Welcome to our tutorial on how to configure Postfix to use Gmail SMTP on CentOS 8 to relay mails. Postfix is a free and open-source mail transfer agent that routes and delivers electronic mail. Postfix MTA can be configured to relay mails through an external SMTP servers such as Gmail SMTP server for a reliable mail delivery.
Configure Postfix to Use Gmail SMTP on CentOS 8
Install Postfix on CentOS 8
You can install Postfix by installing the
postfix package itself or via the
mailutils package which installs along with it.
dnf install postfix
Install SASL on CentOS 8
SASL (Simple Authentication and Security Layer) provides a mechanism of authenticating users using their username and password. The implementation of SASL is provided Cyrus SASL library which can be installed on a CentOS 8 system by running the command below;
dnf install cyrus-sasl-plain
Install Mail Command on CentOS 8
Mail command on CentOS 8 is provided by mailx package.
dnf install mailx
Configure Postfix to Use Gmail SMTP on CentOS 8
Postfix is now installed with the default configuration. You can view Postfix configuration values using the postconf command;
To make further configuration changes, edit the main Postfix configuration file,
/etc/postfix/main.cf and make any necessary changes as needed.
Set the Postfix Relay server
Postfix can be configured to deliver mails indirectly via a relay host. A relay host can be defined on a Postfix configuration file using the
By default, the value of the
relayhost parameter is empty. This configures Postfix is to try to deliver mail directly to the Internet, which is usually not desirable.
According to Postfix configuration, different values can be set for the relayhost parameter;
- On an intranet, you can specify your organizational domain name. If your internal DNS uses no MX records, specify the name of the intranet gateway host instead.
- In the case of SMTP or LMTP delivery, specify one or more destinations in the form of a domain name, hostname, hostname:port, [hostname]:port, [hostaddress] or [hostaddress]:port, separated by comma or whitespace. The form [hostname] turns off MX lookups.
In our case, we are setting Postfix relay to Gmail SMTP servers. Hence, open the Postfix main configuration file;
Under the Intranet/Internet section, find the,
relayhost =, lines and set its value to Gmail SMTP domain name as shown below;
... #relayhost = $mydomain #relayhost = [gateway.my.domain] #relayhost = [mailserver.isp.tld] #relayhost = uucphost #relayhost = [an.ip.add.ress] relayhost = [smtp.gmail.com]:587
Configure Postfix SASL Authentication
According to Postfix:
- SMTP servers need to decide whether an SMTP client is authorized to send mail to remote destinations, or only to destinations that the server itself is responsible for.
- Usually, SMTP servers accept mail to remote destinations when the client’s IP address is in the “same network” as the server’s IP address.
- SMTP clients outside the SMTP server’s network need a different way to get “same network” privileges. To address this need, Postfix supports SASL authentication. With this, a remote SMTP client can authenticate to the Postfix SMTP server, and the Postfix SMTP client can authenticate to a remote SMTP server.
- Once a client is authenticated, a server can give it “same network” privileges.
To enable SASL server authentication, you need to;
- Enable SMTP client-side authentication by setting the value of
smtp_sasl_auth_enable = yes
- Configure the Postfix SMTP client to send username and password information to the mail gateway server. This can be done by defining the path to
sasl_passwdas using the
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
- Enforce STARTTLS encryption for outgoing SMTP to ensure that connection to the remote smtp server will be encrypted using the
smtp_tls_security_level = encrypt
- Define the Postfix SMTP client SASL security options. This be zero or more of the following options;
- noplaintext: Disallow methods that use plaintext passwords.
- noactive: Disallow methods subject to active (non-dictionary) attack.
- nodictionary: Disallow methods subject to passive (dictionary) attack.
- noanonymous: Disallow methods that allow anonymous authentication.
- mutual_auth: Only allow methods that provide mutual authentication.
smtp_sasl_security_options = noanonymous
These configs can be updated on Postfix configuration file (See the highlighted lines);
... relayhost = [smtp.gmail.com]:587 ... # ... # SASL authentication # change may to encrypt. smtp_tls_security_level = encrypt meta_directory = /etc/postfix shlib_directory = /usr/lib64/postfix # Added these lines smtp_sasl_auth_enable = yes smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd smtp_sasl_security_options = noanonymous
Save and exit the configurtion file.
Set the SMTP SASL Credentials
As per our configurations above, the SASL credentials database file is set to
You should define the SMTP credentials in the format;
# destination credentials [smtp.domain.name] username:password
As shown below;
[smtp.gmail.com]:587 [email protected]:password
[email protected] and
password with your Gmail account credentials.
- If you specify the “
[” and “
]” in the
relayhostdestination, you must as well use the same format in the
- If you specify a non-default TCP Port (such as “
:submission” or “
:587“) in the
relayhostdestination, you must as well use the same form in the
Secure the SASL Password File
The credentials are set in plaintext. To protect access to the file by other users, make the file read+write only for
chown root:root /etc/postfix/sasl_passwd chmod go-rwx /etc/postfix/sasl_passwd chmod 600 /etc/postfix/sasl_passwd
Create SASL Password DB file
Postfix requires that the
sasl_passwd file to be a database such that it can be read faster. Use
postmap command to convert the file into a database,
This will assign the same ownership and permissions to the database file as set for the sasl_passwd file above.
ls -l /etc/postfix/sasl_passwd*
-rw-------. 1 root root 56 Dec 2 22:02 /etc/postfix/sasl_passwd -rw-------. 1 root root 12288 Dec 2 22:03 /etc/postfix/sasl_passwd.db
Check Postfix Configuration
postfix check command to check the Postfix configuration for any error. Any error should printed on the output.
You can ignore the warning,
postfix/postfix-script: warning: symlink leaves directory: /etc/postfix/./makedefs.out.
Start and enable Postfix to run on system boot;
systemctl enable --now postfix
To check the status;
systemctl status postfix
● postfix.service - Postfix Mail Transport Agent Loaded: loaded (/usr/lib/systemd/system/postfix.service; disabled; vendor preset: disabled) Active: active (running) since Wed 2020-12-02 22:04:20 EAT; 6s ago Process: 3653 ExecStart=/usr/sbin/postfix start (code=exited, status=0/SUCCESS) Process: 3651 ExecStartPre=/usr/libexec/postfix/chroot-update (code=exited, status=0/SUCCESS) Process: 3647 ExecStartPre=/usr/libexec/postfix/aliasesdb (code=exited, status=0/SUCCESS) Main PID: 3721 (master) Tasks: 3 (limit: 5027) Memory: 5.6M CGroup: /system.slice/postfix.service ├─3721 /usr/libexec/postfix/master -w ├─3722 pickup -l -t unix -u └─3723 qmgr -l -t unix -u Dec 02 22:04:19 centos8.kifarunix-demo.com systemd: Starting Postfix Mail Transport Agent... Dec 02 22:04:20 centos8.kifarunix-demo.com postfix/master: daemon started -- version 3.3.1, configuration /etc/postfix Dec 02 22:04:20 centos8.kifarunix-demo.com systemd: Started Postfix Mail Transport Agent.
Send a Test Mail to Verify Postfix Gmail SMTP Relay
Once you are done with the configuration, you can try to send a test mail to verify that Gmail SMTP relay works fine. You can use mail client or any other for this purpose.
echo "Test Postfix Gmail SMTP Relay" | mail -s "Postfix Gmail SMTP Relay" [email protected]
You can tail the logs to check the delivery status;
If you get the error;
...status=deferred (SASL authentication failed; server smtp.gmail.com[188.8.131.52] said: 535-5.7.8 Username and Password not accepted.
You need to login to the account you used for the SASL authentication and enable Less secure app access.
NOTE that the use of less secure app access has been deprecated. See how you can use App password as an alternative in the guide below;
After that, retry to sent the test mail and check the logs and hurray, our test mail is delivered, status=sent.
... Dec 2 22:04:56 ceph-admin postfix/qmgr: 46993C35EAC: from=<[email protected]>, size=513, nrcpt=1 (queue active) Dec 2 22:05:00 ceph-admin postfix/smtp: 46993C35EAC: to=<[email protected]>, relay=smtp.gmail.com[184.108.40.206]:587, delay=4, delays=0.47/0.33/2/1.2, dsn=2.0.0, status=sent (250 2.0.0 OK 1606935899 f18sm554842edt.60 - gsmtp) ...
And that is how easy it is to configure Postfix to use Gmail as an SMTP relay host. That marks the end of our guide on how to install and configure Postfix to use Gmail SMTP relay host on CentOS 8.
Read more about Postfix Configuration on;