Mail Server: Postfix

A colleague says the mail transfer agent is the whole email server and drops mail into users' inboxes. Where is that wrong, and what actually does the local delivery?

In mail-server terminology, what do MUA, MDA, MTA, and SASL each stand for, and which one is the client program the user actually sees?

A user wants their mail to stay in sync across a laptop, phone, and tablet. Between POP and IMAP, which fits, and what is the core difference that decides it?

You are configuring a mail client and must pick the right port. Which port is for server-to-server SMTP, and which is the submission port that clients should use to send mail?

When storing incoming mail, what is the practical difference between mbox and maildir format, and which one is recommended alongside an IMAP server?

You add an entry to /etc/aliases to redirect root's local mail to your own account, but nothing changes. What step was missed?

Trace the path of an email from the moment a sender clicks Send in their client to the moment the recipient reads it. Which protocol and which program handle each hop?

STARTTLS is described as encrypting a mail connection. At what moment does encryption begin, and what does it deliberately not protect?

Why is a mail server whose relaying is left open the worst configuration mistake you can make, and what is the lasting consequence?

Which DNS record type routes email for a domain, why isn't it an ordinary A record, and what does its priority number decide?

For a mail domain you see CNAME entries like imap, smtp, and pop pointing at the mail host. Are these required for mail to work, and what are they actually for?

To find and resolve a domain's mail servers you run host, but the book warns not to do it on the mail server itself. Which commands do you use, and why run them elsewhere?

Your mail sends fine but recipients keep flagging it as spam. Reverse DNS is mentioned as a defense — what does a PTR entry do and how does its absence hurt you?

You add the reverse DNS entry for your mail server on your domain's DNS control panel, but it never resolves. Why, and where does the PTR entry actually belong?

During a Debian/Ubuntu Postfix install a dialog asks for a configuration type. Which option do you pick for a server that sends and receives mail directly over SMTP?

With a fresh Internet Site install, which accounts can receive mail by default, and what happens when mail arrives for a name that doesn't exist?

On RHEL Postfix is already installed and running, yet external mail never arrives. What is the default limitation, and which main.cf setting lifts it?

On a RHEL mail server, which firewall ports must be reachable, and what firewall-cmd commands open them?

Postfix lookup tables are written as option=type:name with the common type hash. What does a hash table actually read at runtime, and how is that file produced?

In main.cf, what do myhostname, myorigin, mydestination, and relayhost each control, and what value should relayhost have on a standalone server?

On a standalone root server, what must mynetworks contain, and what goes wrong if you make it less restrictive?

You want to see only the Postfix settings you have changed from the defaults, not the whole configuration. Which postconf variant does that, and how do the three variants differ?

Instead of editing main.cf in an editor and reloading, you use postconf -e option=value. What does it do to the file and to Postfix, and what typo silently breaks it?

You're about to change a live mail server's config and worry a mistake will bounce and lose incoming mail. Which setting protects you, and what does it change about error handling?

To let mail clients submit on port 587, which config file do you edit (not the usual one), and what two guarantees does the submission block enforce?

Mail seems stuck and isn't being delivered. Which commands list the queued messages and force an immediate retry, and where does Postfix log its activity?

On a distribution that logs mail through the systemd journal, how do you read just the Postfix messages versus just the Dovecot messages?

In Postfix TLS configuration, what is the difference between the smtpd_ and smtp_ parameter groups, and which one needs your custom certificate?

For receiving mail, what is the practical difference between smtpd_tls_security_level = may and = encrypt, and what does each cost you?

When sending mail, your log shows Untrusted TLS connection. Was the mail encrypted, and which setting turns it into Trusted?

Self-signed certificates are a no-go on public web servers, yet they're considered acceptable on mail servers. What makes the situation different for mail?

On RHEL you generate a self-signed certificate for Postfix that should cover all mail subdomains at once. What must the Common Name look like, and what permission fix is mandatory?

Using a Let's Encrypt certificate for Postfix, which of the issued files must smtpd_tls_cert_file point to, and what must you do after each renewal?

With default Postfix, how much setup does an ordinary Linux user need to become a mail user, and what password do they authenticate with — unlike Samba?

You set home_mailbox in main.cf but Postfix keeps writing mbox instead of maildir. What single character selects the maildir format?

What is a mail alias in /etc/aliases able to forward mail to besides another local account, and what must you run after editing it?

In main.cf you see both alias_database and alias_maps pointing at /etc/aliases. What is the crucial difference between the two parameters?

You want to stop system accounts like daemon or man from receiving mail. Which parameter restricts valid recipients, and what are the steps to apply a custom list?

After editing a mapping file you must rerun postmap, but doing so on a live server risks corrupt lookups. Why, and what is the safe update pattern?

You need addresses like Herbert.Hoover@a-company.com, but Linux usernames can't be that long or contain dots. How do you make it work end to end?

In Postfix terminology, what makes a domain virtual, and what is the simplest way to have one Postfix server host an additional domain?

You host two domains and want hoover@a-company.com and hoover@another-company.com to be different people. Why won't mydestination do it, and what mechanism will?

Virtual mailboxes let Postfix store mail for addresses with no matching Linux account. Who owns those mailbox files, and which parameters configure the setup?

The book warns that virtual mailboxes only pay off under one condition. What is it, and what extra work do they otherwise add?

The SMTP VRFY command checks whether an address exists. Why is that a liability, and how do you turn it off in Postfix?

SMTP authentication seems broken and you want to see what your Postfix server actually offers a connecting client. Which old tool helps, and what in the reply confirms TLS and auth support?

Why is it a serious security mistake to give a sudo-privileged admin account a mail account, even though it's convenient?

You create a Linux account purely to receive mail, no interactive login allowed. What shell do you set, and why does the account still need a real password?

In this book's mail stack Postfix is the SMTP server, so what is Dovecot doing besides serving IMAP — and why does authentication depend on it rather than Postfix?

Postfix stores received mail into local mailboxes without you installing a separate delivery program. Which component does that, and where do Procmail and Maildrop still fit in?

A message can't be delivered right now because the receiving server is down. Does the sending MTA drop it immediately, and what does the sender eventually see if it never gets through?

Open relaying is a disaster, yet the book calls relaying legitimate in one design. When is passing mail through intermediate MTAs actually the point rather than a mistake?

You open the default RHEL main.cf and it's a wall of comments you can barely read. What is the book's one-liner to get a clean, editable version — and what must you do first?

You opened ports 25 and 587 with firewall-cmd on your cloud mail server, but external mail still can't reach it. What second firewall did you forget?

Reading a Postfix config you see option2 = $option1 and a setting that wraps onto a second indented line. What two syntax rules of the config files does this show?

Hosting thousands of mailboxes as hash files is unwieldy. What backend can Postfix read lookups from instead, and what does the referenced config file then actually contain?

On RHEL a fresh Postfix throws Relay access denied on legitimate local mail. Which main.cf line is the book's culprit, and what's the fix?

After editing Postfix config, when is systemctl reload postfix enough and when must you actually restart? Which single parameter forces the stronger action?

Your mail host shouldn't use IPv6 at all. Postfix is dual-stack by default — which parameter and value pins it to IPv4 only?

You already set smtpd_tls_security_level = may for incoming mail. What does the sibling smtp_tls_security_level = may govern, and what does switching it to encrypt cost you?

Why does Postfix on Debian/Ubuntu auto-copy CA certificates into /var/spool/postfix/etc/ssl/certs at startup, while RHEL needs no such copy?

TLS handshakes on a busy mail server are expensive. Which optional Postfix parameter cuts that cost, what does it cache, and where does it live?

On a fresh Debian/Ubuntu box Postfix already has a working TLS certificate you never created. What is that certificate, and why do clients warn about it?

Debian/Ubuntu Postfix already receives mail encrypted, but an older install may still send it in the clear. Which two main.cf settings guarantee Postfix also encrypts the mail it sends out?

For a Postfix mail server's TLS certificate, which side actually verifies it, what does it compare the certificate against, and does the MX entry play any role?

Thunderbird auto-derives the SMTP server name as smtp.<domain>. What does that imply for the name on your mail certificate, and why can you end up needing several certificates?

On Debian/Ubuntu, Postfix installs a 'snake-oil' certificate by default. What is it, what two shortcomings does it have, and how do you regenerate it after changing the host name?

You issue a Let's Encrypt certificate for Postfix with acme.sh. Which names must it cover, and what changes in the command if the mail server isn't also running a web server?

Let's Encrypt certificates renew about every 60 days. How do you make both Postfix and Dovecot automatically pick up the renewed certificate with no manual step?

You can restrict which TLS protocol versions and algorithms Postfix accepts to harden it. What's the trade-off, and what must happen for any TLS change to take effect?

What's the command to create a mail-only Linux account on Debian/Ubuntu that skips the full-name and contact prompts, and the RHEL equivalent?

You switch Postfix to maildir with home_mailbox = Maildir/, but delivery still misbehaves. Which leftover main.cf statement must you comment out?

You redirect a user's mail to an external address via an alias or .forward, but it often lands in spam or disappears. Why does indirect forwarding fail so often?

A local user has no access to /etc/aliases but wants their own incoming mail redirected elsewhere. What can they create to do it, without any admin help?

For Postfix virtual mailboxes, which main.cf parameters define the domains served, the storage directory, the address-to-file mapping, and the file ownership?

In a Postfix virtual mailbox map, each address points to a mailbox file under virtual_mailbox_base. What single character on that filename switches virtual delivery from mbox to maildir?

Postfix 'supports SASL', yet it can't authenticate mail users on its own. What actually performs the authentication, and how does that show up in the config?

Sketch the shape of an SPF DNS record: which record type, what prefix, how you list senders, and the difference between ending in ~all vs -all?

OpenDKIM both signs outgoing mail and verifies incoming signatures. Which packages install it on Debian/Ubuntu vs RHEL, and what repo prep does RHEL need?

In /etc/opendkim.conf, what do Mode sv, the Socket line, and OversignHeaders From each accomplish?

On Debian/Ubuntu, your careful /etc/opendkim.conf settings can be silently overridden. What causes that, and what do you do about it?

On RHEL you try to run OpenDKIM on a custom port instead of 8891 and it's blocked. What's the cause, and which command authorizes another port?

In OpenDKIM, what's the division of labor between signing.table and key.table, and what does a date-like selector such as 202305 buy you?

Reading opendkim-genkey options: what do -b 2048, -r, and -s do, why avoid the default key size, and what dangerous thing happens with -s on existing files?

You run opendkim-genkey and get a name.txt file. When publishing that public key in DNS, which part becomes the record's Name/Hostname and which part becomes its value?

opendkim-testkey -vvv reports 'key not secure' on one run and 'record not found' on another. Which is harmless and which is a real problem?

To make Postfix sign outgoing mail with OpenDKIM you register it as a milter. What's the difference between smtpd_milters and non_smtpd_milters, and what does milter_default_action = accept protect against?

After configuring DNS and TLS for your mail server, which two external web services let you confirm the DNS/blacklist status and the TLS configuration?

Why can Mutt running on the Postfix host send mail with no login, while your phone must authenticate first?

Which main.cf parameters enable Dovecot-backed SMTP authentication in Postfix, and what's the Debian/Ubuntu gotcha about the auth socket path?

SPF, DKIM, and DMARC all publish something in DNS to keep your mail out of spam folders. What does each one declare, and which one depends on the other two?

On RHEL, mail delivery to root in maildir format fails with 'create maildir file: permission denied'. Why, and what must you do first?