Postfix and Dovecot Cheat Sheet for RHEL, AlmaLinux and Rocky Linux

A one-page reference for the Postfix and Dovecot commands you actually use when running mail on Red Hat Enterprise Linux, AlmaLinux, Rocky Linux, Oracle Linux and CentOS Stream. Everything here works with the AppStream packages on EL9 (Postfix 3.5, Dovecot 2.3.16) and EL10 (Postfix 3.8, Dovecot 2.3.21). For a full server build, see Configure Postfix and Dovecot on RHEL, AlmaLinux, Rocky and Oracle Linux.

Most commands need root. Replace QUEUE_ID, alice and example.com with your own values.

Install and service control

Command	What it does
dnf install postfix dovecot	Install from AppStream (add postfix-lmdb on EL9)
dnf install postfix-perl-scripts	Adds qshape and pflogsumm
systemctl enable --now postfix dovecot	Start now and at boot
systemctl reload postfix	Re-read main.cf/master.cf without dropping connections
postfix check	Check configuration and file permissions
postfix status	Show whether the Postfix master is running
postfix flush	Attempt delivery of all deferred mail now
alternatives --display mta	Confirm Postfix owns /usr/sbin/sendmail

postconf: read and change configuration

Command	What it does
postconf -n	Show only settings changed from defaults (start here)
postconf myhostname	Show the current value of one parameter
postconf -d myhostname	Show the built-in default for a parameter
postconf -e 'relayhost = [smtp.example.com]:587'	Set a parameter in main.cf
postconf -X relayhost	Remove a parameter from main.cf (back to default)
postconf -M	List services defined in master.cf
postconf -P	List per-service -o overrides in master.cf
postconf -m	List supported lookup table types (lmdb, cdb, hash…)
postconf -a	List SASL server plugins (should include dovecot)
postconf mail_version	Show the running Postfix version

Mail queue

Command	What it does
postqueue -p	List the queue (same as mailq)
postqueue -p | tail -n 1	One-line summary: total size and number of requests
postqueue -j	Queue listing as JSON, one message per line
postqueue -f	Flush: retry all deferred mail
postqueue -i QUEUE_ID	Retry one message now
postcat -q QUEUE_ID	Show a queued message (envelope, headers, body)
postcat -hq QUEUE_ID	Show only the headers of a queued message
postsuper -d QUEUE_ID	Delete one message
postsuper -d ALL deferred	Delete every deferred message
postsuper -d ALL	Delete the entire queue (careful)
postsuper -h QUEUE_ID	Put a message on hold
postsuper -H QUEUE_ID	Release a held message
postsuper -r ALL	Requeue everything (after fixing transport or relay settings)
qshape deferred	Deferred mail grouped by destination domain and age

Delete all queued mail from one sender (useful after a compromised account):

postqueue -j | jq -r 'select(.sender=="spammer@example.com") | .queue_id' | postsuper -d -

Lookup tables and aliases

EL10 has no Berkeley DB, so hash: tables fail. Use lmdb: on both EL9 and EL10.

Command	What it does
postmap lmdb:/etc/postfix/virtual	Rebuild a table after editing the source file
postmap -q info@example.com lmdb:/etc/postfix/virtual	Look up one key in a table
postmap -q alice@example.com ldap:/etc/postfix/ldap-aliases.cf	Test an LDAP lookup table
newaliases	Rebuild /etc/aliases (same as postalias on alias_database)
postalias -q root lmdb:/etc/aliases	Show where an alias expands to
postconf -n | grep -E 'hash:|btree:'	Find Berkeley DB tables to convert before an EL10 upgrade
postconf -e 'default_database_type = lmdb'	Make lmdb the default map type

Logs and tracing

Command	What it does
tail -f /var/log/maillog	Follow Postfix and Dovecot logs (rsyslog)
journalctl -u postfix -u dovecot -f	Same from the journal, for hosts without rsyslog
grep QUEUE_ID /var/log/maillog	Follow one message through every Postfix process
grep 'status=deferred' /var/log/maillog | tail	Recent deliveries that failed temporarily
grep -E 'reject|warning|fatal' /var/log/maillog	Rejections and errors
pflogsumm /var/log/maillog	Daily traffic summary report
postconf -e 'smtp_tls_loglevel = 1'	Log outbound TLS negotiation details
postconf -e 'debug_peer_list = 192.0.2.10'	Verbose logging for one problem client only

Testing SMTP, submission and TLS

Command	What it does
echo body | mail -s test alice@example.com	Local test message (s-nail package)
sendmail -bv alice@example.com	Ask Postfix how it would deliver an address (report is mailed back)
openssl s_client -connect mail.example.com:25 -starttls smtp	STARTTLS on port 25: check certificate and chain
openssl s_client -connect mail.example.com:587 -starttls smtp	STARTTLS on submission port 587
openssl s_client -connect mail.example.com:993	IMAPS certificate check
swaks --server mail.example.com:587 --tls --auth LOGIN --auth-user alice --to you@gmail.com	Authenticated send test (swaks from EPEL)
swaks --server mail.example.com:25 --to someone@gmail.com	Open relay test from outside: must be rejected
dig +short MX example.com	Check MX record
dig +short -x 203.0.113.25	Check reverse DNS (PTR) for the mail server IP
dig +short TXT example.com	Check SPF (and other TXT) records

Dovecot: configuration and authentication

Command	What it does
doveconf -n	Show non-default Dovecot settings (and catch syntax errors)
doveconf -a | grep -E "^protocols"	Show enabled protocols
doveconf mail_location	Show one setting
doveadm reload	Reload configuration
doveadm auth test alice	Test a username and password against passdb
doveadm user alice	Show userdb result: uid, gid, home, mail location
doveadm user '*'	List all users (needs a userdb that supports iteration)
doveadm pw -s SHA512-CRYPT	Generate a password hash for SQL or passwd-file back ends
doveadm log errors	Show recent errors logged by Dovecot

Dovecot: mailboxes and sessions

Command	What it does
doveadm who	Who is logged in, from where, which protocol
doveadm kick alice	Disconnect all sessions for a user
doveadm mailbox list -u alice	List folders for a user
doveadm mailbox status -u alice messages INBOX	Count messages in a folder
doveadm search -u alice mailbox INBOX from boss@example.com	Find messages (returns GUIDs and UIDs)
doveadm expunge -u alice mailbox Trash savedbefore 30d	Purge Trash older than 30 days
doveadm move -u alice Archive mailbox INBOX before 2025-01-01	Move old mail to an Archive folder
doveadm force-resync -u alice INBOX	Rebuild indexes after corruption or manual file changes
doveadm quota get -u alice	Show quota usage (quota plugin enabled)
doveadm replicator status	Replication queue status (two-server setups)

Firewall and SELinux

Command	What it does
firewall-cmd --permanent --add-service=smtp --add-service=smtp-submission --add-service=imaps	Open 25, 587 and 993
firewall-cmd --permanent --add-service=smtps	Open 465 (implicit TLS submission)
firewall-cmd --reload && firewall-cmd --list-services	Apply and verify
semanage port -l | grep -E 'smtp|pop|imap'	Ports SELinux allows for mail daemons
semanage port -a -t smtp_port_t -p tcp 2525	Allow Postfix on a non-standard port
ausearch -m AVC -ts recent	Recent SELinux denials
getsebool -a | grep -E 'postfix|dovecot|mail'	Mail-related SELinux booleans
restorecon -Rv /home/alice/Maildir	Fix labels after copying or restoring mail

Key file locations

Path	Purpose
/etc/postfix/main.cf	Main Postfix configuration
/etc/postfix/master.cf	Postfix services (smtp, submission, smtps)
/etc/aliases	Local aliases (rebuild with newaliases)
/var/spool/postfix/	Postfix queue directories (incoming, active, deferred, hold)
/etc/dovecot/dovecot.conf	Main Dovecot configuration (includes conf.d/*.conf)
/etc/dovecot/conf.d/10-auth.conf	Authentication mechanisms and back ends
/etc/dovecot/conf.d/10-mail.conf	mail_location and mailbox settings
/etc/dovecot/conf.d/10-master.conf	Service listeners (LMTP, auth socket for Postfix)
/etc/dovecot/conf.d/10-ssl.conf	TLS certificate and key
/var/log/maillog	Mail log on EL9 and EL10 with rsyslog

Related posts

• Configure Postfix and Dovecot on RHEL, AlmaLinux, Rocky and Oracle Linux: the full server build this cheat sheet supports.
• Send Email Script CentOS: a simple script for sending mail from a server through the local MTA.