Integrating Amazon SES with Postfix

To configure integration using STARTTLS

1. On your mail server, open the main.cf file. On many systems, this file resides in the /etc/postfix folder.

2. Add the following lines to the main.cf file, modifying them to reflect your particular situation, and then save the file.

   relayhost = email-smtp.us-east-1.amazonaws.com:25
   smtp_sasl_auth_enable = yes
   smtp_sasl_security_options = noanonymous
   smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
   smtp_use_tls = yes
   smtp_tls_security_level = encrypt
   smtp_tls_note_starttls_offer = yes
                       

3. Edit the /etc/postfix/sasl_passwd file. If the file does not exist, create it. Add the following lines to the file, replacing USERNAME and PASSWORD with your SMTP user name and password.

   email-smtp.us-east-1.amazonaws.com:25 USERNAME:PASSWORD
   ses-smtp-prod-335357831.us-east-1.elb.amazonaws.com:25 USERNAME:PASSWORD
                       

4. Save the sasl_passwd file.

5. At a command prompt, issue the following command to create an encrypted file containing your SMTP credentials.

   sudo postmap hash:/etc/postfix/sasl_passwd

6. Remove the /etc/postfix/sasl_passwd file.

7. Tell Postfix where to find the CA certificate (needed to verify the SES server certificate).

   If running on the Amazon Linux AMI:

   sudo postconf -e 'smtp_tls_CAfile = /etc/ssl/certs/ca-bundle.crt'

   If running on Ubuntu Linux:

   sudo postconf -e 'smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt'

To configure integration using a secure tunnel

1. To begin, you will need to set up a secure tunnel as described in Setting Up a Secure Tunnel. In the following procedure, we use port 2525 as your stunnel port. If you are using a different port, modify the settings that you actually use accordingly.

2. On your mail server, open the main.cf file. On many systems, this file resides in the /etc/postfix folder.

3. Add the following lines to the main.cf file, modifying them to reflect your particular situation, and then save the file.

   relayhost = 127.0.0.1:2525
   smtp_sasl_auth_enable = yes
   smtp_sasl_security_options = noanonymous
   smtp_tls_security_level = may
   smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
                       

4. Edit the /etc/postfix/sasl_passwd file. If the file does not exist, create it. Add the following line to the file, replacing USERNAME and PASSWORD with your SMTP user name and password.

   127.0.0.1:2525 USERNAME:PASSWORD

5. Save the sasl_passwd file.

6. At a command prompt, issue the following command to create an encrypted file containing your SMTP credentials.

   sudo postmap hash:/etc/postfix/sasl_passwd

7. Remove the /etc/postfix/sasl_passwd file.