Configure a Postfix domain without opening relay access

Postfix moves mail; it does not supply an IMAP mailbox service. Start with a supported distribution package on a dedicated test host and decide whether this instance is a final destination, a relay, or an application submission host.

Set identity and destination policy

1. Follow the basic configuration guide for main.cf syntax and distribution paths.
2. Set myhostname to the actual mail hostname. Review mydomain and myorigin rather than assuming the operating-system hostname is the intended sender domain.
3. Put only final local domains in mydestination. Virtual mailbox domains and relay destinations use different configuration; do not add the same domain everywhere.
4. Keep mynetworks narrow and review relay restrictions before exposing SMTP. A broad cloud subnet is not a trusted application network.

Inspect configuration without submitting mail:

postconf -n

Review output privately because local settings can disclose infrastructure details. Use the package’s configuration validation and reload procedure after approved changes.

Verify acceptance boundaries

With controlled addresses, test an intended local recipient, an unknown recipient, and an unauthenticated remote-to-remote relay attempt. The last must be rejected. A listening port or valid MX record is not proof that destination policy is correct.

Keep production MX unchanged until local delivery and rollback are understood. If users need inbox access, configure a mailbox service and its delivery handoff separately; do not describe Postfix as a parsed-webhook API or full mailbox suite.