From ArchWiki
Revision as of 12:57, 6 August 2017 by Larivact (talk | contribs) (rm emphasis)
Jump to navigation Jump to search

Sendmail is the classic SMTP server from the unix world. Arch Linux provides the alternative Postfix in the official repositories.

The goal of this article is to setup Sendmail for local users accounts, without using mysql or other database, and allowing also the creation of mail-only accounts.

This article only explains the required steps configuring Sendmail; after that, you probably want to add IMAP and POP3 access, so you could follow the Dovecot article.


Install the sendmailAUR, procmail and m4 packages.

DNS Records

You should have a domain, and edit your MX records to point your server. Remember some servers have problems with MX records pointing to CNAMEs, so your MX should point to an A record instead.

Adding users

Create a Linux user for each user that wants to receive email at To add mail-only accounts, that is, users who can get email, but can't have shell access or login on X, you can add them like this:

# useradd -m -s /usr/bin/nologin username


Create SSL certs

Warning: If you plan on implementing SSL/TLS, know that some variations and implementations are still vulnerable to attack. For details on these current vulnerabilities within SSL/TLS and how to apply appropriate changes to Sendmail, visit and

Generate a key and obtain a certificate. See OpenSSL#Self-signed certificate for private use or Let's Encrypt for a free publicly-trusted certificate.

Create the file /etc/mail/ You can read all the options for configuring sendmail on the file /usr/share/sendmail-cf/README.

Warning: If you create your own file, remember that plaintext auth over non-TLS is very risky. Using the following example forces TLS and is therefore more safe unless you know what are you doing

Here is an example using auth over TLS. The example has comments explaing how it works. The comments start with dnl .

define(`confDOMAIN_NAME', `')dnl
dnl  The following allows relaying if the user authenticates,
dnl  and disallows plaintext authentication (PLAIN/LOGIN) on
dnl  non-TLS links:
define(`confAUTH_OPTIONS', `A p y')dnl
dnl  Accept PLAIN and LOGIN authentications:
dnl Make sure this paths correctly point to your SSL cert files:
FEATURE(`virtusertable', `hash /etc/mail/virtusertable.db')dnl

Then process it with

# m4 /etc/mail/ > /etc/mail/


Put your domains on the local-host-names file:


Make sure the domains are also resolved by your /etc/hosts file.


Create the file /etc/mail/access and put there the base addresses where you want to be able to relay mail. Lets suppose you have a vpn on, and you want to relay mails from any ip in that range:

10.5.0 RELAY
127.0.0 RELAY

Then process it with

# makemap hash /etc/mail/access.db < /etc/mail/access


Edit the file /etc/mail/aliases and uncomment the line #root: human being here and change it to be like this:

root:         your-username

You can add aliases for your usernames there, like:

coolguy:      your-username
somedude:     your-username

Then process it with

# newaliases


Create your virtusertable file and put there aliases that includes domains (useful if your server is hosting several domains)

/etc/mail/virtusertable         your-username                       joenobody

Then process it with

# makemap hash /etc/mail/virtusertable.db < /etc/mail/virtusertable

Start on boot

Enable and start the following services. Read Daemons for more datails.

  • saslauthd.service
  • sendmail.service
  • sm-client.service

SASL authentication

Add a user to the SASL database for SMTP authentication.

# saslpasswd2 -c your-username

Tips and tricks

Forward all the mail of one domain to certain user

To forward all mail addressed to any user in the domain to, add to the /etc/mail/virtusertable file:

Do not forget to process it again with

# makemap hash /etc/mail/virtusertable.db < /etc/mail/virtusertable