LPIC-2 E-Mail Services: Postfix and Dovecot

Delivering email is two separate jobs, and Linux splits them across two daemons. Mixing them up is the root cause of most "my mail server is broken" tickets, so get the map straight first.

Postfix is the MTA (Mail Transfer Agent). Its job is to move messages between servers over SMTP — accepting mail addressed to your domain and handing your users' outbound mail onward to the internet.

Dovecot is the MDA / mailbox server. It does local delivery (writing an accepted message into a user's mailbox) and then serves that mailbox back to mail clients over IMAP and POP3 so people can read it.

Think of a town's postal system. Postfix is the sorting office: trucks (SMTP) arrive and leave, letters get routed toward the right neighbourhood. Dovecot is the part that drops the letter into your mailbox and lets you open it (IMAP) to read what's inside. A letter that reaches the sorting office but never lands in a mailbox you can open has gone exactly nowhere useful — which is why these two have to cooperate.

Postfix's behaviour lives in /etc/postfix/main.cf. Before it can accept or route a single message it has to know who it is and what it is responsible for. Three parameters answer that:

• myhostname — this server's fully-qualified name, e.g. mail.example.com.
• mydestination — the list of domains for which this box is the final destination (mail for these is delivered locally, not relayed onward).
• mynetworks — the IP ranges Postfix trusts to relay through it without authenticating. This is a security control, covered in depth in the next step.

You can edit main.cf by hand, but the safe, scriptable, exam-preferred way is postconf -e ("edit"). It rewrites the parameter in place, preserving formatting and avoiding the classic duplicate-key mistake.

Outbound mail is the other half of identity. By default Postfix tries to deliver directly to each recipient's MX server. On many networks that's blocked (residential IPs, port-25 egress filtering), so you point Postfix at a smarthost with relayhost — an upstream mail server that accepts your outbound mail and forwards it for you.

An open relay is a mail server that will accept mail from anyone and forward it to anyone — no authentication required. Spammers hunt for these constantly, because relaying through your server hides their origin and burns your IP reputation instead of theirs. Within hours of going open, your domain lands on blocklists and your legitimate mail stops being delivered anywhere.

The single parameter that most often causes this is mynetworks. It lists the client IP ranges Postfix trusts to relay outbound mail without logging in. Set it too wide and you've handed the keys to the internet.

Postfix reads several lookup tables — /etc/aliases (forwarding rules like postmaster: root), plus optional maps such as transport and access. For speed, Postfix doesn't read these text files at delivery time; it reads a compiled binary built from them. So editing the text file alone changes nothing until you rebuild that binary.

This is the most common "I changed it and nothing happened" trap in the whole topic. Two commands rebuild the two kinds of table.

Once Postfix has accepted a message, Dovecot takes over: it stores the mail and serves it back to clients over IMAP (keeps mail on the server, syncs across devices) and POP3 (typically downloads and removes). Two storage formats exist, and the choice matters:

• mbox — one big file per mailbox, every message concatenated together. Simple, but the whole file is locked during writes, so concurrent delivery and reading collide and it scales poorly.
• Maildir — one file per message inside new/, cur/, and tmp/ directories. No global lock, safe for concurrent access, and a corrupted message can't take the whole mailbox down with it.

Prefer Maildir. It's the modern default for exactly these reliability reasons.

Here is the failure that wastes the most hours, because nothing errors out. Postfix delivers a message to its idea of the mailbox; Dovecot serves the client from its idea of the mailbox. If those two locations (or formats) differ, the mail is written successfully and then never appears in the client — it looks like messages are vanishing into thin air.

Concretely: if Postfix delivers to mbox at /var/mail/$USER while Dovecot reads Maildir at ~/Maildir, every message lands in a place Dovecot never looks. No bounce, no log error on the read side — just an empty inbox.

The fix is to make them agree: same format (Maildir) at the same path.

You have a real root shell to your right. These commands are read-only inspection — they change nothing. A mail server may or may not be installed on this box; that's fine. The goal is to practise the moves you'd use to audit any mail host: confirm Postfix's identity, check its relay trust, and see which mail ports are actually listening.