Postfix

How to Install and Configure Postfix Mail Server with Let's Encrypt on Ubuntu VPS (Native Installation)

Philip Jensen

— 3 min read

Introduction

Setting up a secure and reliable mail server is essential for many businesses and developers. At ByteHosting, we understand the importance of having a robust email infrastructure, which is why we’ve prepared this comprehensive guide on how to install and configure a Postfix mail server with Let's Encrypt on Ubuntu VPS. Whether you're new to mail server setup or looking to improve your existing configuration, this step-by-step tutorial will help you achieve a secure, efficient, and trusted mail system.

Prerequisites: VPS Setup and Domain Configuration

Before diving into the installation, ensure you have a clean Ubuntu VPS. We recommend Ubuntu 20.04 LTS or later for optimal compatibility. Additionally, your domain name should be properly pointed to your VPS’s IP address via DNS A records. This is crucial for obtaining SSL certificates from Let's Encrypt and for proper mail delivery.

At ByteHosting, our cost-effective VPS plans, such as our Xeon 4GB or Ryzen Virtual Servers, provide a reliable platform for hosting your mail server. Once your VPS is ready and your domain is configured, you can proceed with the installation.

Installing Postfix from Ubuntu Repositories

First, update your package list and install Postfix. We recommend installing the 'mail-stack-delivery' package, which includes Postfix along with other necessary components:

sudo apt update
sudo apt install postfix

During installation, you'll be prompted to select a configuration type. For a basic setup, choose Internet Site and enter your domain name when asked. This sets up Postfix to handle mail for your domain.

Configuring Postfix for Secure SMTP with TLS

Security is paramount. To encrypt email traffic, we'll configure Postfix to use TLS. First, install the necessary packages:

sudo apt install opendkim opendkim-tools

Next, generate a self-signed certificate initially (we'll replace it with Let's Encrypt later). For now, create a directory for SSL certificates:

sudo mkdir -p /etc/ssl/postfix

Generate a certificate:

sudo openssl req -newkey rsa:2048 -days 365 -nodes -x509 \
  -subj "/C=US/ST=State/L=City/O=Organization/CN=mail.yourdomain.com" \
  -keyout /etc/ssl/postfix/privkey.pem \
  -out /etc/ssl/postfix/fullchain.pem

Configure Postfix to use these certificates by editing /etc/postfix/main.cf:

sudo nano /etc/postfix/main.cf

Add or modify the following lines:

smtpd_tls_cert_file = /etc/ssl/postfix/fullchain.pem
smtpd_tls_key_file = /etc/ssl/postfix/privkey.pem
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

Restart Postfix to apply changes:

sudo systemctl restart postfix

Obtaining and Installing Let's Encrypt SSL Certificates

To ensure your mail server is trusted and secure, obtain free SSL certificates from Let's Encrypt. We recommend using Certbot for this purpose. Install Certbot:

sudo apt install certbot

Then, request a certificate for your domain:

sudo certbot certonly --standalone -d mail.yourdomain.com

Once obtained, update your Postfix configuration to use the Let's Encrypt certificates, typically located at:

/etc/letsencrypt/live/mail.yourdomain.com/fullchain.pem
/etc/letsencrypt/live/mail.yourdomain.com/privkey.pem

Edit /etc/postfix/main.cf again to point to these files:

smtpd_tls_cert_file = /etc/letsencrypt/live/mail.yourdomain.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.yourdomain.com/privkey.pem

Reload Postfix:

sudo systemctl reload postfix

Testing Mail Server Functionality

After configuration, it's essential to test your mail server. Use tools like telnet or openssl to verify SMTP connectivity and TLS encryption:

openssl s_client -starttls smtp -connect mail.yourdomain.com:587

Send a test email using your preferred email client or command-line tools like swaks. Ensure that emails are sent and received correctly, and check your server logs for any errors.

Troubleshooting Common Postfix Setup Issues

  • DNS issues: Make sure your DNS records (MX, A, and SPF) are correctly configured.
  • Certificate errors: Verify that your SSL certificates are valid and correctly referenced in main.cf.
  • Firewall restrictions: Open ports 25, 587, and 993 as needed for SMTP, submission, and IMAP/POP3.
  • Authentication problems: Configure SASL if you plan to require authentication for sending emails.

At ByteHosting, our reliable infrastructure in Frankfurt ensures your mail server runs smoothly. If you encounter persistent issues, our support team is ready to assist you with advanced configurations and troubleshooting.

Conclusion

Setting up a secure Postfix mail server on Ubuntu with Let's Encrypt is a manageable task when following best practices. By properly installing, configuring TLS, and obtaining trusted SSL certificates, you ensure your email communications are secure and trustworthy. Remember to regularly update your certificates and monitor your server logs for any anomalies. With our affordable VPS hosting options, you can deploy a professional-grade mail server that meets your needs. If you need a reliable environment for your mail infrastructure, consider our VPS plans in Frankfurt — trusted by organizations worldwide.

Read more