How to: postfix, dovecot with imap, smtp sasl authentication, encryption

06 Feb 2010 at 00:00:00 - 3 comment(s)

This is a great how-to if you want to install and configure an email server. If you are struggling to do so, this post will put an end to it. I myself was struggling getting everything to work as I wanted especially for the smtp to do authentication and solve the relay access denied error message I was getting even with the authentication working. On top of having a working email server with encryption and authentication we will configure spamassassin in order to get rid of the SPAM. Configuration files are available for download and it is guarantee to work not like the thousand of tutorials I read.


The easiest part. You need to install just four things: postfix, dovecot, procmail and spamassassin.

procmail is an automail processing. It will take care of delivering the emails to the right mailbox.

dovecot is an IMAP and POP3 server written with security primarily in mind.

postfix is the email server which is going to use dovecot and procmail.

So to install nothing easier. As I am using archlinux I am giving the command to install the packages on archlinux and then I'll give it debian based distribution such as Ubuntu

pacman -S dovecot, postfix, procmail, spamassassin-spamc

And for debian distribs:

apt-get install dovecot, postfix, procmail, spamassassin


That's the hard part but as you'll have everything in this post it will be easy and smooth. First thing is to create a mailbox for your user so let's say you have a user marc and its home directory is /home/marc. Here is how you do it

cd /home/marc/
maildirmake mail

You need this folder to belong to the user marc

chown -R marc:marc mail

Now we're going to do something in order procmail can deliver the emails to this user. For doing so you need to create the file .procmailrc in its home folder.

vi /home/marc/.procmailrc

Here is the content of this file:


* ^X-Spam-Status: Yes

First part of the file is easy to understand. Second part is for spamassassin. It is a filter saying to procmail to deliver the folder marked as spam to the folder Junk of your mailbox.

That's it for procmail. Now let's configure dovecot.

vi /etc/dovecot/dovecot.conf

The content of dovecot.conf

protocols = imap imaps
disable_plaintext_auth = no
log_timestamp = "%b %d %H:%M:%S "
ssl = yes
ssl_cert_file = /etc/ssl/certs/mail.crt
ssl_key_file = /etc/ssl/private/mail.key
mail_location = maildir:~/mail
mail_access_groups = mail
auth_username_chars = abcdefghijklmnopqrstuvwxyz
protocol imap {
  imap_client_workarounds = delay-newmail tb-extra-mailbox-sep
auth default {
  mechanisms = plain login
  passdb pam {
  userdb passwd {
  socket listen {
    client {
      path = /var/spool/postfix/private/auth
      user = postfix
      group = postfix
      mode = 0660

I think most of what is here is clear, if not leave a comment. Just you need to check the path /var/spool/postfix/private/auth exists and as you can see we have an ssl certificate and a key. We need to generate these.

openssl genrsa -des3 -rand /etc/hosts -out mail.key 1024
openssl req -new -key mail.key -out mail.csr
openssl x509 -req -days 3650 -in smtpd.csr -signkey mail.key -out mail.crt

Don't forget to move those generated files at the right place. We're done with dovecot. Let's move to postfix.

There are essentially 2 configuration files for postfix: and


vi /etc/postfix/

The content of

daemon_directory = /usr/lib/postfix

smtpd_banner = $myhostname ESMTP $mail_name
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
delay_warning_time = 4h

myhostname =
mydomain =
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin =
mydestination = localhost, localhost.localdomain,

mynetworks =

mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

smtpd_use_tls = yes
smtpd_tls_loglevel = 2
smtpd_tls_cert_file = /etc/ssl/certs/mail.crt
smtpd_tls_key_file = /etc/ssl/private/mail.key
smtpd_sasl_auth_enable = yes
smtpd_client_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination
broken_sasl_auth_clients = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous

I was struggling for 4 days before I got it to work. Indeed I was getting relay access denied though my authentication was working fine. The only thing I was missing was:
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination

Now you need to edit

vi /etc/postfix/

The content of

smtp      inet  n       -       n       -       -       smtpd -o content_filter=spamassassin
smtps     inet  n       -       n       -       -       smtpd -o content_filter=spamassassin
pickup    fifo  n       -       n       60      1       pickup
cleanup   unix  n       -       n       -       0       cleanup
qmgr      fifo  n       -       n       300     1       qmgr
#qmgr     fifo  n       -       n       300     1       oqmgr
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
rewrite   unix  -       -       n       -       -       trivial-rewrite
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce
verify    unix  -       -       n       -       1       verify
flush     unix  n       -       n       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       n       -       -       smtp
relay     unix  -       -       n       -       -       smtp
        -o smtp_fallback_relay=
showq     unix  n       -       n       -       -       showq
error     unix  -       -       n       -       -       error
retry     unix  -       -       n       -       -       error
discard   unix  -       -       n       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
scache    unix  -       -       n       -       1       scache

spamassassin unix -     n       n       -       -       pipe
  user=spamd argv=/usr/bin/perlbin/vendor/spamc -f -e
        /usr/sbin/sendmail -oi -f ${sender} ${recipient}

Almost done. The only thing left is spamassassin. I personally kept the default configuration as it works pretty well for me but if you want to do some customization there, just edit /etc/mail/spamassassin/

Finally just start it up (on debian distribs you would replace rc.d by init.d)

/etc/rc.d/dovecot start
/etc/rc.d/postfix start

Download the configuration files


In this post we have been through the installation and the configuration of an email server using postfix, dovecot, procmail and spamassassin. We got imap with ssl encryption working as well as sasl authentication for smtp with tls encryption. All what you need to have a good and robust email server.


Notify me of follow up comments