Configuring Mail Relay for Sending Notifications from Servers
A typical situation: a cron job fails at night, Zabbix registers an incident, but the notification goes nowhere because the server tries to send mail directly on port 25, which is blocked by the provider or hosting. The app gets Connection refused or 554 5.7.1 Relay access denied, the email is lost, the incident goes unnoticed. We've encountered this dozens of times—so we've developed a proven relay setup process that ensures delivery.
Mail relay solves this in one step: the server sends mail to a trusted SMTP gateway, which knows how to deliver it further. This article covers specific configuration, common mistakes, and cases for different infrastructures.
Why Direct Sending Doesn't Work?
Most hosting providers and cloud platforms block port 25 by default—this is spam protection. Even if the port is open, server IPs often end up on blacklists. Additionally, mail servers (Exchange, Yandex 360) require authentication and TLS. Without a relay, your alerts will be lost.
Postfix as Local Relay: Minimal Configuration
For most servers, configuring Postfix in satellite mode is sufficient—it doesn't accept incoming mail, doesn't keep a long queue, simply forwards everything to an upstream relay.
# /etc/postfix/main.cf
myhostname = app01.internal.example.com
mydomain = internal.example.com
myorigin = $mydomain
relayhost = [smtp.sendgrid.net]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
inet_interfaces = loopback-only
mydestination = Credentials file:
# /etc/postfix/sasl_passwd [smtp.sendgrid.net]:587 apikey:SG.xxxxxxxxxxxx After creating, hash and restart:
postmap /etc/postfix/sasl_passwd
chmod 600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db
systemctl reload postfixInstead of SendGrid, any SMTP will work: Amazon SES (email-smtp.eu-west-1.amazonaws.com:587), Mailgun, corporate Exchange/Office 365, or your own Postfix on a dedicated server.
Comparison of Popular SMTP Relays
| Provider | Port | Authentication | Free Limit | Price After Limit |
|---|---|---|---|---|
| SendGrid | 587/2525 | API key | 100 emails/day | from $19.95/month |
| Amazon SES | 587/2587 | SMTP key | 62,000 emails/month | $0.10 per 1,000 emails |
| Mailgun | 587/465 | SMTP login | 5,000 emails/month | $35 for 50,000 emails |
| Internal relay | 25 (trusted) | IP whitelist | Unlimited | Only server costs |
When You Need an Internal Relay Instead of External SaaS
In isolated infrastructures—banks, government sector, perimeter networks without internet access—external SMTP providers are unavailable. In such cases, we set up an internal relay server: one Postfix with open mynetworks for trusted subnets and configured smarthost to the corporate mail server.
# relay.internal — accepts from 10.0.0.0/8, forwards to Exchange
mynetworks = 127.0.0.0/8, 10.0.0.0/8
relayhost = [mail.corp.example.com]:25
relay_domains =
smtpd_recipient_restrictions = permit_mynetworks, rejectSuch a relay does not require authentication from internal servers—they are in mynetworks. Exchange accepts from the relay via IP-based connector.
How to Choose Between External and Internal Relay?
We recommend an external relay for cloud infrastructures—it's cheaper and easier to maintain. An internal relay is for environments with high security and isolation requirements. We have experience configuring both: over 80 projects, including banks and government agencies.
Testing and Diagnostics
After configuration, immediately test:
# Send a test email
echo "Test relay $(hostname)" | mail -s "relay test" [email protected]
# Check the queue
mailq
postqueue -f # force delivery attempt
# Real-time logs
journalctl -u postfix -fA common mistake is SASL authentication failed with a correct password. The reason is usually that sasl_passwd.db was not updated after editing the text file (postmap wasn't rerun), or the password contains special characters that need to be escaped.
Example: resolving SASL authentication failed error
When using a password with `%` in SendGrid, you must escape it in `sasl_passwd` as `%%`. Otherwise, Postfix interprets `%` as a substitution character. After escaping, rerun `postmap`.What Our Service Includes
We configure Postfix relay on each server or one centralized relay host for the entire infrastructure. We connect to your chosen upstream: SendGrid, SES, Mailgun, corporate SMTP. We set up TLS, authentication, IP restrictions. We verify delivery from all notification sources: cron, Zabbix/Prometheus Alertmanager, applications.
Timeline: from a few hours for one server to 1-2 days for an infrastructure with dozens of hosts and non-standard network restrictions. Get a consultation for your project—we will assess the complexity and select the optimal turnkey solution.
Which Relay Suits My Infrastructure?
For small projects (up to 10 servers), an external SMTP provider is enough—it doesn't require a dedicated server and saves maintenance time. For large distributed systems with dozens of hosts and strict availability requirements, it's better to set up an internal relay—it gives full control over queues and logs. We'll help you decide and configure the solution on any platform.
For in-depth understanding of Postfix mechanisms, the official documentation is recommended.