The history of Postfix: the mail system born at IBM

In 1997, Wietse Venema, at the IBM Thomas J. Watson Research Center, began writing an MTA so he would not have to live with Sendmail. On December 14, 1998, the code became open. It was called VMailer, then IBM Secure Mailer, then Postfix — “post” for mail, “fix” for repair. Twenty-eight years later, Postfix 3.11.6 (August 10, 2026) still delivers mail on more Shodan-visible servers than Exim, and remains the default in many distros, including Ubuntu.

Watson, Sendmail, and a stubborn Dutchman

Wietse Venema was already well known before Postfix. TCP Wrapper (hosts.allow / hosts.deny), SATAN, security work at Eindhoven University of Technology and later IBM. Eric Allman's Sendmail was the Unix world's MTA: a monolith, configuration that looks like an alien urinal (sendmail.cf), a history of holes. Venema wanted three things Sendmail did not provide for free: security by design, performance under load, and administration a human could read.

IBM allowed the code to be opened. The first name, VMailer, ran into a trademark. IBM Secure Mailer was a laboratory name. Postfix stuck: mail, and the bugfix. IBM Public License 1.0 — OSI-approved, but with a patent clause some projects avoid. Starting with 3.2.5, the code is also available under Eclipse Public License 2.0, at the distributor's choice. Dual licensing, the same “use it without a lawsuit” spirit.

The design: one master and many pieces

Postfix's trick is not a fat daemon. It is a master process that spawns children with minimal privileges, each with one job. The one speaking SMTP on port 25 is smtpd. The one delivering to the local mailbox is local (or virtual). The one managing the queue is qmgr. The one rewriting addresses is trivial-rewrite. The one sending to another MX is smtp. There is pickup, cleanup, bounce, defer, error, flush, proxymap, verify, anvil, scache, tlsproxy, postscreen, dnsblog.

If smtpd suffers an overflow, the rest of the queue does not go down with it. Each service has optional chroot, its own UID, and memory and time limits. This is what Venema designed in 1997, when Sendmail advisories still appeared weekly. The queue lives in /var/spool/postfix — incoming, active, deferred, hold, corrupt. postqueue -p and postsuper are the daily routine. main.cf fits on one screen; master.cf lists the services.

Why it beat Sendmail (and ties with Exim)

During the 2000 decade, Sendmail was still the default in many distros. Postfix came in through Ubuntu, Fedora, and administrators who had run a real server and no longer wanted m4. Dan Bernstein's Qmail had the same security obsession — and a license that held distros back. Cambridge's Exim became strong in shared hosting (cPanel). OpenSMTPD is OpenBSD's. Postfix landed in the middle: modular like Qmail, configurable like a serious tool, with a license Debian could accept.

A small survey (E-Soft, February 2025) still put Exim ahead. A broad Shodan scan in mid-August 2026: Postfix ~2,1 million detections, Exim ~1,9 million. Some sites block Shodan; even so, the order reversed. Default on Ubuntu Server. Present in appliances, underneath Zimbra, on mailing lists, in corporate relays that do not want Exchange.

TLS, milter, postscreen: the grown-up MTA

The Postfix of 1998 spoke classic SMTP. The one of 2026 speaks everything else mail needed to avoid becoming junk:

• TLS (STARTTLS and port 465), DANE/TLSA, PFS, SNI.
• Milter — the same API Sendmail invented — for SpamAssassin, OpenDKIM, OpenDMARC, rspamd.
• postscreen in front of smtpd: inexpensive greylisting, dropping bots that do not speak SMTP properly before spending a heavyweight process.
• SASL (SMTP AUTH), submission 587, filter header_checks / body_checks, policy daemon in smtpd_recipient_restrictions.
• MySQL, PostgreSQL, LDAP, SQLite as maps. Virtual mailboxes without Unix accounts.

Anyone building a mail stack on this blog still goes through Zimbra — which uses Postfix underneath — in Installing Zimbra 8.7.1 on Ubuntu. The classic virtual mailbox panel is covered in The history of PostfixAdmin; its Go successor, in go-postfixadmin. The hosting panel born around the same time is covered in The History of the ISPConfig Project.

2026: 3.11.6, Qualys, and the mouse that will not retire

Stable 3.11.0 came out on March 5, 2026. Version 3.11.6, on August 10, brought a medium-impact fix: remote DoS and policy bypass. Qualys, with help from Claude Mythos Preview, and OpenAI's security team found most of them — more than half the defects were twenty years old or older. Venema was direct in the announcement: when he implemented Postfix, he already knew there would be errors; hence the architecture and safety nets. One hundred and fifty thousand lines, a defect rate below what he had designed it to withstand.

The supported stable versions in September 2026 are 3.11, 3.10, 3.9, and 3.8. Version 3.7 reached end of life on March 6, 2026. Experimental 3.12 snapshots are already circulating. The gray mouse with the yellow bag labeled MAIL — Andrzej Adam Filip's mysza — remains the official mascot.

And the author? Wietse Venema left IBM in 2015, after eighteen years at Watson, and in the same year joined Google, where he stayed for eight years — leaving in 2023 and continues to this day as Postfix's maintainer. Development is public: the code is on GitHub, github.com/vdukhovni/postfix (maintained with Viktor Dukhovni); the canonical site remains at postfix.org.

Timeline

• 11/1996 — Wietse Venema arrives at the IBM Thomas J. Watson Research Center;
• 1997 — starts writing the MTA that would replace Sendmail in his life;
• 14/12/1998 — public beta of IBM Secure Mailer (later Postfix);
• 2005-2011 — the MTA matures: TLS and IPv6 in the core, Milter, postscreen;
• 2015 — Postfix 3.0; Venema leaves IBM and joins Google;
• 01/2018 — dual IPL 1.0 / EPL 2.0 licensing starting with 3.2.5;
• 2023 — Venema leaves Google after eight years; remains the project's maintainer;
• 10/08/2026 — audits by Qualys (with AI) and OpenAI's security team result in 3.11.6;
• 09/2026 — snapshots of the upcoming 3.12 in public testing.

Version and release timeline

• 12/1998 — first public version (still as IBM Secure Mailer);
• 2002 — Postfix 1.1 and, at year's end, 2.0: the modern foundation for the queue and configuration;
• 03/2005 — 2.2: TLS and IPv6 integrated into the main code;
• 07/2006 — 2.3: support arrives for Milter, opening the door to DKIM/DMARC and antispam;
• 01/2011 — 2.8: postscreen starts blocking bots before smtpd;
• 01/2014 — 2.11: support for DANE/TLSA;
• 02/2015 — 3.0: dynamic maps and SMTPUTF8 (internationalized email);
• 28/02/2017 — 3.2.0;
• 28/01/2018 — 3.2.5: dual IPL 1.0 / EPL 2.0 licensing;
• 27/02/2019 — 3.4.0: SNI in the TLS server;
• 2020-2025 — annual cadence at the end of the American winter: 3.5 (16/03/2020), 3.6 (29/04/2021), 3.7 (05/02/2022), 3.8 (17/04/2023), 3.9 (06/03/2024), 3.10 (16/02/2025);
• 05/03/2026 — 3.11.0, the current stable version; 3.11.6 (10/08/2026) brought the Qualys/OpenAI audit fixes;
• Today — supported: 3.11, 3.10, 3.9, and 3.8 (the four latest stable versions, as usual); 3.7 retired on 06/03/2026.

Wrap-up

A Dutch researcher at IBM, a monolith everyone feared, and a design based on small processes. Sendmail did not die on day one; it was gradually uninstalled. Postfix is not “modern” in the sense of Go and YAML. It is C, main.cf and a master that does not trust its children. That is why it is still on port 25.

The broader Unix/Linux history on this blog is in The History of Operating Systems, UNIX — The Origin of Systems and Linux turns 35. The hypervisor many people use to virtualize their MX is covered in Proxmox.

From Watson to 3.11.6: the mail system Sendmail did not provide. IPL or EPL 2.0, on-disk queue, mouse with a yellow bag. Twenty-eight years, and the mailq still responds.