Every few years someone writes Postfix’s obituary, and every year Postfix keeps quietly delivering a ridiculous share of the world’s email. I still run it, and I still recommend it for a specific kind of person: the one who wants to understand every moving part. But the ground has shifted underneath it in the last few years, and old tutorials will steer you straight into the junk folder. Here is the current reality.
The core stack, unchanged
The classic trio still applies: Postfix for SMTP, Dovecot for IMAP and local delivery, and something for content filtering. Postfix’s main.cf essentials have not changed: myhostname and mydestination set your identity, mynetworks defines who can relay (keep it tight), smtpd_tls security levels govern encryption, and virtual mailbox domains handle multiple domains cleanly. If you have never configured it, expect a weekend of reading — the documentation is excellent but not skim-friendly.
What receivers demand now that they did not in 2015
The big mailbox providers tightened everything. TLS is assumed, not bonus. SPF, DKIM, and DMARC are effectively mandatory; unsigned mail from an unknown IP barely gets considered. IPv6 matters: your IPv6 record reputation is evaluated independently, and a misconfigured IPv6 path can poison delivery even when IPv4 is clean. And DMARC reports are how you discover that half the internet is forwarding your mail in ways that break alignment. Start at p=none, read the aggregate reports, then enforce. Our guide to the three records walks through it without the acronym soup.
The parts worth bolting on
Three add-ons carry their weight in the modern stack:
- OpenDKIM — signs outgoing mail. Non-negotiable.
- Rspamd — modern filtering for both directions, far smarter than the greylisting-and-prayer approach. It speaks milter, so Postfix integration is a few lines.
- Postscreen — Postfix’s built-in front-door filter that weeds out the dumbest bots before they cost you anything.
For certificate renewal, whatever you do, automate it. Expired TLS on a mail host produces error cascades that look like everything except their cause.
What will actually burn you
In order of likelihood: port 25 blocked by your provider, reverse DNS forgotten, sending application mail from your marketing domain, a compromised contact form turning your server into a spam cannon, and — the slow burn — reputation decay from a cold IP that you resumed sending from at full volume. Every one of these is preventable with a checklist and monitoring, and none of them announces itself politely. Monitor your queues (mailq is your friend), watch bounces daily, and set up DMARC reporting from day one.
When to not run Postfix at all
If the email you care about is transactional — receipts, resets, notifications from an application — do not hand-roll this. The receivers’ wall is high and getting higher, and a dedicated API provider absorbs it for you. Our four-platform field test shows how little setup the good ones require now. Self-host when you want sovereignty, learning, or a personal mailbox you control; use a provider when email is a feature with a deadline.
If you do want your own server but Postfix’s assembly tax puts you off, read our Stalwart walkthrough — a single-binary modern alternative that handles what used to take four daemons.
Where to start
Get a VPS with port 25 open, set PTR, install Postfix and Dovecot from your distro, sign with OpenDKIM, publish your three DNS records, and send yourself mail at Gmail — then read the “show original” headers like a detective. Every problem you will ever have is visible in headers if you learn to read them once.