Sending Email from an Ubuntu VM on Oracle Cloud (OCI)

Sending email from a cloud VM sounds trivial until you try it on Oracle Cloud Infrastructure. If you’ve seen emails bounce with 535 Authentication required, or worse, show status=sent but never arrive, this covers why and how to fix it: why OCI blocks direct SMTP, how OCI Email Delivery actually works, a working Postfix configuration, the mail flow end to end, the common errors, and SPF/DKIM/DMARC.

1. The OCI SMTP reality

OCI blocks direct outbound SMTP from compute instances. Port 25 is always blocked, and running Postfix alone will not work. Instead, OCI provides Email Delivery, a managed SMTP relay.

High-level flow

+-------------+        +---------------------+        +-------------+
| Ubuntu VM   | -----> | OCI Email Delivery  | -----> | Recipient    |
| (Postfix)   | 587    | (SMTP Relay)        |        | (Gmail, etc) |
+-------------+        +---------------------+        +-------------+

Your VM authenticates to OCI, and OCI sends the email on your behalf.

2. Create OCI Email Delivery SMTP credentials

In the OCI Console:

Email Delivery → SMTP Credentials → Create SMTP Credential

You’ll get:

• SMTP username

• SMTP password

• Regional SMTP endpoint, e.g.

  smtp.email.uk-london-1.oci.oraclecloud.com

These credentials are not your OCI user password.

3. Install Postfix on Ubuntu

sudo apt update
sudo apt install postfix mailutils libsasl2-modules -y

During setup, select Internet Site. The system mail name doesn’t matter yet, the sender gets fixed later.

4. Configure Postfix to use OCI SMTP

Edit Postfix config:

sudo nano /etc/postfix/main.cf

Add or verify:

relayhost = [smtp.email.uk-london-1.oci.oraclecloud.com]:587

smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous

smtp_use_tls = yes
smtp_tls_security_level = encrypt
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

5. Configure SMTP credentials

Create credential file:

sudo nano /etc/postfix/sasl_passwd

The hostname must match relayhost exactly:

[smtp.email.uk-london-1.oci.oraclecloud.com]:587 SMTP_USERNAME:SMTP_PASSWORD

Apply and secure:

sudo chmod 600 /etc/postfix/sasl_passwd
sudo postmap /etc/postfix/sasl_passwd
sudo systemctl restart postfix

6. Test email sending

echo "Hello from OCI" | mail -s "OCI Test" your@gmail.com

Check logs:

sudo tail -f /var/log/mail.log

7. Understanding the mail flow

[Local App / cron]
        |
        v
+-----------------+
| Postfix (VM)    |
| - Rewrites From |
| - Authenticates |
+-----------------+
        |
        v  (SMTP 587 + SASL + TLS)
+---------------------------+
| OCI Email Delivery        |
| - Checks approved sender  |
| - Applies DKIM            |
+---------------------------+
        |
        v
[Internet Mail Servers]

If any step fails, mail is bounced or silently suppressed.

8. Common error #1: 535 Authentication required

Log output

status=bounced
535 Authentication required

Causes

• sasl_passwd key mismatch
• Forgot postmap
• Wrong SMTP credentials
• Missing libsasl2-modules

Debug command

sudo postmap -q "[smtp.email.uk-london-1.oci.oraclecloud.com]:587" /etc/postfix/sasl_passwd

If this returns nothing, Postfix can’t see the credentials.

9. Common error #2: status=sent but the email never arrives

OCI requires approved sender addresses. If Postfix sends mail as ubuntu@dev.internal.oraclevcn.com, OCI may accept the SMTP session but drop delivery silently.

10. Fix: set a default approved sender

Step 1: Approve sender in OCI

Email Delivery → Approved Senders

Example:

no-reply@yourdomain.com

Step 2: Rewrite sender in Postfix

Create generic map:

sudo nano /etc/postfix/generic

ubuntu@dev.internal.oraclevcn.com  no-reply@yourdomain.com
ubuntu@dev                         no-reply@yourdomain.com

Enable it:

sudo nano /etc/postfix/main.cf

smtp_generic_maps = hash:/etc/postfix/generic

Apply:

sudo postmap /etc/postfix/generic
sudo systemctl restart postfix

11. SPF, DKIM, and DMARC

Without these, emails land in spam or get rejected outright.

SPF (Sender Policy Framework)

Tells receivers who is allowed to send for your domain.

Add this TXT record to your DNS:

v=spf1 include:spf.email.uk-london-1.oci.oraclecloud.com ~all

Diagram:

Receiver → DNS → "Is OCI allowed to send for this domain?"

DKIM (DomainKeys Identified Mail)

OCI signs outgoing emails with a cryptographic signature.

Steps:

1. Enable DKIM in OCI Email Delivery
2. Add the provided CNAME records to DNS

Diagram:

Email → Signed by OCI → Receiver verifies DKIM via DNS

DMARC (policy and reporting)

Tells receivers what to do if SPF/DKIM fails.

Start with monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Later, tighten it:

p=quarantine
p=reject

Diagram:

SPF/DKIM fail?
   |
   +--> Follow DMARC policy

12. Troubleshooting checklist

• Check logs: sudo tail -f /var/log/mail.log

• Verify Postfix config: postconf -n

• Check SMTP connectivity:

  nc -vz smtp.email.uk-london-1.oci.oraclecloud.com 587

• Check OCI suppression list:

  Email Delivery → Suppressions

OCI Email Delivery is reliable and production-grade, but the setup has sharp edges: authentication must be exact, the sender must be approved, and DNS auth (SPF/DKIM/DMARC) is not optional. Get those three right once, and it works well for system alerts, cron jobs, and application notifications.