Sendy
Sign inSign up

Postfix smarthost

Use sendmail on your VPS and relay outbound email through Sendy with Postfix.

Keep using sendmail on your VPS. Configure Postfix to relay outbound email through Sendy, and your applications and scripts can keep submitting mail through the local /usr/sbin/sendmail interface. Configure Sendy’s SMTP credentials once in Postfix instead of adding them to each application.

Postfix queues local submissions and relays remote mail to Sendy over STARTTLS on port 2525. These steps use Debian and Ubuntu file paths and LMDB password maps. Your applications still need valid message headers and sender addresses on a verified domain.

Before you begin

  • Verify a sending domain, create an API key, and have available email credits in your Sendy account.
  • Use an installed Postfix server with root access, Cyrus SASL client mechanisms, LMDB lookup support, and a system CA bundle. On Debian and Ubuntu, the supporting packages are libsasl2-modules, postfix-lmdb, and ca-certificates. Allow outbound TCP connections on port 2525.

Confirm your Postfix build supports LMDB maps:

List supported lookup types · terminal
postconf -m

The output must include lmdb. Sendy also requires a verified domain for both the message’s From header and any nonempty envelope sender. Configure your applications to use a verified sender; unmodified system mail from root@hostname can be rejected.

  1. Configure the relay

    Set these parameters in /etc/postfix/main.cf, updating existing entries rather than adding duplicates:

    main.cf · Postfix SMTP client
    relayhost = [smtp.sendy.stanleymasinde.com]:2525
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noplaintext, noanonymous
smtp_sasl_tls_security_options = noanonymous
smtp_tls_security_level = secure
smtp_tls_secure_cert_match = nexthop
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_wrappermode = no

    The brackets suppress MX lookups. The secure TLS level requires encryption, a trusted certificate, and a hostname match against the configured relay. Keep wrapper mode off: Sendy uses STARTTLS, not implicit TLS on port 465.

    These are outbound smtp_ options, not inbound smtpd_ options. Existing transport maps or sender-dependent relay settings can override relayhost; review them if mail still bypasses Sendy.

  2. Store the SMTP credentials

    Create /etc/postfix/sasl_passwd with a privileged editor and add this entry:

    sasl_passwd · credentials
    [smtp.sendy.stanleymasinde.com]:2525 apikey:API_KEY

    Replace API_KEY with your full API key, including snd_key_. Keep apikey as the username. Match the brackets, hostname, and port in relayhost exactly.

  3. Build the protected password map

    Restrict the source file before building the LMDB map, then protect the generated file:

    Build the credential map · terminal
    sudo chown root:root /etc/postfix/sasl_passwd
sudo chmod 0600 /etc/postfix/sasl_passwd
sudo postmap lmdb:/etc/postfix/sasl_passwd
sudo chown root:root /etc/postfix/sasl_passwd.lmdb
sudo chmod 0600 /etc/postfix/sasl_passwd.lmdb

    Both files contain the API key. Rebuild the map after changing credentials. If you use a different supported map type, use it consistently in smtp_sasl_password_maps and postmap, and protect that type’s generated files.

  4. Check and reload Postfix

    Check the configuration before reloading the running server:

    Check configuration · terminal
    sudo postfix check

    If the check succeeds, apply the changes:

    Apply configuration · terminal
    sudo postfix reload

  5. Submit a test email

    Save this as email.eml. Replace the sender with an address on your verified domain and the recipient with an external test address:

    email.eml
    From: My App <[email protected]>
To: [email protected]
Subject: Welcome
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<h1>Welcome</h1><p>Your account is ready.</p>

    Submit it through Postfix. Replace the envelope sender with the same verified sender:

    Submit through Postfix · terminal
    /usr/sbin/sendmail -f [email protected] -t < email.eml

Check the result

Open Emails to confirm Sendy queued the message and follow its delivery status. A successful local submission only confirms that Postfix accepted the email. Inspect its queue if the message has not reached Sendy:

Inspect the Postfix queue · terminal
postqueue -p

Check your mail log for the test message’s relay and status fields. The relay should be Sendy’s host on port 2525, and a successful handoff reports status=sent with Sendy’s 250 2.0.0 Queued jobs response. This confirms queuing, not inbox delivery.

For authentication failures, check the map key, API key, and installed SASL mechanisms. For TLS failures, check the system CA bundle and hostname. See SMTP errors for sender, credit, and size errors.

Configuration references: Postfix client SASL authentication, Postfix client TLS, and the postmap manual.