100% Client-Side Mail Server Wizard

Postfix & Dovecot Hardened Config Builder

Generate production-ready, hardened main.cf and master.cf configurations. Includes modern TLS cipher suites, submission port 587, rate-limiting, and milters.

Server Parameters & Security Toggles

Base Domain ($mydomain):

Mail Hostname ($myhostname):

TLS Security Profile:

Integrated Milter Engine:

Rate Limit (Max Msgs/Hour/Client):

Enable Authenticated Submission Port 587 & SMTPS 465

# ==============================================================================
# Hardened Postfix Configuration: main.cf
# Generated via BestUtilities.org Postfix Config Builder
# Domain: example.com | Mail Host: mail.example.com
# ==============================================================================

# Server Identity & Domains
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, localhost
mynetworks = 127.0.0.0/8 [::1]/128
inet_interfaces = all
inet_protocols = all

# TLS / SSL Security Configuration (MODERN)
smtpd_tls_security_level = may
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_ciphers = high
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

# Outbound SMTP TLS Client Settings
smtp_tls_security_level = dane
smtp_dns_support_level = dnssec
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_ciphers = high
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# SASL Authentication (Dovecot Backend)
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $mydomain

# Anti-Spam & Relaying Restrictions
smtpd_relay_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination

smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination,
    reject_invalid_helo_hostname,
    reject_non_fqdn_helo_hostname,
    reject_non_fqdn_sender,
    reject_non_fqdn_recipient,
    reject_unknown_recipient_domain,
    reject_rbl_client zen.spamhaus.org

# Rate Limiting & Anti-Abuse (Anvil Engine)
smtpd_client_message_rate_limit = 100
anvil_rate_time_unit = 3600s
smtpd_error_sleep_time = 5s
smtpd_soft_error_limit = 5
smtpd_hard_error_limit = 10

# Milters Configuration (OpenDKIM & OpenDMARC)
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:127.0.0.1:8891, inet:127.0.0.1:8893
non_smtpd_milters = $smtpd_milters

# Clean Privacy Headers
header_checks = regexp:/etc/postfix/header_checks
biff = no
append_dot_mydomain = no
readme_directory = no