Building an SMTP Relay on AWS using Postfix

3 min readMay 19, 2026

In modern cloud architectures, applications still need a simple, dependable way to send email — whether for alerts, user notifications, or system events. While managed services exist, many teams prefer running a lightweight SMTP relay within their infrastructure for control, flexibility, and compliance.

This guide walks through configuring a production-ready SMTP server using a prebuilt AMI: Postfix SMTP Mail Server for Linux Platforms by Kurian.

Why Postfix on AWS?

Postfix remains one of the most trusted MTAs because it is:

Secure by default
Lightweight and fast
Easy to configure for relay use cases
Well-supported across Linux distributions

In AWS environments, Postfix is commonly used as:

An application mail relay
A smart host forwarding to corporate SMTP
A controlled outbound email gateway

Product Links

What the Kurian AMI Provides

Instead of manually installing and hardening Postfix, this AMI gives you:

Postfix preinstalled and configured
Latest OS patches applied
Standard Linux-native setup (no custom tooling)
Support across multiple distributions

👉 This allows you to focus on configuration, not installation.

Step 1 — Launch the Instance

From AWS Marketplace:

Open the product listing from https://aws.amazon.com/marketplace/pp/prodview-rjvyskrhlcd7c
Choose your preferred Linux distribution (Ubuntu, AlmaLinux, Amazon Linux, etc.)
Launch a small instance (t3.micro or t3.small is sufficient for most relay workloads)

Security Group Configuration

Allow:

TCP 22 — SSH
TCP 25 — SMTP (internal use)
Optional:
TCP 587 — submission
TCP 465 — SMTPS

Note: AWS restricts outbound port 25 by default. You may need to request removal or use a relay like SES.

Step 2 — Verify Postfix

SSH into the instance:

systemctl status postfix

Expected output:

Active: active (running)

Step 3 — Basic Configuration

Edit:

sudo vi /etc/postfix/main.cf

Minimal relay configuration:

myhostname = smtp.yourdomain.com
myorigin = /etc/mailname
inet_interfaces = all
inet_protocols = ipv4

mydestination =
relayhost = [smtp.yourcompany.com]:587smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymoussmtp_use_tls = yes
smtp_tls_security_level = encrypt

Step 4 — Configure Authentication

sudo vi /etc/postfix/sasl_passwd

[smtp.yourcompany.com]:587 username:password

Apply:

sudo chmod 600 /etc/postfix/sasl_passwd
sudo postmap /etc/postfix/sasl_passwd

Step 5 — Restart and Test

sudo systemctl restart postfix

Send test email:

echo "Test email" | mail -s "SMTP Test" you@example.com

Check logs:

tail -f /var/log/maillog

or (Ubuntu):

tail -f /var/log/syslog

Step 6 — Production Hardening

Restrict relay

mynetworks = 127.0.0.0/8 [your VPC CIDR]

Prevent open relay

smtpd_recipient_restrictions =
    permit_mynetworks,
    reject_unauth_destination

Enable TLS

smtpd_tls_cert_file=/etc/ssl/certs/your.crt
smtpd_tls_key_file=/etc/ssl/private/your.key

Common Deployment Patterns

Application Relay

Apps → Postfix → SES / Corporate SMTP

Central Mail Hub

Multiple services → Postfix → outbound relay

Hybrid Enterprise

Cloud workloads → Postfix → on-prem Exchange

Final Thoughts

Running your own SMTP relay in AWS doesn’t have to be complex. With a properly prepared AMI, you eliminate setup overhead and move directly to integration and tuning.

The Postfix SMTP Mail Server AMI by Kurian provides a clean, standards-based foundation — ideal for teams that want control without unnecessary complexity.

Next Steps

Integrate with AWS SES for better deliverability
Add monitoring (CloudWatch, Datadog)
Automate provisioning via Ansible or Terraform
Apply hardened configurations for compliance

A well-configured SMTP relay remains one of the most reliable building blocks in cloud infrastructure — simple, predictable, and highly effective when implemented correctly.