4.1Configuring and Managing Postfix

Email works through a division of roles: sending (an MTA), receiving and delivering (an MDA), and retrieving (an MRA). Postfix fills the MTA role and is the most widely deployed mail transfer agent on Linux. Rather than memorizing settings, having a map of "which file decides what" is the shortcut for both real work and the exam.

4.1.1main.cf, master.cf, and aliases

• Config files live under /etc/postfix/. main.cf holds the daemon's runtime parameters (accepted domains, relay permissions, TLS settings, etc.) as one parameter per line. master.cf is a table defining which services (smtp, submission, pickup, ...) run as which processes.
• Redirect destinations via /etc/aliases (e.g., root: admin@example.com forwards mail addressed to root). After editing, you must run newaliases (or postalias) to rebuild the hashed database—without it, the change has no effect.
• Mail is not always delivered instantly—it passes through queues under /var/spool/postfix/ (incoming, active, deferred, hold, corrupt, etc.). Inspect or force-flush stuck mail with postqueue and postsuper.
• Runtime logs land under /var/log/ (often /var/log/maillog or /var/log/mail.log, or via journalctl on systemd-based systems), and are the first place to check for delivery or authentication failures.

4.1.2SMTP auth, TLS, and the protocol

• The SMTP protocol is a text-based command/response exchange (HELO/EHLO, MAIL FROM, RCPT TO, DATA, QUIT). Port 25 is typically used for server-to-server relay, while port 587 is commonly used for client submission.
• SMTP authentication (SASL) lets legitimate users submit mail while blocking open relay abuse: clients authenticate with a username and password during the SMTP session before being allowed to send.
• Encryption is handled with TLS. Authentication and TLS are typically combined so credentials are never sent in the clear.

The troubleshooting habit that pays off: check the queue and logs before doubting the configuration. If mail is not arriving, first check for backlog with postqueue -p (or mailq), then trace SMTP reply codes and delivery failure reasons in the mail log under /var/log/. Redirecting operational notices sent to root via /etc/aliases is common work, but forgetting to run newaliases afterward is a classic pitfall—the change silently has no effect. When enabling SMTP authentication, you set SASL-related parameters in main.cf (whether to require auth, which paths permit it) while master.cf provides the TLS-capable service entry (for example, a submission service listening on port 587)—keeping this two-file division of labor in mind makes the setup easier to reason about. Postfix is not the only choice on Linux: exim is a historically popular alternative MTA with a different configuration philosophy and file layout, but it shares the same role of speaking SMTP as an MTA.

4.1.3Section summary

• main.cf = parameters / master.cf = service definitions / aliases need newaliases / mail flows through a queue
• SMTP auth (SASL) + TLS lets legitimate users submit mail without sending plaintext passwords. exim is an alternative MTA