How to Install and Configure a Secure Postfix and Dovecot Mail Server on Linux

Introduction

Email remains one of the most important communication channels for businesses and organizations. Running your own mail server provides complete control over email delivery, user management, security policies, and data privacy.

Two of the most widely used open-source components for building a mail platform are:

• Postfix – A fast, secure, and reliable Mail Transfer Agent (MTA) responsible for sending and receiving email.
• Dovecot – A powerful IMAP and POP3 server that provides mailbox access and user authentication.

Together, Postfix and Dovecot create a complete email hosting solution capable of serving multiple domains and users securely.

This guide walks through the installation and configuration of Postfix and Dovecot on a modern Linux server running Oracle Linux 9, Rocky Linux 9, AlmaLinux 9, or RHEL 9.

Prerequisites

Before starting, ensure the following requirements are met:

• Root or sudo access to the server
• A registered domain name
• Proper DNS records configured:
  • A record
  • MX record
  • PTR (Reverse DNS) record
• A public IP address
• Firewall access
• Internet connectivity

Recommended hostname:

mail.example.com

Mail Flow Overview

The architecture used in this guide is:

Internet
   │
   ▼
Postfix (SMTP)
   │
   ▼
Maildir Storage
   │
   ▼
Dovecot (IMAP/POP3)
   │
   ▼
Mail Clients

Step 1 – Install Postfix and Dovecot

Update the operating system:

sudo dnf update -y

Install Postfix and Dovecot:

sudo dnf install postfix dovecot -y

Enable services:

sudo systemctl enable postfix
sudo systemctl enable dovecot

Start Postfix:

sudo systemctl start postfix

Verify:

sudo systemctl status postfix

Step 2 – Create a Dedicated Mail User

Create a system account to own mailbox files:

sudo useradd -r -s /sbin/nologin vmail

Verify the UID and GID:

id vmail

Example:

uid=5000(vmail) gid=5000(vmail)

Record these values for later use.

Step 3 – Create Mail Storage Directories

Create the virtual mailbox structure:

sudo mkdir -p /var/mail/vhosts

Assign ownership:

sudo chown -R vmail:vmail /var/mail/vhosts

Step 4 – Configure Postfix

Backup the existing configuration:

sudo cp /etc/postfix/main.cf /etc/postfix/main.cf.bak

Edit:

sudo vi /etc/postfix/main.cf

Add or modify:

myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain

inet_interfaces = all
inet_protocols = ipv4

mynetworks = 127.0.0.0/8

home_mailbox = Maildir/

virtual_mailbox_domains = /etc/postfix/virtual_domains
virtual_mailbox_base = /var/mail/vhosts
virtual_mailbox_maps = hash:/etc/postfix/vmailbox

virtual_uid_maps = static:5000
virtual_gid_maps = static:5000

virtual_alias_maps = hash:/etc/postfix/virtual

Replace the UID and GID values with those assigned to the vmail user.

Step 5 – Configure Virtual Domains

Create the domain list:

sudo vi /etc/postfix/virtual_domains

Example:

example.com
example.net

Step 6 – Configure Mailboxes

Create mailbox mappings:

sudo vi /etc/postfix/vmailbox

Example:

info@example.com example.com/info/
admin@example.com example.com/admin/

For a catch-all mailbox:

@example.com example.com/catchall/

Step 7 – Generate Postfix Lookup Databases

Generate Postfix hash tables:

sudo postmap /etc/postfix/vmailbox
sudo postmap /etc/postfix/virtual

Whenever these files are updated, rerun the commands above.

Step 8 – Configure Dovecot

Edit:

sudo vi /etc/dovecot/dovecot.conf

Configure:

protocols = imap pop3
listen = *

Step 9 – Configure Mail Storage

Edit:

sudo vi /etc/dovecot/conf.d/10-mail.conf

Configure:

mail_location = maildir:/var/mail/vhosts/%d/%n

mail_uid = 5000
mail_gid = 5000

Step 10 – Configure Authentication

Edit:

sudo vi /etc/dovecot/conf.d/10-auth.conf

Recommended settings:

disable_plaintext_auth = yes
auth_mechanisms = plain login

Enable password-file authentication:

!include auth-passwdfile.conf.ext

Step 11 – Create Mail Users

Generate a password hash:

doveadm pw -s SHA512-CRYPT

Create the user database:

sudo vi /etc/dovecot/users

Example:

info@example.com:{SHA512-CRYPT}$6$hashedpassword::::::

Set permissions:

sudo chmod 600 /etc/dovecot/users

Step 12 – Configure Dovecot Authentication Socket

Edit:

sudo vi /etc/dovecot/conf.d/10-master.conf

Add:

service auth {

  unix_listener /var/spool/postfix/private/auth {
      mode = 0660
      user = postfix
      group = postfix
  }

}

This allows Postfix to authenticate users through Dovecot.

Step 13 – Configure TLS Encryption

Install Certbot:

sudo dnf install certbot -y

Generate a Let’s Encrypt certificate:

sudo certbot certonly --standalone \
-d mail.example.com

Certificates are stored in:

/etc/letsencrypt/live/mail.example.com/

Step 14 – Configure Postfix TLS

Edit:

sudo vi /etc/postfix/main.cf

Add:

smtpd_tls_security_level = may

smtpd_tls_cert_file =
/etc/letsencrypt/live/mail.example.com/fullchain.pem

smtpd_tls_key_file =
/etc/letsencrypt/live/mail.example.com/privkey.pem

smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth

Step 15 – Enable Submission and SMTPS

Edit:

sudo vi /etc/postfix/master.cf

Enable:

submission inet n - n - - smtpd

smtps inet n - n - - smtpd

Restart Postfix:

sudo systemctl restart postfix

Step 16 – Configure Dovecot SSL

Edit:

sudo vi /etc/dovecot/conf.d/10-ssl.conf

Configure:

ssl = required

ssl_cert =
</etc/letsencrypt/live/mail.example.com/fullchain.pem

ssl_key =
</etc/letsencrypt/live/mail.example.com/privkey.pem

Restart Dovecot:

sudo systemctl restart dovecot

Step 17 – Open Firewall Ports

Allow mail-related services:

sudo firewall-cmd --permanent --add-service=smtp
sudo firewall-cmd --permanent --add-service=submission
sudo firewall-cmd --permanent --add-service=imap
sudo firewall-cmd --permanent --add-service=imaps
sudo firewall-cmd --permanent --add-service=pop3
sudo firewall-cmd --permanent --add-service=pop3s

sudo firewall-cmd --reload

Step 18 – Verify Services

Check Postfix:

sudo postfix check
sudo systemctl status postfix

Check Dovecot:

sudo dovecot -n
sudo systemctl status dovecot

Verify listening ports:

ss -tulpn

Expected ports:

Service	Port
SMTP	25
SMTPS	465
Submission	587
POP3	110
POP3S	995
IMAP	143
IMAPS	993

Recommended DNS Records

To improve deliverability, configure:

SPF

TXT  "v=spf1 mx ip4:YOUR_SERVER_IP -all"

DKIM

Use OpenDKIM to sign outgoing messages.

DMARC

TXT "v=DMARC1; p=quarantine;"

These records help prevent spoofing and improve inbox placement.

Testing the Mail Server

After configuration:

1. Send a test email from Gmail or Outlook.
2. Verify message delivery.
3. Configure a mail client using IMAP.
4. Test SMTP authentication.
5. Validate TLS encryption.

Useful logs:

/var/log/maillog
journalctl -u postfix
journalctl -u dovecot

Troubleshooting

Verify Postfix

postfix check

Verify Dovecot

dovecot -n

Check Listening Ports

ss -tulpn

Monitor Logs

tail -f /var/log/maillog

Conclusion

Postfix and Dovecot provide a reliable and secure foundation for self-hosted email services. By combining Postfix for SMTP delivery and Dovecot for mailbox access, administrators can host email for multiple domains while maintaining complete control over security, privacy, and infrastructure.

For production environments, consider adding OpenDKIM, OpenDMARC, spam filtering, malware scanning, automated backups, monitoring, and high-availability configurations to further strengthen your mail platform.

Frequently Asked Questions (FAQ)

1. Why should I use Postfix instead of Sendmail?

Postfix was designed as a secure and high-performance alternative to Sendmail. It offers easier configuration, better security architecture, improved reliability, and lower maintenance overhead, making it the preferred choice for most Linux mail server deployments.

2. What is the role of Dovecot in a mail server?

Postfix handles the sending and receiving of email via SMTP, while Dovecot provides IMAP and POP3 services that allow users to access and manage their mailboxes from email clients such as Outlook, Thunderbird, Apple Mail, and mobile devices.

3. Can I host multiple domains on a single server?

Yes. Postfix supports virtual domains, allowing a single server to host email services for multiple domains. Each domain can have its own users, aliases, and mailbox structure.

Related Articles

1. Remove an Email Account from the cPanel Backend
   Remove an Email Account from the cPanel Backend
2. Enable or Disable Webmail Applications for cPanel Users
   Enable or Disable Webmail Applications for cPanel Users
3. Monitor Logged-In Mail Users with a Shell Script
   Monitor Logged-In Mail Users with a Shell Script