Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

To send Ubuntu mail through a Gmail or Google Workspace mailbox, configure Postfix as an authenticated SMTP client with [smtp.gmail.com]:587, STARTTLS, and a Google app password. The password belongs in a root-only SASL map, not in your normal Gmail password field. This setup sends outbound mail through Google; it does not make Ubuntu a public mail server.

What this setup does

Postfix is Ubuntu’s mail transfer agent. In a relay configuration it accepts mail from local applications, queues it, and submits each message to Google instead of trying to deliver directly to the recipient’s mail server. This is suitable for system alerts, scheduled jobs, contact forms, and other send-only workloads.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The standard mailbox route uses Google’s authenticated submission host, smtp.gmail.com. A separate Google Workspace product, smtp-relay.gmail.com, is intended for organization-wide device and application relay. The two services have different authentication and policy models, so choosing the correct hostname is the first decision.

Choose the Google service before installing Postfix

Characteristic Gmail or Workspace mailbox Google Workspace SMTP relay
Hostname smtp.gmail.com smtp-relay.gmail.com
Typical identity One Gmail or Workspace mailbox Organization-managed applications and devices
Authentication App password for a client that cannot perform interactive OAuth; OAuth is preferred where supported Workspace administrator policy, commonly authorized IP addresses and/or authenticated relay settings
Encryption choices documented by Google Port 587 with STARTTLS or port 465 with implicit SSL Ports 25, 465, and 587, with administrator-selected TLS/SSL policy
Administrative control Mailbox and account security settings Google Workspace administrator configuration and relay policy
Published sending figure Gmail SMTP option: 2,000 messages per day in Google’s current administrator guidance (crawled 2026) 10,000 recipients per user per day in Google’s current Workspace SMTP relay guidance (crawled 2026)

The rest of this guide uses smtp.gmail.com on port 587. Use the Workspace relay section later if your organization specifically administers smtp-relay.gmail.com.

#1 Best Overall
Sale
Compressed Air Duster,130000RPM Super Power Cordless Air Duster,Rechargeable Brushless Blower,3 Gear Adjustable Blower with LED Light,Dust Remover for Computer/House/Outdoor/Car
  • Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
  • With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
  • Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
  • Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
  • Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.

Prerequisites and design checks

  • An Ubuntu host with administrative access and a working DNS resolver.
  • Outbound firewall access to the Google submission port you select, normally TCP 587.
  • A complete Gmail or Google Workspace address, such as alerts@example.com.
  • Two-Step Verification enabled on that account if you will use an app password.
  • Permission from your Workspace administrator if the account is managed by an organization. Policies can disable app passwords, and Advanced Protection can prevent their use.
  • A plan for the envelope sender. Google may reject a sender that is not permitted for the authenticated account or Workspace relay policy.

Record the Ubuntu and Postfix versions while troubleshooting. Package names, defaults, and generated configuration can differ between Ubuntu releases.

Install Postfix and the SASL modules

Refresh package metadata and install Postfix, the SASL client modules used for SMTP authentication, and certificate authorities for TLS validation:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo apt update
sudo apt install postfix libsasl2-modules ca-certificates

During the package dialog, choose the mail system type that matches the host. An Internet site is appropriate when the machine is intended to originate mail itself; a satellite or system-relay style is appropriate when all outbound mail should leave through another server. The dialog writes an initial /etc/postfix/main.cf, so inspect that file after installation rather than assuming its defaults.

sudo postconf -n
sudo systemctl status postfix

If your release offers a differently named SASL package, search the package cache and install the client modules for that release. The important requirement is that Postfix can load a SASL authentication mechanism and TLS certificate authorities.

Configure Postfix for Gmail submission on port 587

Port 587 is Google’s STARTTLS submission path. Set the relay host with square brackets so Postfix uses the literal host and port instead of looking up MX records. Enable SASL authentication, disallow anonymous mechanisms, and require encryption before Postfix sends credentials or message data.

You can edit /etc/postfix/main.cf as root, or apply the settings with postconf:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo postconf -e 'relayhost = [smtp.gmail.com]:587'
sudo postconf -e 'smtp_sasl_auth_enable = yes'
sudo postconf -e 'smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd'
sudo postconf -e 'smtp_sasl_security_options = noanonymous'
sudo postconf -e 'smtp_sasl_tls_security_options = noanonymous'
sudo postconf -e 'smtp_tls_security_level = encrypt'

Check the resulting values and look for duplicate or conflicting entries in the file:

sudo postconf relayhost smtp_sasl_auth_enable smtp_sasl_password_maps 
smtp_sasl_security_options smtp_sasl_tls_security_options smtp_tls_security_level

smtp_tls_security_level = encrypt prevents a plaintext fallback for this outbound SMTP session. If Google cannot negotiate TLS, Postfix should defer or fail the delivery rather than transmit the password without encryption.

Using port 465 instead

Port 465 is Google’s implicit-SSL alternative. It is not interchangeable with STARTTLS on port 587. A representative Postfix configuration is:

Rank #2
EVEO® Screen Cleaner Spray Kit (Streak-Free) TV Screen Cleaner for Smart TV, Lcd, LEd, Oled | Computer Screen Cleaner Spray and Wipe Microfiber Cloth - TV, Monitor, Laptop, iPad, Car - 6.7oz 1 Pack
  • Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
  • Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
  • Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
  • Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
  • Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
relayhost = [smtp.gmail.com]:465
smtp_tls_wrappermode = yes
smtp_tls_security_level = encrypt

Keep the same SASL settings and use the exact [smtp.gmail.com]:465 key in the password map. Port 587 is generally simpler to diagnose because the connection starts unencrypted and explicitly upgrades with STARTTLS.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Create a Google app password

A normal Gmail account password is not the right credential for this non-interactive Postfix client. Google app passwords are separate credentials for an application or device. Google states that app passwords can only be used on accounts with Two-Step Verification enabled.

  1. Sign in to the Google account that will submit the mail.
  2. Enable Two-Step Verification if it is not already active.
  3. Open the account’s security settings and create an app password for this Ubuntu/Postfix installation.
  4. Copy the generated value when Google displays it. Treat it like a password; anyone who obtains it can attempt to authenticate as that mailbox.

Workspace administrators can restrict app-password use, and Advanced Protection may make it unavailable. If policy blocks app passwords, ask the administrator to approve an OAuth-capable client or use the organization’s SMTP relay service instead. Google recommends OAuth where the client supports it; this send-only Postfix pattern uses an app password because the SMTP client cannot perform an interactive browser sign-in.

Google revokes app passwords after the account’s primary password is changed. Plan to generate a replacement and rebuild the Postfix map after such a change.

Store the credential in Postfix’s SASL map

Create /etc/postfix/sasl_passwd with the exact destination spelling used by relayhost:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo install -m 600 /dev/null /etc/postfix/sasl_passwd
sudoedit /etc/postfix/sasl_passwd

Put one line in the file, replacing the address and generated app-password value with the account you created:

[smtp.gmail.com]:587 alerts@example.com:generated-app-password

The complete account address is required. The bracketed host and port must match relayhost character for character. If you use port 465, both places must say [smtp.gmail.com]:465.

Build Postfix’s indexed database, then verify ownership and mode:

sudo postmap /etc/postfix/sasl_passwd
sudo chown root:root /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db
sudo chmod 600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db

Postfix reads the map before dropping privileges, which is why the file belongs in /etc/postfix and should be readable and writable only by root. The generated .db file contains the credential in an indexed form; protect it as carefully as the source file.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
BladeHawks RGB Gaming Mouse Pad Extra Large Extended 31.5x12 Inch-Black
  • 【Large size】:Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
  • 【LED backlight mouse pad】:Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
  • 【Anti-slip rubber base】:Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
  • 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
  • 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.

After every edit, rerun postmap. Editing only the text file does not update the database that Postfix actually queries.

Understand sender identity and delivery limits

The address used to authenticate and the envelope sender used for a message are related but not automatically interchangeable. A Gmail mailbox may be authorized to send only as its own address or as addresses configured for that account. A Workspace relay rule can impose a verified-domain or approved-sender restriction. Use an envelope sender that your account or administrator has explicitly permitted, especially for automated alerts.

Successful authentication also does not guarantee unlimited delivery. Google’s current guidance lists 2,000 messages per day for the Gmail SMTP option. The Workspace SMTP relay guidance lists 10,000 recipients per user per day. These are service limits, not a throughput promise: suspicious content, unusual volume, or policy violations can still cause filtering, temporary blocks, or rejected messages.

For that reason, use a mailbox relay for modest notification traffic rather than treating it as a bulk-mail platform. Monitor the queue and journal, and design applications to tolerate deferred delivery instead of sending repeated copies when a temporary failure occurs.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Restart Postfix and send a controlled test

Restart the service so it loads the new map and configuration:

sudo systemctl restart postfix
sudo systemctl --no-pager --full status postfix

Send a plain text message through the local Postfix submission command. The -v flag prints the SMTP conversation summary, while the journal shows the complete service-side result:

printf 'Subject: Postfix testnnThis is a test.n' | sendmail -v recipient@example.net
sudo journalctl -u postfix -f

For a successful delivery, the log should show a connection to the selected Google host, TLS negotiation, SASL authentication, and a final accepted or delivered status. Stop the live log with Ctrl+C after the message leaves the queue.

If the message is deferred, inspect the queue and the detailed status before repeatedly retrying:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
postqueue -p
sudo postcat -q QUEUE_ID

Use the actual queue ID shown by postqueue -p. Once the underlying error is corrected, Postfix will retry deferred mail according to its normal queue schedule; you can request an immediate retry with sudo postqueue -f.

Rank #4
Sale
Vaydeer Wrist Rest for Keyboard and Mouse, Computer Ergonomic Wrist Support Pad, Soft Memory Foam Arm Cushion for Desk, Palm Hand Office Laptop Typing
  • 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
  • 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
  • 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
  • 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
  • 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.

Changing or revoking the app password safely

  1. Create a replacement app password in Google’s account security settings.
  2. Edit /etc/postfix/sasl_passwd without changing the exact bracketed destination key.
  3. Run sudo postmap /etc/postfix/sasl_passwd to rebuild the indexed map.
  4. Keep the source and database files root-owned with mode 600.
  5. Restart Postfix and send one controlled test.
  6. Revoke the old credential in Google after the replacement works, or immediately if the old value may have been exposed.

Changing the account’s ordinary password also revokes its app passwords. A resulting stream of 535 errors is therefore expected until a new app password is installed and mapped.

Using Google Workspace SMTP relay instead

Google documents smtp-relay.gmail.com as a separate service for applications and devices. Google recommends the SMTP relay service for sending email from devices or apps, but it requires Workspace administrator configuration.

Ask the administrator which combination of source IP authorization, SMTP authentication, sender restrictions, and TLS is required. The service supports ports 25, 465, and 587. Do not replace smtp.gmail.com with this hostname while leaving mailbox app-password assumptions unchanged: the relay service’s policy and authentication model are different.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

For an IP- or policy-authorized relay, the administrator may allow Postfix to relay without a per-mailbox app password. For an authenticated relay, follow the administrator’s required credential and sender policy. The envelope sender domain may be restricted to domains verified in Workspace or to addresses allowed by the relay rule.

The published 10,000-recipient-per-user-per-day figure applies to Google’s current Workspace SMTP relay guidance and is not a guarantee of unrestricted throughput. Google can still apply anti-abuse filtering, temporary blocks, or organization-specific quotas.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Troubleshoot common failures

535 authentication failure

  • Confirm that the SASL line contains the full Gmail or Workspace address, not only the local part.
  • Generate a new app password and replace the old value. Do not use the ordinary account password.
  • Verify that Two-Step Verification is enabled and that Workspace policy permits app passwords.
  • Check that relayhost and the map key both use [smtp.gmail.com]:587, including brackets and port.
  • Run sudo postmap /etc/postfix/sasl_passwd after editing and restart Postfix.

530 5.7.0 Must issue STARTTLS first

The client attempted authentication or delivery before TLS was established. Use port 587 with smtp_tls_security_level = encrypt, confirm that the setting is active with postconf, and check that a firewall or TLS-inspecting proxy is not altering the session. If you selected port 465, configure implicit TLS with smtp_tls_wrappermode = yes instead of treating it as STARTTLS.

550 relay or sender-policy rejection

Check the envelope sender and recipient policy. A Gmail mailbox may only be permitted to send as certain addresses, while Workspace SMTP relay can restrict sender domains and source IP addresses. For smtp-relay.gmail.com, verify that the administrator has registered the Ubuntu host’s public IP or required authentication method.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

No worthy mechs found

Postfix cannot find a usable SASL mechanism, or its security policy is rejecting every mechanism. Confirm that the SASL client modules were installed for your Ubuntu release. Keep smtp_sasl_security_options = noanonymous and smtp_sasl_tls_security_options = noanonymous; do not weaken them to permit anonymous authentication. Review the Postfix log for the specific mechanism that failed.

No connection to Google

  • Resolve the hostname: getent hosts smtp.gmail.com.
  • Test outbound TCP access to the selected port through the host firewall and any cloud security group.
  • Check whether the network blocks TCP 25, 465, or 587; use the port allowed by both the network and Google configuration.
  • Inspect the Ubuntu and Postfix versions, because generated defaults and package names vary by release.

Credential lookup or map errors

A map error commonly means the destination key does not match. For port 587 the key must be exactly [smtp.gmail.com]:587, not smtp.gmail.com, [smtp.gmail.com], or a different port. Confirm the map path, rebuild the database, and ensure the Postfix process can read it while unprivileged processes cannot.

Best Value
Sale
Under Desk Cable Management Tray No Drill, Metal Mesh Cable Management Under Desk with Clamp Mount, 2 Hole Cable Tray with Wire Management and Cord Organizer for Home Office Standing Desk
  • 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
  • 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
  • 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
  • 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
  • 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.

Security and operational practices

  • Require encryption with smtp_tls_security_level = encrypt so credentials never fall back to plaintext.
  • Keep both sasl_passwd and sasl_passwd.db owned by root with mode 600.
  • Create a separate app password for each application or device where policy allows it. Revoke the individual credential when the host is retired.
  • Rotate the app password after an account password change and rebuild the map immediately.
  • Limit local access to Postfix. A relay host that accepts arbitrary unauthenticated submissions from the network can become an open relay.
  • Monitor the journal and queue so authentication failures, repeated deferrals, and unexpected volume are noticed before Google throttles the account.
  • Keep the envelope sender consistent with the authenticated mailbox or the Workspace relay rule. Authentication alone does not guarantee that every sender address is authorized.

Google may filter suspicious messages even when SMTP authentication succeeds. The published 2,000-message-per-day figure for the Gmail SMTP option and 10,000-recipient-per-user-per-day figure for Workspace SMTP relay are service guidance, not a promise that every message will be accepted.

Configuration checklist

  1. Install Postfix, SASL client modules, and certificate authorities from Ubuntu’s package system.
  2. Choose the mailbox service (smtp.gmail.com) or the administrator-managed Workspace relay (smtp-relay.gmail.com).
  3. For the mailbox route, enable Two-Step Verification and create an app password.
  4. Set relayhost, SASL authentication, and mandatory TLS in main.cf.
  5. Write the exact bracketed host-and-port key and complete account address to /etc/postfix/sasl_passwd.
  6. Protect the files, run postmap, and restart Postfix.
  7. Send a controlled test and confirm TLS, authentication, and final delivery in journalctl -u postfix.
  8. Resolve sender-policy, quota, or network errors before putting production applications on the relay.

Frequently Asked Questions

What should I put in Postfix relayhost for Gmail?

For an authenticated Gmail or Google Workspace mailbox, use relayhost = [smtp.gmail.com]:587. The brackets and port must also appear exactly in the SASL password-map key.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Why does Gmail reject my normal Postfix password?

A non-interactive Postfix client should use a Google app password, not the account’s ordinary password. App passwords require Two-Step Verification and may be disabled by Workspace policy or Advanced Protection.

Can I use smtp-relay.gmail.com instead of smtp.gmail.com?

Only when a Google Workspace administrator has configured the SMTP relay service. It uses different authentication, source-IP, sender, and policy controls; do not substitute the hostname while keeping mailbox app-password assumptions.

Should I use port 587 or 465?

Use port 587 with STARTTLS and smtp_tls_security_level = encrypt for the simplest Postfix setup. Port 465 uses implicit SSL and requires smtp_tls_wrappermode = yes; its password-map key must end in :465.

Why do I get a 535 authentication error after creating an app password?

Check the full account address, regenerate the app password if necessary, confirm Two-Step Verification and Workspace policy, match the bracketed host-and-port key, rerun postmap, and restart Postfix.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What does “Must issue STARTTLS first” mean?

Postfix attempted authentication or delivery before encryption. Confirm port 587, mandatory TLS encryption, and that a firewall or proxy is not interfering. For port 465, configure wrapper mode rather than STARTTLS.

Where is the Postfix Gmail credential stored?

It belongs in /etc/postfix/sasl_passwd and its generated .db map. Keep both files root-owned with mode 600 and rebuild the map after every edit.

How many messages can this relay send?

Google’s current guidance lists 2,000 messages per day for the Gmail SMTP option and 10,000 recipients per user per day for Workspace SMTP relay. Filtering, temporary blocks, and organization policies can impose additional restrictions.

The Bottom Line

For a send-only Ubuntu host using one Gmail or Workspace mailbox, install Postfix and the SASL modules, set [smtp.gmail.com]:587, require STARTTLS, and authenticate with a Google app password stored in a root-only postmap database. Match the host-and-port key exactly, test through journalctl, and keep sender policy and Google’s service limits in mind. Use smtp-relay.gmail.com only when a Workspace administrator has configured that separate relay service.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.