| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| computing:mailserver-trixie [2026/07/28 16:07] – oemb1905 | computing:mailserver-trixie [2026/07/28 19:52] (current) – oemb1905 |
|---|
| reject_non_fqdn_recipient, | reject_non_fqdn_recipient, |
| reject_unknown_recipient_domain, | reject_unknown_recipient_domain, |
| check_sender_access hash:/etc/postfix/sender_access, | |
| check_policy_service unix:private/policyd-spf | check_policy_service unix:private/policyd-spf |
| </code> | </code> |
| |
| Make sure you understand what each line does. In short, this mandates authentication (except for localhost), and does not allow use of the server for public relay, i.e., to deliver emails for other domains besides haacksnetworking.org or domain.com. The sender_access file is super helpful for repeat offenders. Sure, you can also just blacklist those in sieve rules, but that means that they still arrive and fill up your Junk folder. In some cases, spammers will send 100s of the same message per day. In those cases, it is helpful to stop them at the gates with postfix's sender_access: | Make sure you understand what each line does. In short, this mandates authentication (except for localhost), and does not allow use of the server for public relay, i.e., to deliver emails for other domains besides haacksnetworking.org or domain.com. Okay, I now disable the SPF policy's default behavior of rejecting emails when the HELO/EHLO hostname does not match the sender's SPF policy. I also disable the second line as well, which checks the origin IP against the SPF policy of the sender. In short, I instruct the SPF policy to log failures instead of rejecting emails because of it. This is also essential for spam assassin, which will later use this policy to identify and rank the health of incoming email, thus allowing you to create management rules for priority senders or to manage spam. Head over to ''/etc/postfix-policyd-spf-python/policyd-spf.conf'' and edit: |
| | |
| nano /etc/postfix/sender_access | |
| <spam@spamemail.com REJECT> | |
| sudo postmap /etc/postfix/sender_access | |
| sudo postfix reload | |
| sudo systemctl restart postfix | |
| | |
| Okay, I now disable the SPF policy's default behavior of rejecting emails when the HELO/EHLO hostname does not match the sender's SPF policy. I also disable the second line as well, which checks the origin IP against the SPF policy of the sender. In short, I instruct the SPF policy to log failures instead of rejecting emails because of it. This is also essential for spam assassin, which will later use this policy to identify and rank the health of incoming email, thus allowing you to create management rules for priority senders or to manage spam. Head over to ''/etc/postfix-policyd-spf-python/policyd-spf.conf'' and edit: | |
| |
| HELO_reject = False | HELO_reject = False |
| reject_unauthenticated_sender_login_mismatch, | reject_unauthenticated_sender_login_mismatch, |
| reject_sender_login_mismatch, | reject_sender_login_mismatch, |
| | check_sender_access hash:/etc/postfix/sender_access, |
| permit | permit |
| </code> | </code> |
| | |
| | The sender_access file is super helpful for repeat offenders. Sure, you can also just blacklist those in sieve rules, but that means that they still arrive and fill up your Junk folder. In some cases, spammers will send 100s of the same message per day. In those cases, it is helpful to stop them at the gates with postfix's sender_access: |
| | |
| | nano /etc/postfix/sender_access |
| | <spam@domain.com REJECT> #block exact email |
| | <domain.com REJECT> #block all users @domain.com |
| | <.domain.com REJECT> #block all users @sub.domain.com |
| | sudo postmap /etc/postfix/sender_access |
| | sudo postfix reload |
| | sudo systemctl restart postfix |
| |
| Now that the SPF/recipient and PTRI am now going to set up the DKIM policy for incoming email but/and, I will also use the same package to cut a DKIM keypair for use with the server's outgoing email. First, I install the policy and add opendkim to the postfix group. | Now that the SPF/recipient and PTRI am now going to set up the DKIM policy for incoming email but/and, I will also use the same package to cut a DKIM keypair for use with the server's outgoing email. First, I install the policy and add opendkim to the postfix group. |
| I rewrote the mail server tutorial for the presentation [[https://tech.haacksnetworking.org/2025/06/10/your-email-your-rules-self-hosting-simplified/|Your Email, Your Rules: Self-Hosting Simplified]]. The SeaGL presentation can be found [[https://pretalx.seagl.org/2025/talk/VLM7AS/|on their calendar]]. | I rewrote the mail server tutorial for the presentation [[https://tech.haacksnetworking.org/2025/06/10/your-email-your-rules-self-hosting-simplified/|Your Email, Your Rules: Self-Hosting Simplified]]. The SeaGL presentation can be found [[https://pretalx.seagl.org/2025/talk/VLM7AS/|on their calendar]]. |
| |
| --- //[[alerts@haacksnetworking.org|oemb1905]] 2026/07/28 15:38// | --- //[[alerts@haacksnetworking.org|oemb1905]] 2026/07/28 19:51// |
