This guide explains how to configure Postfix on Debian 13 to send emails using Resend as an SMTP relay. Many cloud providers, such as Hetzner, block ports 25 and 465 to prevent email spam, making a relay service like Resend necessary for reliable email delivery. This setup is useful for scenarios like sending cronjob notifications (e.g., via MAILTO). Below is a streamlined process to integrate Postfix with Resend, because unfortunately I could not find any blog or forum about how to combine these too. I also included a little ceveat I found about Resend.

Postfix --> Resend SMTP Relay --> Recipient Mailbox

Prerequisites

  • A Debian 13 server (e.g., hosted on Hetzner).
  • A Resend account with a verified domain and an API key with sending permissions. Refer to Resend’s SMTP documentation for setup details.
  • Replace YOUR_DOMAIN with your verified domain and YOUR_API_KEY with the API key from Resend.

Note: Keep the Resend dashboard open to monitor email delivery or verify receipt.

Installing Postfix

Install Postfix using the following command:

1
2

sudo apt update
sudo apt install postfix

During installation, a configuration prompt will appear. Select:

  1. General type of mail configuration: Choose Internet Site.
  2. System mail name: Set this to your domain (e.g., example.com for a hostname like mail.example.com). This ensures emails are sent as [email protected].

To reconfigure these settings later, run:

1

sudo dpkg-reconfigure postfix

To monitor Postfix logs for debugging, use:

1
2
3

journalctl -u postfix.service
# Or view logs in reverse order
journalctl -r -u postfix.service

Configuring Postfix for Resend

Step 1: Set Up SASL Authentication

Postfix uses a sasl_passwd file to store SMTP credentials for Resend. Create or edit this file:

1
2
3
4

# Using a text editor (e.g., nano)
sudo nano /etc/postfix/sasl_passwd
# Or append directly
echo "[smtp.resend.com]:587 resend:YOUR_API_KEY" >> /etc/postfix/sasl_passwd

The file should contain:

[smtp.resend.com]:587 resend:YOUR_API_KEY

Note: Port 587 is used for STARTTLS, which is not blocked by Hetzner, unlike ports 25 and 465.

Generate the hashed database for Postfix:

1

sudo postmap /etc/postfix/sasl_passwd

Step 2: Configure Postfix

Edit the Postfix configuration file /etc/postfix/main.cf:

1

sudo nano /etc/postfix/main.cf

Add or update the following lines to enable Resend as the SMTP relay. Make sure to use the same port you used in the sasl_passwd file.

# Resend SMTP Relay Configuration
relayhost = [smtp.resend.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_use_tls = yes
smtp_tls_wrappermode = no
smtp_tls_security_level = encrypt

Step 3: Install SASL Modules

If you encounter SASL authentication errors (e.g., No worthy mechs found), install the Cyrus SASL modules to ensure compatibility with Resend:

1

sudo apt install libsasl2-modules

Step 4: Restart Postfix

Apply the changes by restarting Postfix and verifying its status:

1
2

sudo systemctl restart postfix
sudo systemctl status postfix

Check the logs for errors like:

warning: SASL authentication failure: No worthy mechs found

If this occurs, ensure libsasl2-modules is installed and restart Postfix.

Testing the Setup

I used the mail command from the mailutils package to test email sending. It’s up to you to use a different client like mutt.

1
2

sudo apt install mailutils
echo "Hello, World!" | mail -s "Test Email" -r "from@YOUR_DOMAIN" to@YOUR_DOMAIN

Replace from@YOUR_DOMAIN and to@YOUR_DOMAIN with valid email addresses. Verify delivery in the Resend dashboard or your inbox.

Troubleshooting

If emails fail to send, check the following:

  1. Resend 450 Status Code:

    • Temporary Server Issue: Wait a few minutes and retry.
    • Greylisting: Verify your server’s IP isn’t on a blacklist using MXToolbox.
    • Domain Mismatch: Ensure the sender’s domain (from@YOUR_DOMAIN) matches a verified domain in Resend. A typo here can cause a 450 error from Resend.

  2. SASL Authentication Errors: Confirm libsasl2-modules is installed and the sasl_passwd file contains the correct API key.

  3. Postfix Logs: Use journalctl -u postfix.service to diagnose issues.

Alternatives

If you happen to use Google Chat and just need some notifications from the VPS then here’s a command for that:

1

curl -X POST -H "Content-Type: application/json; charset=UTF-8" -d '{"text": "Hello, this is a test message from a curl command."}' YOUR_WEBHOOK_URL