How to Configure Postfix as an SMTP Relay Client Through Amazon Ses on Ubuntu 24.04

ByAkensai

Learning how to configure Postfix as an SMTP relay client through Amazon SES on Ubuntu 24.04 is one of the smartest moves you can make for server email delivery. By default, emails sent directly from a VPS often land in spam folders. Amazon Simple Email Service (SES) gives you a trusted sending infrastructure with high deliverability rates. This tutorial walks you through installing Postfix, verifying your domain in SES, creating SMTP credentials, and wiring everything together so your server routes outbound mail through Amazon’s network. Whether you’re running a WordPress site, a web application, or any Linux-based service that needs to send email, this setup will keep your messages out of spam and your server off blacklists. By the end, you’ll have a fully working mail relay that sends authenticated email through Amazon SES.

Prerequisites and Requirements for Configuring Postfix as an Amazon SES Relay

Before you start, make sure you have everything in place. This setup is straightforward, but a few things need to be ready first.

What you need:

  • A server running Ubuntu 24.04 with root or sudo access
  • An active Amazon SES account with a verified domain or email address
  • SMTP credentials generated from the SES console (access key and secret key)
  • A registered domain with DNS access to add TXT and CNAME records
  • Basic familiarity with the Linux command line
  • Postfix not yet installed, or installed but unconfigured

Estimated time: 30–45 minutes

Assumed knowledge: You should be comfortable editing files with a text editor like nano, running sudo commands, and navigating a terminal. You don’t need deep mail server experience. This guide explains each step clearly.

If your SES account is still in sandbox mode, you can only send to verified addresses. Request production access from the AWS console before going live.

How to Configure Postfix as an SMTP Relay Client Through Amazon SES on Ubuntu 24.04

Related tutorial: How to Monitor Linux System Performance with Netdata on Ubuntu Server

Follow these steps in order. Don’t skip steps, especially the credential encoding section.

Step 1: Update your system and install Postfix

Start with a fresh package list. Then install Postfix and the SASL authentication library.

sudo apt update && sudo apt upgrade -y
sudo apt install postfix libsasl2-modules -y

During the Postfix installation prompt, select Internet Site as the mail configuration type. Enter your server’s fully qualified domain name (FQDN) when asked. You can change this later.

Step 2: Generate your Amazon SES SMTP credentials

Log into the AWS Management Console. Navigate to Amazon SES → SMTP Settings. Click Create SMTP Credentials. AWS generates an IAM user with the correct sending policy. Download the credentials file. You’ll get a username (access key ID) and a password (secret access key converted to SMTP format).

Keep these credentials safe. You’ll use them in the next step.

Step 3: Encode your credentials for Postfix

Postfix stores SMTP credentials in a sasl_passwd file. Create it now.

sudo nano /etc/postfix/sasl_passwd

Add this single line, replacing the placeholders with your actual SES SMTP endpoint, username, and password:

[email-smtp.us-east-1.amazonaws.com]:587 YOUR_SMTP_USERNAME:YOUR_SMTP_PASSWORD

Save and close the file. Now hash it so Postfix can read it securely:

sudo postmap /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db

The postmap command creates a binary database from the plain text file. The chmod command locks down permissions so only root can read the credentials.

Step 4: Configure the Postfix main.cf file

This is the core configuration step. Open the main Postfix config file:

sudo nano /etc/postfix/main.cf

Add or update these lines at the bottom of the file:

relayhost = [email-smtp.us-east-1.amazonaws.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_use_tls = yes
smtp_tls_security_level = encrypt
smtp_tls_note_starttls_offer = yes
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

Each line matters. The relayhost tells Postfix to send all outbound mail through SES. The SASL lines enable authentication. The TLS lines enforce encrypted connections, which SES requires.

Save and close the file.

Step 5: Restart Postfix and test the configuration

Apply your changes by restarting Postfix:

sudo systemctl restart postfix
sudo systemctl status postfix

Make sure the service shows as active and running. Now send a test email:

echo "Test email from Postfix SES relay" | mail -s "SES Relay Test" [email protected]

Replace [email protected] with a verified address if your SES account is still in sandbox mode.

Step 6: Check the mail logs

Watch the logs in real time to confirm delivery:

sudo tail -f /var/log/mail.log

Look for a line containing 250 Ok from the SES server. That confirms successful delivery. If you see errors, note the exact message and check the troubleshooting section below.

Step 7: Verify your domain in Amazon SES

If you haven’t verified your sending domain yet, do it now. Go to Amazon SES → Verified Identities → Create Identity. Choose Domain and enter your domain name. AWS provides DNS records. Add them to your DNS provider. Verification usually completes within a few minutes. Check the Amazon SES identity verification documentation for detailed DNS record instructions.

Troubleshooting Common Postfix and Amazon SES Relay Issues

Even with careful setup, things sometimes go wrong. Here are the most common problems and how to fix them.

Authentication failed (SASL errors)

This usually means your credentials are wrong or the sasl_passwd file wasn’t hashed correctly. Double-check your username and password. Re-run sudo postmap /etc/postfix/sasl_passwd after any edits to the file.

Connection refused or timeout on port 587

Your server’s firewall might be blocking outbound port 587. Check with:

sudo ufw status

Allow outbound traffic if needed. Also confirm your cloud provider’s security group allows outbound connections on port 587.

Email rejected with “Email address not verified”

Your SES account is in sandbox mode. Either verify the recipient address in SES or request production access from AWS.

Postfix not starting after config changes

Run this command to check for syntax errors in your configuration:

sudo postfix check

This prints any errors without restarting the service. Fix the reported issues, then restart.

Mail going to spam

Make sure your domain has SPF, DKIM, and DMARC records configured. Amazon SES provides DKIM keys during domain verification. Add them to your DNS. SPF should include Amazon SES sending IPs or use the SES-provided SPF record.

Conclusion

You now know how to configure Postfix as an SMTP relay client through Amazon SES on Ubuntu 24.04. Your server will route all outbound mail through Amazon’s trusted infrastructure. This dramatically improves deliverability and keeps your server’s IP off email blacklists. From here, you can explore setting up email monitoring with AWS CloudWatch, configuring bounce and complaint handling through SNS, or integrating this relay with WordPress using the WP Mail SMTP plugin. If you manage multiple servers, repeat this process on each one using the same SES credentials. Maintaining good sending practices, like keeping bounce rates low and honoring unsubscribes, will keep your SES account in good standing long term.

Similar Posts