some users and a generic rewrite for the rest, first define the files in main.cf (The order matters: Hash first, then RegEx)
			sudo postconf -e "sender_canonical_maps = hash:/etc/postfix/sender_canonical, regexp:/etc/postfix/sender_canonical_regexp"
			Map the static file (This creates/updates the .db file)
			sudo postmap /etc/postfix/sender_canonical
			No need to postmap the regexp file, just restart to load the config
			sudo systemctl restart postfix

Wikisailor: /* Media Wiki Configuration */

2026-02-24T06:19:48Z

Media Wiki Configuration

← Older revision		Revision as of 06:19, 24 February 2026
Line 91:		Line 91:
	];		];
	Save and exit and it should be good to go a simple test is to change a email address of a wiki user and authenticate the new email.		Save and exit and it should be good to go a simple test is to change a email address of a wiki user and authenticate the new email.


			==Postfix configuration for other hosts==

Wikisailor at 23:35, 10 April 2025

2025-04-10T23:35:27Z

← Older revision		Revision as of 23:35, 10 April 2025
Line 72:		Line 72:
	sudo systemctl restart postfix		sudo systemctl restart postfix
	the tails file should clear and send the email.		the tails file should clear and send the email.

			=== Joomla Configuration ===

			To set joomla to use Postfix as its MTA simply go to System->Global Configuration->Server scroll down to Mail and set Mailer to PHP Mail. After saving send a test email and it should just work. Now that Postfix is doing the auth to Brevo Joomla can just use the local PHP mail so no need to negotiate any SSL/TLS because Postfix does it all. Postfix is well known and quite reliable, mature and robust service it should be reasonably secure, especially as hostile actors cannot directly connect to it, it is only for the websites to use.

			=== Media Wiki Configuration===

			We have set mynetworks and smtpd_relay_restrictions to allow production to use the Postfix MTA so there is no need to have Logan install Postfix. All that we need to do to get Wikimedia sending out email is to edit the ubiquitous LocalSettings.php. The item to set is $wgSMTP. so we ssh to Logan and cd to the public_html dir the
			sudo nano LocalSettings.php
			CTRL + W and search for $wgSMTP then add a message block so it looks like
			$wgSMTP = [
			'host' => '192.168.100.10', // the IP of lime
			'port' => '25, // SMTP port with no encription as this is a private LAN there is no need for SSL
			'auth' => false, // authentication is not need on a private LAN like this
			// 'username' =>'', // auth is false so no username required
			// 'password' => '', // no need for password if there is no username
			// 'encription' => '', // we are on 25 so no encription
			];
			Save and exit and it should be good to go a simple test is to change a email address of a wiki user and authenticate the new email.