# Postfix smarthost

Use sendmail on your VPS and relay outbound email through Sendy with Postfix.

Keep using `sendmail` on your VPS. Configure Postfix to relay outbound email through Sendy, and your applications and scripts can keep submitting mail through the local `/usr/sbin/sendmail` interface. Configure Sendy’s SMTP credentials once in Postfix instead of adding them to each application.

Postfix queues local submissions and relays remote mail to Sendy over STARTTLS on port 2525. These steps use Debian and Ubuntu file paths and LMDB password maps. Your applications still need valid message headers and sender addresses on a verified domain.

## Before you begin

*   Verify a sending domain, create an [API key](https://usesendy.com/docs/authentication), and have available email credits in your Sendy account.
*   Use an installed Postfix server with root access, Cyrus SASL client mechanisms, LMDB lookup support, and a system CA bundle. On Debian and Ubuntu, the supporting packages are `libsasl2-modules`, `postfix-lmdb`, and `ca-certificates`. Allow outbound TCP connections on port 2525.

Confirm your Postfix build supports LMDB maps:

List supported lookup types · terminal

```
postconf -m
```

The output must include `lmdb`. Sendy also requires a verified domain for both the message’s `From` header and any nonempty envelope sender. Configure your applications to use a verified sender; unmodified system mail from `root@hostname` can be rejected.

1.  ## Configure the relay
    
    Set these parameters in `/etc/postfix/main.cf`, updating existing entries rather than adding duplicates:
    
    main.cf · Postfix SMTP client
    
    ```
    relayhost = [smtp.usesendy.com]:2525
    smtp_sasl_auth_enable = yes
    smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
    smtp_sasl_security_options = noplaintext, noanonymous
    smtp_sasl_tls_security_options = noanonymous
    smtp_tls_security_level = secure
    smtp_tls_secure_cert_match = nexthop
    smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
    smtp_tls_wrappermode = no
    ```
    
    The brackets suppress MX lookups. The `secure` TLS level requires encryption, a trusted certificate, and a hostname match against the configured relay. Keep wrapper mode off: Sendy uses STARTTLS, not implicit TLS on port 465.
    
    These are outbound `smtp_` options, not inbound `smtpd_` options. Existing transport maps or sender-dependent relay settings can override `relayhost`; review them if mail still bypasses Sendy.
    
2.  ## Store the SMTP credentials
    
    Create `/etc/postfix/sasl_passwd` with a privileged editor and add this entry:
    
    sasl\_passwd · credentials
    
    ```
    [smtp.usesendy.com]:2525 apikey:API_KEY
    ```
    
    Replace `API_KEY` with your full API key, including `snd_key_`. Keep `apikey` as the username. Match the brackets, hostname, and port in `relayhost` exactly.
    
3.  ## Build the protected password map
    
    Restrict the source file before building the LMDB map, then protect the generated file:
    
    Build the credential map · terminal
    
    ```
    sudo chown root:root /etc/postfix/sasl_passwd
    sudo chmod 0600 /etc/postfix/sasl_passwd
    sudo postmap lmdb:/etc/postfix/sasl_passwd
    sudo chown root:root /etc/postfix/sasl_passwd.lmdb
    sudo chmod 0600 /etc/postfix/sasl_passwd.lmdb
    ```
    
    Both files contain the API key. Rebuild the map after changing credentials. If you use a different supported map type, use it consistently in `smtp_sasl_password_maps` and `postmap`, and protect that type’s generated files.
    
4.  ## Check and reload Postfix
    
    Check the configuration before reloading the running server:
    
    Check configuration · terminal
    
    ```
    sudo postfix check
    ```
    
    If the check succeeds, apply the changes:
    
    Apply configuration · terminal
    
    ```
    sudo postfix reload
    ```
    
5.  ## Submit a test email
    
    Save this as `email.eml`. Replace the sender with an address on your verified domain and the recipient with an external test address:
    
    email.eml
    
    ```
    From: My App <noreply@example.com>
    To: recipient@example.com
    Subject: Welcome
    MIME-Version: 1.0
    Content-Type: text/html; charset=UTF-8
    Content-Transfer-Encoding: quoted-printable
    
    <h1>Welcome</h1><p>Your account is ready.</p>
    ```
    
    Submit it through Postfix. Replace the envelope sender with the same verified sender:
    
    Submit through Postfix · terminal
    
    ```
    /usr/sbin/sendmail -f noreply@example.com -t < email.eml
    ```
    

## Check the result

Open [Emails](https://usesendy.com/emails) to confirm Sendy queued the message and follow its delivery status. A successful local submission only confirms that Postfix accepted the email. Inspect its queue if the message has not reached Sendy:

Inspect the Postfix queue · terminal

```
postqueue -p
```

Check your mail log for the test message’s `relay` and `status` fields. The relay should be Sendy’s host on port 2525, and a successful handoff reports `status=sent` with Sendy’s `250 2.0.0 Queued jobs` response. This confirms queuing, not inbox delivery.

For authentication failures, check the map key, API key, and installed SASL mechanisms. For TLS failures, check the system CA bundle and hostname. See [SMTP errors](https://usesendy.com/docs/errors) for sender, credit, and size errors.

Configuration references: [Postfix client SASL authentication](https://www.postfix.org/SASL_README.html#client_sasl_enable), [Postfix client TLS](https://www.postfix.org/TLS_README.html#client_tls), and [the postmap manual](https://manpages.debian.org/trixie/postfix/postmap.1.en.html).