Server — Mail — Fastmail as a Relay

The mail introduction article explained why outbound mail from a homelab server needs an external relay: residential IP addresses have no sending reputation and will be treated with suspicion or rejected outright by major mail providers. The relay is the established sending infrastructure that bridges February’s outbound mail to the internet.

Fastmail is a reasonable choice for this role if you already use it as your primary email provider. The case for using it as a relay rather than a dedicated transactional mail service like Mailgun or Brevo is straightforwardly pragmatic: you are already paying for it, you already trust it, and the Postfix relay configuration is a handful of lines. For low-volume sending from a homelab server, Fastmail’s SMTP infrastructure is more than sufficient.

This article covers what makes Fastmail work as a relay, what to set up in your Fastmail account before Postfix is configured, and what Fastmail does and does not provide in this role.

What Fastmail provides as a relay

When Postfix hands outbound mail to Fastmail’s SMTP server, Fastmail handles delivery to the recipient using its own IP addresses and established sender reputation. Mail sent through Fastmail arrives with Fastmail’s sending history behind it, which means it is far less likely to be filtered or rejected than mail sent directly from February’s IP.

Fastmail applies DKIM signing to outbound mail using its own keys. This means DKIM verification for mail from your domain will pass, provided the DKIM record in PowerDNS matches Fastmail’s signing key. The DKIM setup for a custom domain hosted at Fastmail is different from the DKIM setup for a domain where Fastmail is only the relay; this is covered in the DNS records article later in the sub-series.

Fastmail also provides delivery logs in its web interface, showing whether sent mail was accepted, deferred, or bounced. For a low-volume homelab setup, this is a useful diagnostic tool when something is not delivering as expected.

What Fastmail does not provide in relay mode: dedicated IP addresses, sending volume analytics, bounce webhooks, or the detailed deliverability reporting that dedicated transactional email services offer. For February’s use cases, NUT notifications, borgmatic alerts, and the occasional application email, none of that is needed.

Plan requirements

This is worth knowing before anything else: Fastmail’s Basic plan does not include SMTP access or the ability to create app passwords. To use Fastmail as a relay, you need at least a Standard plan. If you are already a Fastmail subscriber for personal email, check which plan you are on before assuming the relay will work. Attempting to connect Postfix to Fastmail’s SMTP server from a Basic plan account will produce authentication failures with no clear error message about the plan restriction.

Creating an app password

Fastmail requires an app-specific password for any third-party service connecting via SMTP. You cannot use your regular Fastmail account password. App passwords are scoped to specific access types and can be revoked individually, which is the right model: if the Postfix configuration is ever compromised, you revoke the relay app password without touching your main account credentials.

To generate one:

1. Log in to the Fastmail web interface.
2. Go to Settings → Privacy & Security.
3. Find the Connected apps & API tokens section.
4. Click Manage app passwords and access.
5. Click New app password.
6. Give it a descriptive name. Something like February Postfix relay is clear enough to identify it six months from now.
7. For access scope, select Mail, Contacts & Calendars. You only need mail access, but this is the standard scope and does not grant anything harmful.
8. Click Generate password.
9. Copy the password immediately. Fastmail shows it once. If you navigate away without saving it, you will need to generate a new one.

Store the app password in the password manager under a clear entry name before doing anything else. The Postfix configuration will need it, and losing it means generating a replacement and updating the configuration.

SMTP settings

The settings Postfix will use to connect to Fastmail:

Fastmail supports both port 587 with STARTTLS and port 465 with implicit TLS. Port 587 is the submission standard and what the Postfix article uses. Port 465 is increasingly common and slightly simpler in terms of TLS negotiation. Either works; the Postfix configuration specifies which to use.

The username is your full Fastmail email address including the domain, for example you@fastmail.com. Not just the local part. A common misconfiguration is using only the username without the domain, which produces an authentication failure.

Custom domain considerations

If you are using a custom domain with Fastmail, meaning your primary email address is you@yourdomain.com rather than you@fastmail.com, the relay username is still your Fastmail address, not the custom domain address. Fastmail authenticates at the account level, not the domain level.

The custom domain for outbound mail is handled separately: Fastmail allows sending as a custom domain address, and the mail headers will reflect that. The authentication to Fastmail’s SMTP server uses the @fastmail.com account address regardless.

If February’s mail is configured to send as server@home.arpa or a similar internal address, the relay headers will show that Fastmail was the sending infrastructure. This is normal and expected. Major mail providers look at the authentication chain rather than just the visible sender address when evaluating deliverability.

What to have ready before Postfix configuration

By the end of this article, you should have:

An app password generated in Fastmail’s settings interface, copied to the password manager, and not used for anything else.

The SMTP host and port noted: smtp.fastmail.com:587.

Your full Fastmail username noted: the complete email address including the domain.

Your Fastmail plan confirmed as Standard or higher.

The Postfix article uses all four of these in the relay configuration. Having them ready avoids interrupting the configuration process to go back to the Fastmail interface.

If Fastmail is not the right choice

Fastmail works for a low-volume homelab relay. If the requirements are different, the alternatives are:

Mailgun and Brevo offer free tiers for low-volume transactional sending, dedicated sending infrastructure, bounce tracking, and detailed delivery analytics. The Postfix relay configuration is nearly identical: an SMTP host, a port, a username, and a password. If February ever generates significant mail volume or needs delivery reporting beyond what Fastmail’s web interface shows, either is a straightforward migration.

Self-hosted outbound delivery is possible if February has a static IP with no block list listings and you are willing to manage sender reputation from scratch. The barrier is not technical but reputational: building enough sending history to be reliably delivered to Gmail inboxes takes weeks of careful volume management. For a homelab server sending a handful of notification emails per day, it is not worth the effort when a relay solves the problem cleanly.

The Postfix article is written for Fastmail but notes where the configuration differs for other providers. Switching relay providers later is a configuration change, not an architectural one.