MTA - Mail Transfer Server 

Postfix is a free and open-source mail transfer agent (MTA) that routes and delivers electronic mail on a Linux system. It is estimated that around 26% of public mail servers on the internet run Postfix.

Prerequisites 

Database Server

MAS - Mail Access Server

Virus Scanner

Rspamd Spam Filter

DNS Resolver

Dehydrated ACME Client

Install Software 

$ sudo apt-get install postfix postfix-mysql

On Ubuntu server 20.04 (focal) the installed version is Postfix version 3.4.13, released on June 14, 2020.

Main Configuration 

Postfix uses a number of different configuration files, with the /etc/postfix/main.cf being the most important.

The documentation website has a page dedicated to main.cf which includes every possible configuration paramter.

The whole file, as presented below, is also provided for download at /server/config-files/etc/postfix/main-mta.cf here.

General Settings 

# General Mail Server Setttings
# ------------------------------------------------------------

# Disable backwards-compatibility safety net
compatibility_level = 2

# What is my domainname?
mydomain = example.net

# What is my hostname (FQDN)?
myhostname = mail.${mydomain}

# What domain name do I append to local sender addresses on outbound mail?
myorigin = charlotte.${mydomain}

# What characters in a recipient address separate users from extensions?
recipient_delimiter = +-

# Should I refuse mails with non-standard FROM or RCPT address formats?
strict_rfc821_envelopes = yes

# What trouble do I need to report to a human (postmaster)?
notify_classes = bounce, 2bounce, data, delay, resource, software

# After how long should I notify if mail-delivery is delayed?
delay_warning_time = 6h
confirm_delay_cleared = yes

# Do I need to notify local users of new mail?
biff = no

# What is the maximum message size (in bytes)?
# 25 Mebibytes = 26,214,400 Bytes
message_size_limit = 26214400

# Whats the size limit of mailboxes (in bytes)?
# 15 Gibibytes = 16,106,127,360 Bytes
mailbox_size_limit = 16106127360


# ------------------------------------------------------------

Trusted networks 

# Trusted (allowed to relay) Networks Maps
# ------------------------------------------------------------

# Which clients do I trust and will relay mail to other domains?
mynetworks = cidr:${config_directory}/mynetworks.cidr


# ------------------------------------------------------------

Local and Virtual Mailboxes and Aliases Maps 

# Maps for Virtual (Local) Domains, Mailboxes and Aliases
# ------------------------------------------------------------

# How can I lookup virtual mail-domains hosted here?
virtual_mailbox_domains = mysql:${config_directory}/sql/virtual-domains.cf

# How do I lookup individual mailbox addresses of virtual mail-domains?
virtual_mailbox_maps = mysql:${config_directory}/sql/virtual-mailboxes.cf

# Where do I forward messages to root, postmaster or webmaster?
alias_maps = $alias_database

# How do I lookup aliases of virtual domain mailbox addresses?
virtual_alias_maps =

    # Lookup table to foward local mail to virtual mailboxes
    hash:${config_directory}/virtual

    # MySQL query to lookup aliases in hosted domains
    mysql:${config_directory}/sql/virtual-aliases.cf


# ------------------------------------------------------------

Relayed and Outgoing Mail Transport Maps 

# Relayed and Outgoing Mail Transport Maps
# ------------------------------------------------------------

# Since our outgoing SMTP servers are also our MX hosts, postfix can look at
# our onw MX records in DNS to find out which servers to use for outgoing mail.
default_transport = smtp:exmaple.net

# Deliver all local mail via LMTP to the Dovecot server
virtual_transport = lmtp:unix:private/dovecot-lmtp

# More specific transport mapping for individal addresses or doamins
transport_maps = hash:${config_directory}/transport


# ------------------------------------------------------------

TCP/IP Protocols Settings 

# TCP/IP Protocols Settings
#
# Changes made here need a full server restart:
#     'sudo systemctl restart postfix.service'
# ------------------------------------------------------------

# On which interfaces / IP addresses do I listen for inbound connections?
inet_interfaces =

    # Localhost
    127.0.0.1, ::1,

    # Private local LAN IPv4 address
    172.27.88.40,

    # Public global IPv6 address
    2001:db8:3414:6b1d::40,

    # Private VPN addresses
    10.195.171.241,
    fdc1:d89e:b128:6a04::29ab

# Our Firewall/Gateway is doing NAT. What is my external IPv4 address?
proxy_interfaces = ipv4.home.example.net


# ------------------------------------------------------------

General TLS Settings 

# General TLS Settings
#
# Ciphers suites to use in different situations.
# Note: While using non-mandatory opportunistic encryption,
# its preferable to use bad encryption, then no encrpytion
# at all.
# ------------------------------------------------------------

# Generated 2020-12-13, Mozilla Guideline v5.6,
# Postfix 3.4.13, OpenSSL 1.1.1f, old configuration
# https://ssl-config.mozilla.org/
tls_low_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA

# Generated 2020-12-13, Mozilla Guideline v5.6,
# Postfix 3.4.13, OpenSSL 1.1.1f, intermediate configuration
# https://ssl-config.mozilla.org/
tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384

# What ciphers suites do I use when I am high?
# The Postfix built-in defaults are okay here.
#tls_high_cipherlist = aNULL:-aNULL:HIGH:@STRENGTH

# Should I enable server cipher preferences?
tls_preempt_cipherlist = yes

# What OpenSSL options do I enable or disable?
tls_ssl_options =
    NO_COMPRESSION
    NO_RENEGOTIATION
    NO_SESSION_RESUMPTION_ON_RENEGOTIATION


# ---------------------------------------------------------

SMTP TLS Client Settings 

# SMTP TLS Client Settings
# ---------------------------------------------------------

# What DNS lookup methods do I use for outgoing SMTP sessions?
smtp_dns_support_level = dnssec

# Which default TLS policy applies when connecting to other SMTP servers?
smtp_tls_security_level = dane-only

# Where do I lookup domain specific TLS policies when sending mail?
smtp_tls_policy_maps =
    mysql:${config_directory}/sql/tls-policy.cf
    socketmap:inet:127.0.0.1:8461:postfix

# Which ciphers I have to exclude for opportunistic TLS policies?
# (if smtp_tls_security_level is set to "may", "dane")
smtp_tls_exclude_ciphers = aNULL, eNULL, EXPORT, RC4, DES, SSLv2, MD5

# Which TLS protocols do I use for mandatory TLS policies?
# (if smtp_tls_security_level is set to "encrypt", "dane-only", "verify", "secure")
smtp_tls_mandatory_protocols = $smtp_tls_protocols, !TLSv1, !TLSv1.1

# Which cipher list do I use for mandatory TLS policies?
# (if smtp_tls_security_level is set to "encrypt", "dane-only", "verify", "secure")
smtp_tls_mandatory_ciphers = high

# Which ciphers I have to exclude for mandatory TLS policies?
# (if smtp_tls_security_level is set to "encrypt", "dane-only", "verify", "secure")
smtp_tls_mandatory_exclude_ciphers = ${smtp_tls_exclude_ciphers}, SHA1

# Where are CA files stored to verify TLS certificates?
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

# Where do I find trusted CA certificates to verify SMTP server certificates?
smtp_tls_CApath = /etc/ssl/certs

# Files containing TLS private keys, certificates and issueing intermediate CA
smtp_tls_chain_files =
     /etc/dehydrated/certs/postfix/keycertchain.pem
     /etc/dehydrated/certs/postfix-rsa/keycertchain.pem

# Where do I cache outgoing SMTP TLS sessions?
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# Should I make a note if I encounter servers who offer encryption?
smtp_tls_note_starttls_offer = yes

# How much of the outgoing TLS transactions should I log?
smtp_tls_loglevel = 1


# ---------------------------------------------------------

SMTPD TLS Server Settings 

# SMTPD TLS Server Settings
# ---------------------------------------------------------

# Is TLS encryption required for incoming connections?
# Possible values:
# 'none', 'may' or ''encrypt
smtpd_tls_security_level = encrypt

# Do I refuse password authentication over unencrypted connections?
smtpd_tls_auth_only = yes

# Which TLS protocols do I accept for opportunistic TLS policies?
# (if smtpd_tls_security_level is set to "may")
smtpd_tls_protocols = $smtp_tls_protocols

# Which ciphers I don't accept for opportunistic TLS policies?
# (if smtpd_tls_security_level is set to "may")
smtpd_tls_exclude_ciphers = $smtp_tls_exclude_ciphers

# Which TLS protocols do I use for mandatory TLS policies?
# (if smtpd_tls_security_level is set to "encrypt")
smtpd_tls_mandatory_protocols = $smtp_tls_mandatory_protocols

# Which cipher list do I accept for mandatory TLS policies?
# (if smtpd_tls_security_level is set to "encrypt")
smtpd_tls_mandatory_ciphers = $smtp_tls_mandatory_ciphers

# Which ciphers I don't accept for mandatory TLS policies?
# (if smtpd_tls_security_level is set to "encrypt")
smtpd_tls_mandatory_exclude_ciphers = $smtp_tls_mandatory_exclude_ciphers

# What security grade do I use for ephemeral elliptic-curve Diffie-Hellman
# (EECDH) key exchange?
smtpd_tls_eecdh_grade = ultra

# Where are CA files stored to verify TLS certificates?
smtpd_tls_CAfile = $smtp_tls_CAfile

# Where do I find trusted CA certificates to verify SMTP server certificates?
smtpd_tls_CApath = $smtp_tls_CApath

# Where do I get Diffie-Hellmann key-exchange (DHE) parameters from?
# (for perfect forward secrecy)
# https://github.com/internetstandards/dhe_groups
# not actually 1024 bits, this applies to all DHE >= 1024 bits
smtpd_tls_dh1024_param_file = /etc/ssl/dhe_groups/ffdhe4096.pem

# Files containing TLS private keys, certificates and issueing intermediate CA
smtpd_tls_chain_files = ${smtp_tls_chain_files}

# Where do I cache incoming SMTP TLS sessions?
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

# Should I ask connecting clients for their own certificate?
smtpd_tls_ask_ccert = yes

# Should I include protocol and cipher used in the "Received:" message headers?
smtpd_tls_received_header = yes

# How much of the incoming TLS transactions should I log?
smtpd_tls_loglevel = ${smtp_tls_loglevel}


# ---------------------------------------------------------

SMTPD Server User Authentication 

# SMTPD Submission Server SASL Authentication Settings
# ---------------------------------------------------------

# Which SASL implementation shoudl I use? (default: Cyrus)
smtpd_sasl_type = dovecot

# Where can I contact the Dovecot authentication server?
smtpd_sasl_path = private/auth

# Don't let in any strangers,
# Don't accept plaintext passowrds over unencrypted connections!
smtpd_sasl_security_options = noanonymous, noplaintext

# Don't let in any strangers over encrypted connections
smtpd_sasl_tls_security_options = noanonymous

# Do I refuse user authentication over unencrypted connections?
smtpd_tls_auth_only = yes

# Add the sender's login name to mail message headers.
smtpd_sasl_authenticated_header = yes


# ---------------------------------------------------------

SMTP Server Restrictions 

# SMTPD Server Restrictions
# ---------------------------------------------------------

# What restrictins apply to connecting clients?
smtpd_client_restrictions =
    permit_mynetworks
    permit_sasl_authenticated
    reject_unknown_client_hostname

# Are connecting clients required to greet me properly before anything else?
smtpd_helo_required = yes

# What restrictins apply to SMTP HELO greetings
smtpd_helo_restrictions =
    permit_mynetworks
    reject_invalid_helo_hostname
    reject_non_fqdn_helo_hostname
    reject_unknown_helo_hostname

# What restrictins apply to any mail sender address?
smtpd_sender_restrictions =
    permit_mynetworks
    #reject_non_fqdn_sender
    #reject_unknown_sender_domain
    reject_unlisted_sender
    warn_if_reject reject_unverified_sender

# What should I tell clients when their sender address verification fails?
unverified_sender_reject_reason = Sender address verification failed

# What restrictions apply to relayed mails?
smtpd_relay_restrictions =
    permit_mynetworks
    permit_sasl_authenticated
    reject_unauth_destination

# What restrictins apply to any mail recipient address?
smtpd_recipient_restrictions =
    permit_auth_destination
    reject_non_fqdn_recipient
    reject_unauth_destination
    reject_unknown_recipient_domain
    reject_unlisted_recipient
    reject_unverified_recipient

# What restrictins apply to mail content?
smtpd_data_restrictions = reject_unauth_pipelining


# ---------------------------------------------------------

Mail User Agent (MUA) Restrictions 

# Mail User Agent (MUA) Restrictions
# These will be applied Submission server in master.conf to
# override the SMTPD server retrictions above for
# authenticated submission clients only.
# ---------------------------------------------------------
mua_client_restrictions =
    permit_sasl_authenticated
    permit

mua_helo_restrictions =
    permit

mua_sender_restrictions =
    permit


# ---------------------------------------------------------

Spam Filters (Milters)

# Spam Filter (Milter) and DKIM Mail Message Signing
# ---------------------------------------------------------

# Milters to handle remote incomfing mail that arrives via smtpd(8)
# Note: UNIX Socket files are relative to '/var/spool/postfix'
smtpd_milters =
    unix:/var/spool/postfix/clamav/clamav-milter.ctl
    #unix:/var/spool/postfix/rspamd/rspamd_proxy.sock

# Milters to handle local mail that arrives via sendmail(1) command-line or
# qmqpd(8)
# Note: UNIX Socket files are relative to '/var/spool/postfix'
non_smtpd_milters =
    unix:/var/spool/postfix/clamav/clamav-milter.ctl
    #unix:/var/spool/postfix/rspamd/rspamd_proxy.sock

# Which macros do I have to send to the Rspamd milter?
milter_mail_macros =  i {mail_addr} {client_addr} {client_name} {auth_authen}

# Default action when a Milter (mail filter) application is unavailable.
milter_default_action = tempfail


# ------------------------------------------------------------
# SOFT BOUNCE - Set to while debugging delivery issues
# ------------------------------------------------------------
#
# The soft_bounce parameter provides a limited safety net for
# testing.  When soft_bounce is enabled, mail will remain queued that
# would otherwise bounce. This parameter disables locally-generated
# bounces, and prevents the SMTP server from rejecting mail permanently
# (by changing 5xx replies into 4xx replies). However, soft_bounce
# is no cure for address rewriting mistakes or mail routing mistakes.
#
#soft_bounce = no

#-*- mode: ini; tab-width: 4; indent-tabs-mode:nil  -*-

Map Files and Databases 

Postfix uses several maps stored in files to translate things like domains and mail-addresses at runtime. As these maps can be quite large and change often, they are not saved in configuration files, but in map files.

The map files are referenced in the postfix server-configuration. Examples already used above are the mynetowrks, alias_maps or virtual_mailbox_domains above.

Such configuration values usually contain a prefix like cidr:, hash: or mysql:, which tell the server in what type of data store the mapping information is accessible.

If the prefix starts with hash: the map is initially is stored as plain text in the file referenced, but cached later in a hash-database for faster access. A hashed map or database can change anythme while the server is running, unlike configuration values, which are only read when the server reloads or fully restarted.

After every change to any of the map files discussed below, their databases need to be refreshed as follows:

$ cd /etc/postfix && sudo postmap <prefix:>/etc/postfix/<filename>

Alias Map 

The file /etc/aliases resides outside of the postifx configuration directory /etc/postifx as it is a standard Linux system file also used by other software packages, besides Postfix.

It contains information on where mails for certain system accounts should be delivered to.

This is needed for notification and warning mails created by system programs (like cronjobs) to reach human beings (like the person responsible for system administration).

Some software packages will add their system accounts to it.

# See man 5 aliases for format
postmaster:    root
clamav: root

The contents of the file are cached in the database /etc/postfix/aliases.db. Because of that the database must be refreshed after each and every change made in /etc/postfix/aliases.map:

$ cd /etc/postfix && sudo postalias

See the manpage aliases(5) for more information.

Virtual Domains Map 

We referenced this the file /etc/postfix/sql/virtual-domains.cf in the main configuration file main.cf above as virtual_mailbox_domains. It contains the MariaDB database server connection information and the SQL Query for Postfix to lookup the virtual domains hosted here:

#
# MySQL connection and query to lookup which mail domains are hosted here
#
# Note: Postfix can't access UNIX sockets outside of '/var/spool/postfix'
# so make sure to use a numerical IP addresses only for 'hosts'!
hosts = 127.0.0.1
user = postfix
password = ****************
dbname = vimbadmin
query = SELECT 1 FROM domain WHERE domain='%s' AND active = '1'

Use the user, password and database defined in Virtual Domains and Mailboxes.

Virtual Mailboxes Map 

Same as with the virtual domain map above, the following MySQL connection defined in /etc/postfix/sql/virtual-mailboxes.cf is used to lookup which mailboxes are hosted here:

#
# MySQL connection and query to lookup which mailboxes are hosted here
#
# Note: Postfix can't access UNIX sockets outside of '/var/spool/postfix'
# so make sure to use a numerical IP addresses only for 'hosts'!
hosts = 127.0.0.1
user = postfix
password = ****************
dbname = vimbadmin
query = SELECT 1 FROM mailbox WHERE username = '%s' AND active = '1'

Note that the only difference to the above one is the SQL query. looking for mailboxes instead of domains.

Virtual Alias Maps 

On our MTA server we use two virtual alias maps:

/etc/postfix/virtual contains local system account names and destination mail addresses for these accounts:

# *****************************************************************************
# virtual - Postfix virtual alias table
# *****************************************************************************
#
# The  optional  virtual(5)  alias table rewrites recipient addresses for
# all local, all virtual, and all  remote  mail  destinations.   This  is
# unlike  the  aliases(5) table which is used only for local(8) delivery.
# This feature is implemented in the  Postfix  cleanup(8)  daemon  before
# mail is queued.
#
# Virtual  aliasing  is  recursive; to terminate recursion for a specific
# address, alias that address to itself.
#
# Virtual aliasing is applied only to recipient envelope  addresses,  and
# does  not  affect message headers.  Use canonical(5) mapping to rewrite
# header and envelope addresses in general.
#
# See https://www.postfix.org/virtual.5.html
#
# This is a hash-type indexed Postfix lookup table.
# The Postfix main configuration file /etc/postfix/main.ch includes this file as
# follows:
#   virtual_alias_maps = hash:${config_directory}/virtual
#
# Update the database after changing this file with the following commands:
#   $ cd /etc/postfix
#   $ sudo postmap virtual
# *****************************************************************************

# Redirect mail for local users of this host to example.net
abuse       abuse@example.net
clamav      admin@example.net
daemon      admin@example.net
hostmaster  hostmaster@example.net
list        postmaster@example.net
postmaster  postmaster@example.net
root        admin@example.net
security    admin@example.net
support     admin@example.net
webmaster   webmaster@example.net
john        john@alainwolf.ch
www-data    webmaster@example.net

#-*- mode: ini; tab-width: 4; indent-tabs-mode:nil  -*-

/etc/postfix/sql/virtual-aliases.cf contains the SQL server connection information and SQL query lookup mailbox aliases at the MySQL database server:

#
# MySQL connection and query to lookup mail-address aliase and their mailbox
#
# Note: Postfix can't access UNIX sockets outside of '/var/spool/postfix'
# so make sure to use a numerical IP addresses only for 'hosts'!
hosts = 127.0.0.1
user = postfix
password = ****************
dbname = vimbadmin
query = SELECT goto FROM alias WHERE address = '%s' AND active = '1'

TLS Policy Maps 

The /etc/postfix/sql/tls-policy.cf file :

hosts = 127.0.0.1
user = postfix
password = ****************
dbname = vimbadmin
query = SELECT policy, params FROM tlspolicies WHERE domain = '%s'

Master Process Configuration 

Postfix consists of many daemons and utilities, some running all the time and others started when needed. The /etc/postfix/master.cf confiugration file is the centralized control center from where the Postfix master process gets his guidelines on what, when and how all these programs have to be started.

Where no command-line options are specified, the program uses relevant configuration values from the main.cf configuration file. Alternatively options can be overridden by command-line parameters like -o.

The official documentation website provides a manual page online.

The whole file, as presented below, is also provided for download at /server/config-files/etc/postfix/master.cf here.

Standard SMTP Dameon 

The first daemon specified here is the SMTP daemon smtpd which runs on the dedicated SMTP TCP port 25, it is enabled by default:

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet  n       -       y       -       -       smtpd

Postscreen SMTP Firewall 

The postscreen damon on the second line is a daemon which runs a mininmal SMTP subset to perform some compliance tests on incoming SMTP client connections. If the client passes all tests he gets whitelistet and the connection is passed along to the real SMTP server running behind it. That is what the second line above is for. An smtpd daemon that takes over connections from postscreen only. The tlsproxy handles TLS encryption for postscreen and dnsblog does the DNS blacklist lookups.

Since we use the Rspamd milter to separate legitimate from undesired SMTP connections, the postscreen line can be commented out.

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
#smtp     inet  n       -       y       -       1       postscreen
#  -o smtpd_sasl_auth_enable=no

Internal Postfix SMTP Daemon 

If the conneting SMTP client has passed all the checks performed by postscreen, the client IP address is temporarely whitelisted.

If possible the TCP connection is then handed over to the SMTPD daemon internally (that is what the “pass” keyword means).

Sometimes this is not possible, depeneding on the checks. If the client had to start already some message delivery in order to complete a check, the connection can not be handed over to a new SMTP server, as this would confuse the SMTP client who is already in the middle of a message delivery. In this case, postscreen will tell the connecting SMTP client to abort message delivery for now and try again later. If the same client connects again later, it will be already whitelisted and then the connection is “passed” directly to the postfix SMTP daemon.

Since we don’t use postscreen, this daemon can be disabled by commenting out the line.

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
#smtpd    pass  -       -       y       -       -       smtpd

DNS Blacklist & Whitelist Lookup 

The dnsblog is a helper service for the postscreen SMTP firewall to lookup, if connecting hosts are found in any of configured the DNS blacklists or whitelists.

Since we use the Rspamd milter to separate legitimate from undesired SMTP connections, the dnsblog line can be commented out.

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
#dnsblog  unix  -       -       y       -       0       dnsblog

TLS Proxy 

It is used by postscreen server to handle TLS connections with inbound SMTP client connections and by the local smtp client to support TLS connection reuse.

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
tlsproxy   unix  -      -       y       -       0       tlsproxy

Submission Daemon 

The submission daemon is a SMTP daemon listening on TCP port 587 for mail user agents (MUAs aka mail clients like Thunderbird or Outlook) of authorized users to connecting and submit their outgoing mail.

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
submission inet  n       -       y       -       -      smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_tls_auth_only=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_client_restrictions=$mua_client_restrictions
  -o smtpd_helo_restrictions=$mua_helo_restrictions
  -o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

The connecting MUA is required to initialize TLS encryption of the connection with the STARTTLS command before anything else. This controlled by the “smtpd_tls_security_level=encrypt” option.

The following options enable user authentication over encrypted connections and various settings to allow mail from authenticated and authorized users to be sent anywhere.

The last options, marks the submitted mail messages as our own, to be handles accordingly by our spam filters.

SMTPS Daemon 

The SMTPS daemon is very simliar to the submission daemon. The difference being, it runs on TCP port 465 and connections are already encrypted, therefore no STARTTLS is required.

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtps      inet  n       -       y       -       -      smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_client_restrictions=$mua_client_restrictions
  -o smtpd_helo_restrictions=$mua_helo_restrictions
  -o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

Systemd Service Dependencies 

Our Postfix MTA depends on various other services, we want to ensure that Postfix is always able to connect to them while running:

Wireguard VPN network interface

MariaDB database server

Rspamd Spam Filter

ClamAV virus scanner

Postfix MTA-STS resolver

The Systemd services file for the Postfix server /lib/systemd/system/postfix@.service is created as part of the software package installation. The recommended method is to create a Systemd override-file and not change anything in the provided service file, as it would be lost on software package updates.

You can create a override file easily with the help of the systemctl command:

$ sudo systemctl edit postfix@.service

This will start your editor with an empty file, where you can add your own custom Systemd service configuration options.

[Unit]
After=sys-devices-virtual-net-wg0.device
After=mariadb.service rspamd.service clamav-daemon.service postfix-mta-sts-resolver.service
BindsTo=sys-devices-virtual-net-wg0.device mariadb.service

The configuration statement After=mariadb.service ensures that mariadb.service is fully started up before the postfix@.service is started.

The line BindsTo=mariadb.service ensures that if the Database service is stopped, the PowerDNS server will be stopped too.

After you save and exit of the editor, the file will be saved as /etc/systemd/system/postfix@.service.d/override.conf and Systemd will reload its configuration:

systemctl show postfix@.service |grep -E "After=|BindsTo="

References 

Postfix Documentation