Get started¶

Two types of mail servers ¶

We use two types of mail server setups: “simple” and “full”.

Simple	Full
Send email notifications from cron, monit, Djanfo to the system admins	Send emails to external recipients, business partners
Just postfix. No need for STARTTLS, DKIM, Dovecot.	Needs STARTTLS, DKIM, Dovecot
FQDN is my.domain.org	FQDN is mydomain.org

Before installing Postfix ¶

Set up your DNS records (aka zone file):

For a simple mail server you just set up an A record in your zone file that makes your FQDN point to your server’s IP address.

Type	Host	Priority	Destination
A	my.domain.org		12.34.56.78

For a full mail server, you also need an MX record.

Type	Host	Priority	Destination
A	mydomain.org		12.34.56.78
A	mail.mydomain.org		12.34.56.78
MX	mydomain.org.	10	mail.mydomain.org

Why this additional A record for mail.mydomain.org instead of simply letting the MX record point to mydomain.org? In a small system, both names resolve to the same IP address. But it can make sense to have your mail server on a different machine than your web server or other application servers. Already for security reasons. Or in order to be scalable. It seems that the mail subdomain (or sometimes smtp or mx) is general practice.

Note : the domain given by the MX record (the FQDN of our mail server) needs to have its separate A record. Just a CNAME is not enough for a mail server.

Install Postfix ¶

Installing Postfix on Debian will automatically uninstall exim4:

$ sudo apt install postfix

Installing Postfix will start by asking you to select a “General mail configuration type”:

No configuration
Internet Site
Internet with smarthost
Satellite system
Local only

You select either “Internet” or “Internet with smarthost”. “Smarthost” is a historical word for a relay host.

In both cases the installer then asks for your system’s mail name:

┌─────────────────────────┤ Postfix Configuration ├────────────────────────
│ The 'mail name' is the domain name used to 'qualify' _ALL_ mail
│ addresses without a domain name. This includes mail to and from <root>:
│ please do not make your machine send out mail from root@example.org
│ unless root@example.org has told you to.
│
│ This name will also be used by other programs. It should be the single,
│ fully qualified domain name (FQDN).
│
│ Thus, if a mail address on the local host is foo@example.org, the
│ correct value for this option would be example.org.
│
│ System mail name:
│
│ mydomain.org
│
│                    <Ok>                        <Cancel>
│
└──────────────────────────────────────────────────────────────────────────

mail name¶: The fully qualified domain name of your server, without any special subdomain, i.e. just the name after the @ of the email addresses for which you want to manage mails.

The Postfix installer stores your answer to this question in /etc/mailname, a one-line text file used by every well-educated MTA to know its own hostname (source). You can verify this after installation:

$ cat /etc/mailname
mydomain.org

When you selected “Internet with smarthost”, you get a next question asking for the name of your relay host:

┌─────────────────────────┤ Postfix Configuration ├────────────────────────
│ Please specify a domain, host, host:port, [address] or [address]:port.
│ Use the form [destination] to turn off MX lookups. Leave this blank for
│ no relay host.
│
│ Do not specify more than one host.
│
│ The relayhost parameter specifies the default external host to send mail
│ to when no entry is matched in the optional transport(5) table. When no
│ relay host is given, mail is routed directly to the destination.
│
│ SMTP relay host (blank for none):
│
│ smtp.zone.eu
│
│                    <Ok>                        <Cancel>
│
└──────────────────────────────────────────────────────────────────────────

Some typical answers:

relay.ovh.com (https://www.ovhcloud.com)
smtp.zone.eu (https://www.zone.ee)

After installing Postfix ¶

Check your /etc/aliases file. It should contain something like:

monit: root
info: root
postmaster: root
cron: root
root: me@mydomain.org

Don’t forget to compile the /etc/aliases file after editing it:

# newaliases

Here is my recipe for configuring a simple mail server:

# postconf myhostname=`cat /etc/mailname`
# systemctl restart postfix

To verify the basic parameters of a simple mail server:

# postconf myhostname mydestination myorigin
myhostname = mydomain.org
mydestination = $myhostname,localhost
myorigin = /etc/mailname

If you use monit, then check /etc/monit/conf.d/lino.conf and add the following lines:

set mailserver localhost
set alert me@mydomain.org

Credentials for a relay host ¶

If you use a relay host and your relay host requires a username and password, then you need to install SASL. Install the library modules:

$ sudo apt-get install libsasl2-modules

Write your credentials to the sasl_password file:

$ sudo nano /etc/postfix/sasl_passwd

Example content:

smtp.zone.eu:587 vps@mydomain.org:1234abcd

After editing your sasl_passwd file, you must compile it:

$ sudo postmap /etc/postfix/sasl_passwd

And your sasl_passwd file must be accessible only by root:

$ sudo chmod 600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db

And in your /etc/postfix/main.cf file you must instruct Postfix to use this file:

smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous

More settings in the /etc/postfix/main.cf file:

smtp_tls_security_level = encrypt
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3

Reverse DNS ¶

For an independent mail server you must make sure that the PTR record (also known as Reverse DNS) of your IP address is configured correctly.

Check whether your PTR record is correctly set:

$ sudo apt install dnsutils
$ nslookup mydomain.org
Name: mydomain.org
Address: 12.34.56.78

$ dig -x 12.34.56.78
;; ANSWER SECTION:
78.56.34.12.in-addr.arpa. 86400 IN PTR mydomain.org.

Otherwise see Reverse DNS (PTR record).

Enable TLS ¶

Postfix uses TLS as a server when receiving mail (SMTPD) and as a client when sending mail (SMTP). Both need to be configured separately.

Use certbot to install a certificate for the mail server:

# certbot certonly --standalone -d mail.mydomain.org

It is possible that you need to stop nginx before running above command.

# General TLS parameters:

smtpd_tls_cert_file=/etc/letsencrypt/live/my.domain.org/fullchain.pem
smtpd_tls_key_file=/etc/letsencrypt/live/my.domain.org/privkey.pem

# How postfix handles incoming SMTP connections:

smtpd_tls_security_level = may
smtpd_use_tls=yes

# How postfix handles outgoing SMTP connections:

smtp_tls_security_level = may
smtp_use_tls=yes


# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination

Get started¶

Two types of mail servers¶

Before installing Postfix¶

Install Postfix¶

After installing Postfix¶

Credentials for a relay host¶

Reverse DNS¶

Enable TLS¶