computing:mailserver
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| computing:mailserver [2025/04/12 23:17] – oemb1905 | computing:mailserver [2025/05/15 19:21] (current) – oemb1905 | ||
|---|---|---|---|
| Line 11: | Line 11: | ||
| ------------------------------------------- | ------------------------------------------- | ||
| - | This tutorial is for users of Debian GNU/Linux who want to set up a proper email server.. This tutorial assumes you know how to set up A, AAAA, SPF, DKIM, DMARC, MX, and PTR records. Set an A record for example.org and mail.example.org. If you don't know how, then learn up, and do not proceed. //Thanks to LinuxBabe for a great jumping off point//. Let's begin by editing our hosts file '' | + | This tutorial is for users of Debian GNU/Linux who want to set up a proper email server.. This tutorial assumes you know how to set up A, AAAA, SPF, DKIM, DMARC, MX, and PTR records. Set an A record for example.org and mail.example.org |
| 127.0.1.1 example.org example | 127.0.1.1 example.org example | ||
| Line 22: | Line 22: | ||
| sudo apt install ufw | sudo apt install ufw | ||
| sudo ufw allow 22/tcp | sudo ufw allow 22/tcp | ||
| - | sudo ufw allow 53/tcp | ||
| sudo ufw allow 25/tcp | sudo ufw allow 25/tcp | ||
| sudo ufw allow 587/tcp | sudo ufw allow 587/tcp | ||
| sudo ufw allow 143/tcp | sudo ufw allow 143/tcp | ||
| + | sudo ufw allow 465/tcp | ||
| sudo ufw allow 993/tcp | sudo ufw allow 993/tcp | ||
| sudo ufw allow 80 | sudo ufw allow 80 | ||
| Line 125: | Line 125: | ||
| < | < | ||
| - | Let's make sure dovecot is part of the mail group with '' | + | Let's make sure dovecot is part of the mail group, including any users you intend to use email: |
| + | |||
| + | | ||
| + | sudo adduser username mail | ||
| + | |||
| + | Now we can configure dovecot | ||
| service lmtp { | service lmtp { | ||
| Line 182: | Line 187: | ||
| | | ||
| | | ||
| + | |||
| + | You also need to make sure that your spf policy is not set to reject emails by default. | ||
| + | |||
| + | nano / | ||
| + | | ||
| + | Make sure that '' | ||
| + | |||
| + | HELO_reject = False | ||
| + | Mail_From_reject = False | ||
| Now, it is time to set up DKIM on your server. After creating the DKIM record/key on your server, you will need to create a corresponding TXT record for it to establish that anything over smtp with that signature is, in fact, you/your server. Let's install opendkim with '' | Now, it is time to set up DKIM on your server. After creating the DKIM record/key on your server, you will need to create a corresponding TXT record for it to establish that anything over smtp with that signature is, in fact, you/your server. Let's install opendkim with '' | ||
| Line 200: | Line 214: | ||
| sudo chmod 711 / | sudo chmod 711 / | ||
| | | ||
| - | Once all the directories and key locations are created, let's open the signing table with '' | + | Once all the directories and key locations are created, let's open the signing table with '' |
| - | *@example.com | + | |
| - | *@*.example.com | + | |
| Now that the signing table is setup, we need to edit the key table with '' | Now that the signing table is setup, we need to edit the key table with '' | ||
| Line 211: | Line 225: | ||
| The trusted hosts is next, over in '' | The trusted hosts is next, over in '' | ||
| + | 127.0.0.1 | ||
| + | localhost | ||
| .domain.com | .domain.com | ||
| | | ||
| Line 249: | Line 265: | ||
| AuthservID OpenDMARC | AuthservID OpenDMARC | ||
| TrustedAuthservIDs mail.yourdomain.com | TrustedAuthservIDs mail.yourdomain.com | ||
| - | RejectFailures | + | RejectFailures |
| IgnoreAuthenticatedClients true | IgnoreAuthenticatedClients true | ||
| + | RequireHeaders true | ||
| SPFSelfValidate true | SPFSelfValidate true | ||
| Socket local:/ | Socket local:/ | ||
| Line 361: | Line 378: | ||
| # | # | ||
| report_safe 0 | report_safe 0 | ||
| - | | + | add_header all Spam-Flag _YESNO_ |
| - | #add_header all Flag _YESNO_ | + | |
| - | | + | add_header all Report _REPORT_ |
| - | | + | add_header all Level _STARS_ |
| - | #add_header all Level _STARS_ | + | |
| - | #add_header all Checker-Version " | + | add_header all Checker-Version " |
| + | # | ||
| + | # | ||
| I included some header options, which can help with debugging. Also, I disable safe reporting and Subject rewriting because they alter the original email, which I think is overkill. In order to activate all that spam assassin can do, we need to have our own recursive DNS resolver, required by RBL services. Let's use the DNS server unbound and install it as follows '' | I included some header options, which can help with debugging. Also, I disable safe reporting and Subject rewriting because they alter the original email, which I think is overkill. In order to activate all that spam assassin can do, we need to have our own recursive DNS resolver, required by RBL services. Let's use the DNS server unbound and install it as follows '' | ||
| Line 469: | Line 488: | ||
| nano / | nano / | ||
| < | < | ||
| + | |||
| + | To setup autodiscovery, | ||
| + | |||
| + | _imap._tcp | ||
| + | _submission._tcp | ||
| + | _imaps._tcp | ||
| + | _submissions._tcp | ||
| + | _autodiscover._tcp | ||
| + | autodiscover | ||
| + | autodiscover | ||
| + | |||
| + | After that, setup your '' | ||
| + | |||
| + | sudo nano / | ||
| | | ||
| - | To check record health after you set your DNS records, you can do the following: | + | Inside that file, enter something similar to this entry below, obviously adjusting for your priority, weight, and desired client configuration behavior: |
| + | |||
| + | <?xml version=" | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | </ | ||
| + | </ | ||
| + | </ | ||
| + | |||
| + | Pretty much everything one needs is now setup. | ||
| | | ||
| dig txt +short _dmarc.jonathanhaack.com | dig txt +short _dmarc.jonathanhaack.com | ||
| Line 496: | Line 573: | ||
| These tools prove helpful if/when emails get stuck, etc. | These tools prove helpful if/when emails get stuck, etc. | ||
| - | --- // | + | --- // |
computing/mailserver.1744499823.txt.gz · Last modified: 2025/04/12 23:17 by oemb1905
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: GNU Free Documentation License 1.3
