Configuring Postfix

How to configure Postfix.

1. Connect to the target server using your preferred SSH tool (e.g. Putty) and log in.
2. Configure that all emails to your custom Microsoft 365 email domain are inbound and the rest is outbound as follows:
   1. Change to the folder /etc/postfix/ and create a new file named user_map
   2. Edit the file and add the configuration, for example:

      demo.eperi-cdp.com inbound
      * outbound

   3. Save and exit the file.
3. Configure your custom Microsoft 365 email domain as relay domain as follows:
   1. Still in the folder /etc/postfix/, create a new file named relay_domains
   2. Edit the file and add the configuration, for example:

      demo.eperi-cdp.com 1

   3. Save and exit the file.
4. Map your custom Microsoft 365 email domain to your EOP mail protection URL hostname as follows:
   1. Still in the folder /etc/postfix/, create a new file named transport
   2. Get your EOP mail protection URL hostname from the DNS settings of your Microsoft 365 tenant (Microsoft 365 Admin center / domains / select domain / first entry in list, see Getting DNS details from your Microsoft 365 tenant).
   3. Edit the file and add the configuration, for example:

      demo.eperi-cdp.com smtp:[demo-epericdp-com02e.mail.protection.outlook.com]:25

   4. Save and exit the file.
5. Convert the three files from above to the Postfix database format:

   postmap /etc/postfix/user_map
   postmap /etc/postfix/relay_domains
   postmap /etc/postfix/transport

6. Edit the main configuration file /etc/postfix/main.cf and adjust (or add, if not present) the following parameters:

   Parameter	Explanation
   smtpd_recipient_restrictions=check_recipient_access hash:/etc/postfix/user_map	To define whether a given email is intended to be inbound (from an external sender to Microsoft 365) or outbound (from Microsoft 365 to an external recipient).
   relay_domains = hash:/etc/postfix/relay_domains	To configure your Microsoft 365 email domain as relay domain.
   transport_maps = hash:/etc/postfix/transport	To map your Microsoft 365 email domain to your EOP mail protection URL hostname.
   smtpd_restriction_classes = inbound, outbound inbound=reject_unknown_sender_domain outbound=permit_mynetworks	To configure the behaviour of Postfix in different cases: For inbound emails (to Microsoft 365) it only rejects unknown sender domains, while for outbound emails (from Microsoft 365) we only accept sender IPs that are in the range of mynetworks (see the parameter mynetworks below).
   mynetworks = 127.0.0.1 23.103.132.0/22 23.103.136.0/21 23.103.144.0/20 23.103.198.0/23 23.103.200.0/22 23.103.212.0/22 40.92.0.0/14 40.107.0.0/17 40.107.128.0/18 52.100.0.0/14 65.55.88.0/24 65.55.169.0/24 94.245.120.64/26 104.47.0.0/17 157.55.234.0/24 157.56.110.0/23 157.56.112.0/24 207.46.100.0/24 207.46.163.0/24 213.199.154.0/24 213.199.180.128/26 216.32.180.0/23 40.95.0.0/16 [2a01:111:f400:7c00::]/54 [2a01:111:f400:fc00::]/54 [2a01:111:f403::]/48	The allowed sender addresses (These are the known addresses from which Microsoft 365 sends out its emails.)
   smtpd_milters = inet:localhost:8280	Where the Milter app is running. 8280 is the default port. (A different port could theoretically be configured.)
   milter_default_action = reject	How to react if Milter encounters a problem: Reject all further commands in this session with a permanent status code.

7. Restart Postfix, for example:

   sudo systemctl restart postfix