Configure Postfix to Use an External SMTP Server (SendGrid, Mailgun, Amazon SES)

Your Linux server needs to send transactional email (password resets, signup confirmations, monitoring alerts) without fighting reverse-DNS, SPF, DKIM, and DMARC configuration to make Gmail accept mail from your IP. The cleaner approach is to relay outbound mail through a dedicated transactional SMTP provider. This DevAnswers walkthrough configures Postfix on Ubuntu 22.04+ or Debian 12+ to relay through SendGrid, Mailgun, or Amazon SES, the three dominant transactional providers in 2026.

Prerequisites #

• A Linux server running Ubuntu 22.04 / 24.04 / 26.04 LTS or Debian 12 / 13, with sudo access.
• Outbound network access on port 587 (STARTTLS) or port 465 (TLS Wrapper). Most ISPs and cloud hosts block port 25 by default, so this guide does not use port 25.
• An account with one of: SendGrid, Mailgun, or Amazon SES, with SMTP credentials generated.
• Looking for Gmail relay instead? See our companion guide on configuring Postfix to use Gmail SMTP. Gmail uses a different authentication pattern (App Password + 2-Step Verification) and is covered there in detail.

Choose Your Provider #

The three providers in this guide share an almost-identical Postfix configuration pattern; the relay hostname, SMTP credentials, and (if you pick port 465 instead of 587) one extra TLS-wrapper directive are the only things that change. Pick based on volume, cost, and where your application is hosted.

• SendGrid (Twilio SendGrid). Free tier 100 emails/day, paid tiers from $20/mo for 50,000/mo. Strong brand recognition. Good fit for SaaS and small-volume transactional.
• Mailgun (Sinch-owned). Paid from around $35/mo after the trial. Developer-friendly API and good documentation. Popular with smaller dev teams.
• Amazon SES. The cheapest at scale at $0.10 per 1,000 emails sent. Default for any application already hosted on AWS. Requires an AWS account, region selection, and awareness of the sandbox-mode restriction on new accounts.

Other providers worth knowing: Postmark (premium transactional-only with a deliverability focus), Resend (newer, popular with React and Next.js projects), and Brevo (formerly Sendinblue, popular for European SMB) all use the same Postfix SASL pattern; only the relayhost and credentials change. Microsoft 365 is intentionally not covered here because it now requires OAuth2 / modern auth for SMTP, which Postfix can only handle via an OAuth2-helper daemon (separate article).

If you haven’t picked a Linux host yet: some managed Linux hosting platforms include outbound SMTP as part of the platform, so you don’t configure Postfix at all. Cloudways bundles Elastic Email integration by default on its managed servers, with optional Mailgun or SendGrid add-ons if you’d rather use one of the providers below. Useful to know upfront, since this decision is easier to make BEFORE you provision the server than after you’ve installed Postfix.

Install Postfix on Ubuntu and Debian #

Install Postfix from the distro package, alongside mailutils (for the sendmail test command later) and libsasl2-modules (provides the PLAIN/LOGIN SASL mechanisms that SendGrid, Mailgun, and SES use; without it, authentication fails with “no worthy mechs found“):

sudo apt update
sudo apt install -y postfix mailutils libsasl2-modules

The installer prompts you to pick a configuration type. For an outbound-only relay, choose Satellite system. Postfix sends all outbound mail to your smarthost and accepts no inbound. If you picked “Internet Site” or any other option during install by mistake, re-run the prompt:

sudo dpkg-reconfigure postfix

Pick “Satellite system” this time. You will be asked for a system mail name; your server’s hostname is the typical answer.

Shared Relay Configuration in main.cf #

Open the Postfix main configuration file:

sudo nano /etc/postfix/main.cf

Add this block at the bottom. Replace RELAYHOST_PLACEHOLDER with the per-provider value from the section below (the rest of the block is identical for all three providers):

# External SMTP relay (replace RELAYHOST_PLACEHOLDER per provider)
relayhost = RELAYHOST_PLACEHOLDER

# SASL authentication (client side)
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_sasl_tls_security_options = noanonymous

# TLS encryption (mandatory for the connection)
smtp_tls_security_level = encrypt
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

Two directives are worth understanding. relayhost is the next-hop destination for non-local mail. Wrapping the hostname in square brackets is significant: it turns off MX lookups, so Postfix connects directly to the named host on the named port instead of asking DNS for the domain’s MX records. That’s what you want for a relay endpoint, since SMTP relay hostnames like smtp.sendgrid.net are not configured as mail-exchange servers for their own domains.

If you use port 465 (TLS Wrapper / implicit TLS) instead of 587 (STARTTLS): add one extra directive to the block above: smtp_tls_wrappermode = yes. Postfix needs to know to negotiate TLS at connection open rather than after a STARTTLS command. The shared block above is otherwise identical for both ports.

smtp_sasl_auth_enable = yes turns on client-side SASL authentication. The paired smtp_sasl_password_maps directive points at the credential table you’ll create in the next section. For TLS, smtp_tls_security_level = encrypt mandates encryption: Postfix refuses to send unless the server offers TLS. That’s the right default for an authenticated relay over a public network.

Now create the credential file at /etc/postfix/sasl_passwd. Add a single line in the format [host]:port user:password matching exactly what’s in relayhost (Postfix matches the entry by hostname first, so the brackets and port must agree). Then lock the file down and compile it to a hash database:

sudo nano /etc/postfix/sasl_passwd
# Add: [host]:port user:password   (per provider, see below)

sudo chmod 0600 /etc/postfix/sasl_passwd
sudo chown root:root /etc/postfix/sasl_passwd
sudo postmap /etc/postfix/sasl_passwd
sudo chmod 0600 /etc/postfix/sasl_passwd.db

The postmap command creates /etc/postfix/sasl_passwd.db, the actual file Postfix reads at runtime. Rerun postmap any time you edit the plaintext file. Now jump to the section for your provider.

SendGrid #

SendGrid uses a single SMTP hostname (smtp.sendgrid.net) regardless of region. Use port 587 with STARTTLS, or port 465 with implicit SSL. Generate an API key first: in the SendGrid dashboard, go to Settings → API Keys → Create API Key, give it “Mail Send” permission, and copy the key (it starts with SG. and is only shown once).

The SendGrid quirk worth knowing, and worth quoting verbatim because it surprises people: per the SendGrid SMTP docs, “Set your username to the string apikey.” The literal six-letter string apikey is your SMTP username, not your account email. The API key itself goes in the password field.

In main.cf, set relayhost = [smtp.sendgrid.net]:587. In /etc/postfix/sasl_passwd:

[smtp.sendgrid.net]:587 apikey:SG.your_actual_api_key_here

Mailgun #

Mailgun’s SMTP server lives at smtp.mailgun.org. Per Mailgun’s documentation, “Mailgun SMTP servers listen on ports 25, 465, 587, and 2525“. Port 587 with STARTTLS is the recommended choice, and port 465 requires TLS. Add and verify your sending domain in the Mailgun dashboard first (Sending → Domains → Add New Domain), then go to that domain’s SMTP credentials section to grab the username and password Mailgun generates for you.

Mailgun’s quirk: the SMTP username looks like postmaster@your-mailgun-domain (typically [email protected] after you verify your custom domain). The password is a Mailgun-generated string, not your dashboard login password.

In main.cf, set relayhost = [smtp.mailgun.org]:587. In /etc/postfix/sasl_passwd:

[smtp.mailgun.org]:587 [email protected]:your_mailgun_smtp_password

Amazon SES #

Amazon SES uses regional SMTP endpoints. Examples include email-smtp.us-east-1.amazonaws.com, email-smtp.us-west-2.amazonaws.com, and email-smtp.eu-west-1.amazonaws.com. The full canonical list lives in the AWS General Reference under “Amazon Simple Email Service endpoints and quotas”. Use the region closest to your server.

SES makes TLS unconditional at the protocol level: “The Amazon SES SMTP endpoint requires that all connections be encrypted using Transport Layer Security (TLS).” SendGrid and Mailgun also support TLS but don’t enforce it server-side the same way; in this guide we enforce it client-side via the smtp_tls_security_level = encrypt setting in the shared block, so all three providers behave identically from your Postfix server’s perspective. SES supports two TLS modes: port 587 with STARTTLS, or port 465 with TLS Wrapper (also called implicit TLS).

SES has two gotchas. First: SMTP credentials must be generated through the SES console specifically (Amazon SES → SMTP settings → “Create SMTP credentials”). The SES console creates a backing IAM user with the right SES SMTP policy and returns an SMTP-formatted username + password, you cannot use a regular IAM access key directly as the SMTP password. Second: new SES accounts start in sandbox mode, which restricts sending to verified recipient addresses only. You’ll need to request production access through the SES console before you can send to arbitrary recipients.

In main.cf, set relayhost = [email-smtp.us-east-1.amazonaws.com]:587 (substitute your region). In /etc/postfix/sasl_passwd:

[email-smtp.us-east-1.amazonaws.com]:587 AKIA_YOUR_SMTP_USERNAME:your_ses_smtp_password

The SMTP username SES generates looks similar to an IAM access key ID (starts with AKIA) but it’s a separate credential generated by the SES console, not your regular IAM key.

Next steps #

After editing main.cf + sasl_passwd + running postmap, reload Postfix to apply the new configuration:

sudo systemctl reload postfix

Send a test message using sendmail -t, which reads the From / To / Subject headers from the message body. Important: the From address MUST be a sender you have verified in your provider’s dashboard. SendGrid, Mailgun, and SES all reject messages from unverified senders.

sendmail -t <<EOF
From: [email protected]
To: [email protected]
Subject: Postfix relay test

Body of the test message.
EOF

# Then watch the mail log:
sudo journalctl -u postfix -f

A successful delivery produces a line containing status=sent with the SMTP response from your provider. To debug failed sends, search the log for entries pertaining to your provider’s hostname or for any line containing status=bounced / status=deferred. Per-provider common errors:

• SendGrid 401 Unauthorized: the SMTP username field has your account email instead of the literal string apikey. Fix the username, re-run postmap, reload Postfix.
• Mailgun 535 authentication failed: the SMTP username is your dashboard login email instead of [email protected], or the domain isn’t verified yet.
• SES “554 Message rejected: Email address is not verified”: your SES account is in sandbox mode. Verify the recipient (or request production access from the SES console).

If your messages reach Gmail or Microsoft inboxes but get bounced with a 5.7.26 authentication-checks error, the receiving end is rejecting your sending domain’s SPF or DKIM signature. See our companion guide on fixing the Gmail 550-5.7.26 bounce. If you’re configuring PHP applications on the same server to use this relay, follow up with our PHP mail() with Postfix guide. To inspect the local mail spool when debugging cron and root mail, see reading mail in Linux. For the wider Postfix maintenance picture, see our guide on automatic service restart with systemd, which applies the same approach to keeping the Postfix daemon up after a crash.