Outgoing SMTP Authentication
When you need to route all outgoing mail through your ISP's MTA, and that MTA requires that you authenticate, certain settings in postfix are required.
For this example, we will use mailrelay.example.com as the outgoing relay The authentication user will be username The password will be password
The outbound destination should be the canonical address. postfix will resolve CNAMEs to canonical addresses and then use that to lookup the username and password .
Godaddy example: smtpout.secureserver.net is really smtp.starfieldtech.com, so make sure you enter smtp.starfieldtech.com nslookup smtpout.secureserver.net ... Non-authoritative answer: smtpout.secureserver.net canonical name = smtp.starfieldtech.com. Name: smtp.starfieldtech.com Address: 22.214.171.124
Setting a relay host
Set the relay host in the admin console, MTA tab to point to your ISPs outgoing mail server. Your ISP can tell you the proper value for this. You may have to set the port, as well.
zmprov ms server.domain.com zimbraMtaRelayHost external.relay.com:#
Enabling smtp authentication
Run all these commands as the zimbra user
Create a text file mapping which name/password should be used for each given outbound destination:
echo mailrelay.example.com username:password > /opt/zimbra/conf/relay_password
Create a postfix lookup table
Test that the map is okay
postmap -q mailrelay.example.com /opt/zimbra/conf/relay_password
This should return username:password if done right
Make postfix use the above
postconf -e smtp_sasl_password_maps=hash:/opt/zimbra/conf/relay_password postconf -e smtp_sasl_auth_enable=yes
postconf -e smtp_cname_overrides_servername=no This last one might be MORE THEN VERY IMPORTANT if you want it to work and
not to loose 3 days searching the internet and trying every possible configurations you can find as I did!. We may say it's not the best secure way to do it but you can improve security with smtp_tls_per_site once it works and once you know that the authentication works. If you apply smtp_tls_per_site settings then smtp_cname_overrides_servername may become obsolete.
The purpose of using smtp_cname_overrides_servername=no is because many smtp servers use load balancing or other technology witch cause your machine to send or forward the outgoing emails to a server having a different name then the one set in the smtp_sasl_password_maps file. Example of the problem :
/opt/zimbra/conf/relay_password : smtp.gmail.com firstname.lastname@example.org:password
but postfix connect to gmail-smtp.l.google.com
What happens is that postfix will not send the authentication info contained in smtp_sasl_password_maps file because it as no entry for the server gmail-smtp.l.google.com but has one for smtp.gmail.com
Using directly gmail-smtp.l.google.com everywhere COULD resolve the problem too but may cause two others problems. First, the server gmail-smtp.l.google.com may not accept direct connections. Second, the day it goes down you are screwed! Using the server CNAME entry or whatever it can be as smtp.gmail.com in this exemple is a much better way to make it works.
Finally if youre using a Zimbra package (some readers may land here looking for POSTFIX config) and if you have been searching the internet or are about to do so for troubleshooting youre installation, DON'T use the brakets  for the server name definition as we can see in many places. Exp.:[smtp.gmail.com]
By the way if you intent to use smtp.gmail.com make it works on the port 587. Port 25 gave me timeout as well did port 465. Exp.: relayhost=smtp.gmail.com:587
Good luck! - Frederik Bacon -
After sending a test message, check the Log Files for the error:
(Authentication failed: cannot SASL authenticate to server ...: no mechanism available)
You can fix this problem by tweaking the auth mechanisms that postfix is willing to use. First check what auth mechanism postfix is configured to use - by default, you will see:
$ postconf smtp_sasl_security_options smtp_sasl_security_options = noplaintext, noanonymous
Since noplaintext is present, postfix will refuse to use a mechanism that sends passwords in the clear. If your upstream relay host only supports PLAIN or LOGIN mechanisms (both of which send password in the clear), you have to remove noplaintext from smtp_sasl_security_options:
$ postconf -e smtp_sasl_security_options=noanonymous $ postfix reload
If you are concerned about password-in-the-clear and your upstream relay host offers TLS, you might be interested in this smtp_use_tls variable.
See also .
Persistence across Zimbra upgrades
I just did an upgrade of Zimbra 5.0.5 to 5.0.8 after doing the above - and all of the relay smtp auth changes stayed - they were not wiped out by the upgrade.