Note: this web page is no longer maintained. It exists only to avoid breaking links in web pages that describe earlier versions of the Postfix mail system.Up one level | Introduction | Goals and features | Global architecture | Queue Management | Security
Postfix is implemented as a resident master server that runs Postfix daemon processes on demand: daemon processes to send or receive network mail messages, daemon processes to deliver mail locally, etc. These processes are created up to a configurable number, are re-used for a configurable number of times, and go away after a configurable amount of idle time. This approach drastically reduces process creation overhead while still providing the good insulation from separate processes.
Postfix is intended to be a Sendmail replacement. For this reason it tries to be compatible with existing infrastructure. However, many parts of the Postfix system, such as the local delivery program, are easily replaced by editing an inetd-like configuration file. For example, the plan is to provide an alternate local delivery program that runs at a fixed low privilege, for POP/IMAP users that never log into the shell, and that may not even have a UNIX account.
As a result of this architecture, Postfix is easy to strip down to the bare minimum. Subsystems that are turned off cannot be exploited. Firewalls do not need local delivery. On client workstations, one disables both the smtp listener and local delivery subsystems; or the client mounts the maildrop directory from a file server, and runs no resident Postfix processes at all.
The amount of information passed on between Postfix processes is limited. In many cases, the only information exchanged between Postfix processes is a queue file name and a list of recipients or some status information. Once an email message is saved to file it stays there until it is read by a mail delivery program.
Postfix takes the usual precautions to avoid loss of information: flush and fsync() all data before acknowledging receipt, and check all system call results for error conditions. This style of programming may be new to some people, but I can assure you that it has been standard practice for years in many places.