From 1b3eded34ae693b8662487b9c54a21e4fec1b07f Mon Sep 17 00:00:00 2001 From: yyamashita Date: Mon, 1 Jun 2026 21:42:57 +0900 Subject: Configure Amazon SES relay for Postfix (port 25 blocked by Hetzner) SES credentials are injected via .env file (not committed). entrypoint.sh creates sasl_passwd at runtime from SES_ACCESS_KEY_ID / SES_SMTP_PASSWORD. Co-Authored-By: Claude Sonnet 4.6 --- mail/postfix/main.cf | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'mail/postfix') diff --git a/mail/postfix/main.cf b/mail/postfix/main.cf index 36d0e35..4066839 100644 --- a/mail/postfix/main.cf +++ b/mail/postfix/main.cf @@ -19,8 +19,12 @@ local_transport = error:local delivery disabled smtpd_relay_restrictions = permit_mynetworks, reject smtpd_recipient_restrictions = permit_mynetworks, reject -# Opportunistic TLS on outbound SMTP -smtp_tls_security_level = may +# Relay via Amazon SES (port 25 outbound is blocked by Hetzner) +relayhost = [email-smtp.us-east-1.amazonaws.com]:587 +smtp_sasl_auth_enable = yes +smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd +smtp_sasl_security_options = noanonymous +smtp_tls_security_level = encrypt smtp_tls_loglevel = 1 # DKIM signing via OpenDKIM milter on localhost:8891 -- cgit v1.2.3