Install | Topics | Beyond Lino

Full mail server

Install Dovecot

Install the Debian packages:

# apt install dovecot-pop3d  # optional
# apt install dovecot-imapd  # optional

Create a file /etc/dovecot/local.conf and add the following content:

listen = *, ::

auth_mechanisms = plain login

mail_driver = maildir
mail_path = ~/Maildir
mail_inbox_path = ~/Maildir/.INBOX

ssl_server_cert_file = /etc/letsencrypt/live/mail.mydomain.org/fullchain.pem
ssl_server_key_file = /etc/letsencrypt/live/mail.mydomain.org/privkey.pem

IMPORTANT: Mail location parameters should be in sync. Above means that the postfix config parameter is home_mailbox = Maildir/.

Control the Dovecot service:

# systemctl restart dovecot

Using hints from:

Install DKIM

This recipe uses mail as the selector. Selectors are used when you have more than one key per domain, e.g. one for “advertisement” and another for “invoicing”. Common alternative values for the default selector are dkim or simply default.

Install the system package:

# apt install opendkim opendkim-tools

Edit your /etc/opendkim.conf and set the following values:

Domain                  mydomain.org
Selector                mail
      KeyFile                 /etc/dkimkeys/mail.private
Socket local:/var/spool/postfix/opendkim/opendkim.sock

Add user “postfix” to group “opendkim”:

# adduser postfix opendkim

Edit your /etc/postfix/main.cf and set the following values:

milter_default_action = accept
milter_protocol = 6
smtpd_milters = local:opendkim/opendkim.sock
non_smtpd_milters = $smtpd_milters
milter_mail_macros =  i {mail_addr} {client_addr} {client_name} {auth_type} {auth_authen}

Generate your DKIM key:

# opendkim-genkey -r -h rsa-sha256 -d mydomain.org -D /etc/dkimkeys -s mail

This will create two files, mail.private and mail.txt in /etc/dkimkeys. The private key is used to sign outgoing emails.

Both files are readable only by their owner. Change the owner and group of these files to opendkim:

# chown -Rv opendkim:opendkim /etc/dkimkeys/mail.*

Paste the public key into a TXT record of your DNS zone file:

# cat /etc/dkimkeys/mail.txt
mail._domainkey       IN      TXT     ( "v=DKIM1; h=rsa-sha256; k=rsa; s=email; "
mail._domainkey       IN      TXT     ( "v=DKIM1; h=sha256; k=rsa; t=y; "
        "p=AySFjB...very"
        "long string...xorQAB" )  ; ----- DKIM key mail for mydomain.org

The result in your provider’s admin platform should look:

v=DKIM1; h=rsa-sha256; k=rsa; p=AySFjB...very long string...xorQAB

It might take some time for changes to propagate.

Restart the services:

# systemctl restart postfix opendkim

Create /etc/opendkim/KeyTable and add the following line:

mydomain.org mydomain.org:mail:/etc/opendkim/keys/mail.private

Create /etc/opendkim/SigningTable and insert:

*@mydomain.org mail._domainkey.mydomain.org

Finally, create /etc/opendkim/TrustedHosts and insert:

127.0.0.1
::1
localhost
*.mydomain.org

SPF

To enable SPF, the following should be applied. First, install corresponding postfix package:

# apt install postfix-policyd-spf-python

Second, append postfix settings to /etc/postfix/master.cf:

policyd-spf unix - n n - 0 spawn user=policyd-spf argv=/usr/bin/policyd-spf

and to /etc/postfix/main.cf:

policyd-spf_time_limit = 3600 smtpd_recipient_restrictions = … , check_policy_service unix:private/policyd-spf

Test your configuration

Use opendkim-testkey:

$ sudo apt install opendkim-tools
$ sudo opendkim-testkey -d mydomain.org -s mail -vvv

opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: key loaded from /etc/dkimkeys/mail.private
opendkim-testkey: checking key 'mail._domainkey.mydomain.org'
opendkim-testkey: key secure
opendkim-testkey: key OK