various fixes
This commit is contained in:
parent
84ca0737ab
commit
3e7fec537f
23 changed files with 108 additions and 68 deletions
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: Start here
|
title: Start here
|
||||||
lastUpdated: 2025-08-09
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie
|
slug: ispmail-trixie
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 100
|
order: 100
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: Upgrading from Debian Bookworm
|
title: Upgrading from Debian Bookworm
|
||||||
lastUpdated: 2025-08-09
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/upgrading
|
slug: ispmail-trixie/upgrading
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 110
|
order: 110
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: Installing Debian
|
title: Installing Debian
|
||||||
lastUpdated: 2025-08-14
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/install-debian
|
slug: ispmail-trixie/install-debian
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 120
|
order: 120
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: Install software packages
|
title: Install software packages
|
||||||
lastUpdated: 2025-08-14
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/install-the-software-packages
|
slug: ispmail-trixie/install-the-software-packages
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 130
|
order: 130
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: Virtual domains
|
title: Virtual domains
|
||||||
lastUpdated: 2025-08-14
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/virtual-domains
|
slug: ispmail-trixie/virtual-domains
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 150
|
order: 150
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: Database setup
|
title: Database setup
|
||||||
lastUpdated: 2025-08-14
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/database
|
slug: ispmail-trixie/database
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 155
|
order: 155
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: Big picture
|
title: Big picture
|
||||||
lastUpdated: 2025-08-24
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/overview
|
slug: ispmail-trixie/overview
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 156
|
order: 156
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: DNS records
|
title: DNS records
|
||||||
lastUpdated: 2025-08-24
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/dns-records
|
slug: ispmail-trixie/dns-records
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 157
|
order: 157
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: TLS certificate
|
title: TLS certificate
|
||||||
lastUpdated: 2025-08-24
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/tls-certificate
|
slug: ispmail-trixie/tls-certificate
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 158
|
order: 158
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: "Postfix"
|
title: "Postfix"
|
||||||
lastUpdated: 2025-08-20
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/postfix
|
slug: ispmail-trixie/postfix
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 160
|
order: 160
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: "Dovecot"
|
title: "Dovecot"
|
||||||
lastUpdated: 2025-08-24
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/dovecot
|
slug: ispmail-trixie/dovecot
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 165
|
order: 165
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: LMTP
|
title: LMTP
|
||||||
lastUpdated: 2025-08-24
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/lmtp
|
slug: ispmail-trixie/lmtp
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 167
|
order: 167
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: Webmail using Roundcube
|
title: Webmail using Roundcube
|
||||||
lastUpdated: 2025-08-25
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/webmail
|
slug: ispmail-trixie/webmail
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 170
|
order: 170
|
||||||
|
|
@ -151,7 +151,7 @@ $config['password_minimum_length'] = 12;
|
||||||
$config['password_force_save'] = true;
|
$config['password_force_save'] = true;
|
||||||
$config['password_algorithm'] = 'blowfish-crypt';
|
$config['password_algorithm'] = 'blowfish-crypt';
|
||||||
$config['password_algorithm_prefix'] = '{CRYPT}';
|
$config['password_algorithm_prefix'] = '{CRYPT}';
|
||||||
$config['password_db_dsn'] = 'mysql://mailadmin:MAILADMIN-PASSWORD-HERER@localhost/mailserver';
|
$config['password_db_dsn'] = 'mysql://mailadmin:MAILADMIN-PASSWORD-HERE@localhost/mailserver';
|
||||||
$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";
|
$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";
|
||||||
?>
|
?>
|
||||||
EOF
|
EOF
|
||||||
|
|
@ -173,7 +173,7 @@ Let’s briefly cover the meaning of those lines:
|
||||||
The cryptographic algorithm to encode the password. This one is considered very secure and supported by Dovecot.
|
The cryptographic algorithm to encode the password. This one is considered very secure and supported by Dovecot.
|
||||||
- `$config['password_algorithm_prefix'] = '{CRYPT}';`\
|
- `$config['password_algorithm_prefix'] = '{CRYPT}';`\
|
||||||
Prepend every password with this string so that Dovecot knows how we encrypted the password.
|
Prepend every password with this string so that Dovecot knows how we encrypted the password.
|
||||||
- `$config['password_db_dsn'] = 'mysql://mailadmin:MAILADMIN-PASSWORD-HERER@localhost/mailserver';`\
|
- `$config['password_db_dsn'] = 'mysql://mailadmin:MAILADMIN-PASSWORD-HERE@localhost/mailserver';`\
|
||||||
Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We
|
Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We
|
||||||
cannot use the restricted _mailserver_ user because we have to write the new password to the database.
|
cannot use the restricted _mailserver_ user because we have to write the new password to the database.
|
||||||
- `$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";`\
|
- `$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";`\
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: Sending / Relaying
|
title: Sending / Relaying
|
||||||
lastUpdated: 2025-08-30
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/relaying
|
slug: ispmail-trixie/relaying
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 180
|
order: 180
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: IMAP
|
title: IMAP
|
||||||
lastUpdated: 2025-09-14
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trxie/imap
|
slug: ispmail-trxie/imap
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 190
|
order: 190
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: Managing users, aliases and domains
|
title: Managing users, aliases and domains
|
||||||
lastUpdated: 2025-09-17
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/managing-users-aliases-and-domains
|
slug: ispmail-trixie/managing-users-aliases-and-domains
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 200
|
order: 200
|
||||||
|
|
@ -114,3 +114,22 @@ Christian G. has created a text-based program to help you manage your mail accou
|
||||||
little help adding accounts and setting passwords but not provide a full blown web interface.
|
little help adding accounts and setting passwords but not provide a full blown web interface.
|
||||||
|
|
||||||
You can find his [Python script at Github](https://github.com/cgzones/ispmail-userctl).
|
You can find his [Python script at Github](https://github.com/cgzones/ispmail-userctl).
|
||||||
|
|
||||||
|
### Adminer
|
||||||
|
|
||||||
|
You can also use a basic tool like [Adminer](https://www.adminer.org/) to manage the tables if you don't want to type
|
||||||
|
out SQL. To set it up:
|
||||||
|
|
||||||
|
```sh title="Run this on your server"
|
||||||
|
apt install -y adminer
|
||||||
|
a2enconf adminer
|
||||||
|
systemctl reload apache2
|
||||||
|
```
|
||||||
|
|
||||||
|
Now Adminer is available as `https://mailserver.example.org/adminer` and allows you to login:
|
||||||
|
|
||||||
|

|
||||||
|
|
||||||
|
After login this is how the interface looks like:
|
||||||
|
|
||||||
|

|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: Catching spam with rspamd
|
title: Catching spam with rspamd
|
||||||
lastUpdated: 2025-10-09
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trixie/catching-spam-with-rspamd
|
slug: ispmail-trixie/catching-spam-with-rspamd
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 300
|
order: 300
|
||||||
|
|
@ -140,7 +140,7 @@ X-Spam: Yes
|
||||||
|
|
||||||
Enable those additonal headers:
|
Enable those additonal headers:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
# Enable rspamd's extended headers
|
# Enable rspamd's extended headers
|
||||||
cat > /etc/rspamd/local.d/milter_headers.conf << EOF
|
cat > /etc/rspamd/local.d/milter_headers.conf << EOF
|
||||||
extended_spam_headers = true;
|
extended_spam_headers = true;
|
||||||
|
|
@ -260,7 +260,7 @@ in the `99-ispmail-sieve.conf` file.
|
||||||
That will give you a much deeper insight of what Dovecot has been doing. Restart Dovecot, send another email with
|
That will give you a much deeper insight of what Dovecot has been doing. Restart Dovecot, send another email with
|
||||||
_swaks_ and check the logs again:
|
_swaks_ and check the logs again:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
systemctl reload dovecot
|
systemctl reload dovecot
|
||||||
journalctl -eu dovecot
|
journalctl -eu dovecot
|
||||||
```
|
```
|
||||||
|
|
@ -290,7 +290,7 @@ loss.) People use Redis as a cache or for very fast lookups of simple data struc
|
||||||
You have already installed the "redis-server" package earlier. It has started automatically and listens to incoming
|
You have already installed the "redis-server" package earlier. It has started automatically and listens to incoming
|
||||||
connections on TCP port 6379 on localhost. You just need to tell rspamd to use it:
|
connections on TCP port 6379 on localhost. You just need to tell rspamd to use it:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
# Create a config file to enable automatic spam training
|
# Create a config file to enable automatic spam training
|
||||||
cat > /etc/rspamd/local.d/classifier-bayes.conf << 'EOF'
|
cat > /etc/rspamd/local.d/classifier-bayes.conf << 'EOF'
|
||||||
# Store training data in the Redis database
|
# Store training data in the Redis database
|
||||||
|
|
@ -320,7 +320,7 @@ The defaults for auto-learning are:
|
||||||
See [rspamd's documentation](https://docs.rspamd.com/configuration/statistic/#statistics-configuration) if you want to
|
See [rspamd's documentation](https://docs.rspamd.com/configuration/statistic/#statistics-configuration) if you want to
|
||||||
fine-tune that.
|
fine-tune that.
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
rspamc stat
|
rspamc stat
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
@ -391,7 +391,7 @@ Or as a diagram:
|
||||||
Create a new Dovecot configuration file (`99-ispmail-imapsieve.conf`) to enable the required functionality and add
|
Create a new Dovecot configuration file (`99-ispmail-imapsieve.conf`) to enable the required functionality and add
|
||||||
triggers on the Junk folder:
|
triggers on the Junk folder:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
cat > /etc/dovecot/conf.d/99-ispmail-imapsieve.conf << 'EOF'
|
cat > /etc/dovecot/conf.d/99-ispmail-imapsieve.conf << 'EOF'
|
||||||
# Enable the imap_sieve plugin
|
# Enable the imap_sieve plugin
|
||||||
protocol imap {
|
protocol imap {
|
||||||
|
|
@ -443,7 +443,7 @@ the `/etc/dovecot/sieve/learn-ham.sieve` Sieve script is called.
|
||||||
|
|
||||||
Let's create both Sieve scripts:
|
Let's create both Sieve scripts:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
# Create spam learning script
|
# Create spam learning script
|
||||||
cat > /etc/dovecot/sieve/learn-spam.sieve << 'EOF'
|
cat > /etc/dovecot/sieve/learn-spam.sieve << 'EOF'
|
||||||
require ["vnd.dovecot.pipe", "copy", "imapsieve"];
|
require ["vnd.dovecot.pipe", "copy", "imapsieve"];
|
||||||
|
|
@ -472,7 +472,7 @@ errors. So if your changes do not seem to work it might be worth compiling them
|
||||||
|
|
||||||
And the last step is to create the simple shell scripts that do the actual spam/ham training:
|
And the last step is to create the simple shell scripts that do the actual spam/ham training:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
# Create the shell script for learning spam
|
# Create the shell script for learning spam
|
||||||
cat > /etc/dovecot/sieve/rspamd-learn-spam.sh << 'EOF'
|
cat > /etc/dovecot/sieve/rspamd-learn-spam.sh << 'EOF'
|
||||||
#!/bin/sh
|
#!/bin/sh
|
||||||
|
|
@ -552,7 +552,7 @@ Andi Olsen pointed out that Dovecot has introduced an
|
||||||
delete emails in a folder that reach a certain age. This is especially useful for the "Trash" and "Junk" folders. To
|
delete emails in a folder that reach a certain age. This is especially useful for the "Trash" and "Junk" folders. To
|
||||||
enable this feature, create yet another configuration file:
|
enable this feature, create yet another configuration file:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
cat > /etc/dovecot/conf.d/99-ispmail-autoexpunge.conf << 'EOF'
|
cat > /etc/dovecot/conf.d/99-ispmail-autoexpunge.conf << 'EOF'
|
||||||
# Remove mails from the Junk and Trash folders after 30 days
|
# Remove mails from the Junk and Trash folders after 30 days
|
||||||
mailbox Junk {
|
mailbox Junk {
|
||||||
|
|
@ -599,7 +599,7 @@ RewriteRule ^/rspamd/(.*) http://localhost:11334/$1 [P,L]
|
||||||
|
|
||||||
You also need to enable Apache’s modules for HTTP proxying and rewriting:
|
You also need to enable Apache’s modules for HTTP proxying and rewriting:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
# Enable the required Apache modules
|
# Enable the required Apache modules
|
||||||
a2enmod proxy_http
|
a2enmod proxy_http
|
||||||
a2enmod rewrite
|
a2enmod rewrite
|
||||||
|
|
@ -614,7 +614,7 @@ thus give you access to the rspamd web interface.
|
||||||
The web interface is password protected. Let’s generate a new access password, hash it and add it to rspamd's
|
The web interface is password protected. Let’s generate a new access password, hash it and add it to rspamd's
|
||||||
configuration:
|
configuration:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
# Generate a random password that is 15 characters long
|
# Generate a random password that is 15 characters long
|
||||||
PW=$(pwgen 15 1)
|
PW=$(pwgen 15 1)
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
title: Prevent spoofing using DKIM and SPF
|
title: Prevent spoofing using DKIM and SPF
|
||||||
lastUpdated: 2023-10-04
|
lastUpdated: 2025-11-01
|
||||||
slug: ispmail-trxie/anti-spoofing-dkim-spf
|
slug: ispmail-trxie/anti-spoofing-dkim-spf
|
||||||
sidebar:
|
sidebar:
|
||||||
order: 310
|
order: 310
|
||||||
|
|
@ -21,9 +21,7 @@ And bad guys obviously don't care.
|
||||||
On this page I will help you set up the three common measures to prevent spoofing:
|
On this page I will help you set up the three common measures to prevent spoofing:
|
||||||
|
|
||||||
- [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework) (_Sender Policy Framework_)
|
- [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework) (_Sender Policy Framework_)
|
||||||
|
|
||||||
- [DKIM](https://en.wikipedia.org/wiki/DomainKeys) (_DomainKeys Identified Mail_)
|
- [DKIM](https://en.wikipedia.org/wiki/DomainKeys) (_DomainKeys Identified Mail_)
|
||||||
|
|
||||||
- [DMARC](https://en.wikipedia.org/wiki/DMARC) (_Domain-based Message Authentication, Reporting and Conformance_)
|
- [DMARC](https://en.wikipedia.org/wiki/DMARC) (_Domain-based Message Authentication, Reporting and Conformance_)
|
||||||
|
|
||||||
## Envelope sender or visible sender?
|
## Envelope sender or visible sender?
|
||||||
|
|
@ -42,20 +40,13 @@ The **visible sender** (this is not an official term) is what the recipient sees
|
||||||
email this is the `From: John <john@example.org>` header. If you think of a written letter, then this is the sender as
|
email this is the `From: John <john@example.org>` header. If you think of a written letter, then this is the sender as
|
||||||
found in the actual letter within the envelope.
|
found in the actual letter within the envelope.
|
||||||
|
|
||||||
This is important to understand the three mechanisms described here:
|
|
||||||
|
|
||||||
- SPF checks the _envelope sender_
|
|
||||||
- DKIM verifies the _visible sender_
|
|
||||||
- DMARC verifies that the _envelope sender_ and the _visible sender_ are the same
|
|
||||||
|
|
||||||
## SPF
|
## SPF
|
||||||
|
|
||||||
SPF defines which servers (IP addresses) are allowed to send emails on behalf of a specific domain.
|
SPF defines which servers (IP addresses) are allowed to send emails on behalf of a specific domain.
|
||||||
|
|
||||||
Essentially SPF is a TXT record in your DNS zone. It contains machine-readable information for other mail server on A
|
SPF is essentially a TXT record in your DNS zone that provides machine-readable information for other mail servers. When
|
||||||
receiving mail server can (and usually does) check if there is an SPF record for your domain. which IP addresses are
|
an email is received, the receiving server can (and usually does) check for an SPF record for your domain to determine
|
||||||
allowed to send emails on behalf of that domain. A receiving mail server can (and usually does) check if there is an SPF
|
which IP addresses are authorized to send emails on its behalf.
|
||||||
record for your domain.
|
|
||||||
|
|
||||||
Let’s take a look at a typical SPF record:
|
Let’s take a look at a typical SPF record:
|
||||||
|
|
||||||
|
|
@ -71,8 +62,8 @@ What it means:
|
||||||
your domain)
|
your domain)
|
||||||
4. any other email should be considered suspicious – proceed with caution
|
4. any other email should be considered suspicious – proceed with caution
|
||||||
|
|
||||||
There are [websites](https://easydmarc.com/tools/spf-record-generator) that help you create your SPF string to add to
|
There are websites like [EasyDMARC](https://easydmarc.com/tools/spf-record-generator) that help you create your SPF
|
||||||
your DNS domain. Keep in mind:
|
string to add to your DNS domain. Keep in mind:
|
||||||
|
|
||||||
- You must know which mail servers send email from your domain. Do not forget to include mailing list or newsletter
|
- You must know which mail servers send email from your domain. Do not forget to include mailing list or newsletter
|
||||||
services that send in your name.
|
services that send in your name.
|
||||||
|
|
@ -93,9 +84,9 @@ email. It also uses a TXT record in your domain's DNS zone to publish the public
|
||||||
|
|
||||||
If you run the _sending_ mail server, you need to:
|
If you run the _sending_ mail server, you need to:
|
||||||
|
|
||||||
1. Create a **public key** and a **private key**.
|
1. Create a **public key** and a **private key** for each domain.
|
||||||
2. Publish the **public key** through a DNS record of your domain. Obviously only the administrator of the sending
|
2. Publish the **public key** through a DNS record of your domain. As only an administrator of the sending domain has
|
||||||
domain has access to the DNS zone which makes it safe.
|
access to the DNS zone, this proves the authenticity.
|
||||||
3. Give your mail server the **private key** so it can **sign** all emails automatically.
|
3. Give your mail server the **private key** so it can **sign** all emails automatically.
|
||||||
|
|
||||||
On the other hand the _receiving_ mail server needs to:
|
On the other hand the _receiving_ mail server needs to:
|
||||||
|
|
@ -105,11 +96,11 @@ On the other hand the _receiving_ mail server needs to:
|
||||||
3. Make a cryptographic check if the **signature** matches the **public key**.
|
3. Make a cryptographic check if the **signature** matches the **public key**.
|
||||||
|
|
||||||
I don't want to dive deeper into public key cryptography. Take a look at the
|
I don't want to dive deeper into public key cryptography. Take a look at the
|
||||||
[Wikipedia article](https://en.wikipedia.org/wiki/Public-key_cryptography) for a good explanation.
|
[Wikipedia article](https://en.wikipedia.org/wiki/Public-key_cryptography) for a decent explanation.
|
||||||
|
|
||||||
Obviously your mail server will both _receive_ and _send_ emails. So if you want to use DKIM (which I recommend) then
|
Obviously your mail server will both _receive_ and _send_ emails. So if you want to use DKIM (which I recommend) then
|
||||||
you need to take care of both parts. But luckily that's not too hard. The _rspamd_ software on your mail server can take
|
you need to take care of both parts. But luckily that's not too hard. The _rspamd_ software on your mail server can take
|
||||||
care of both adding new signatures and validating incoming signatures.
|
care of both signing outgoing emails and validating incoming signatures.
|
||||||
|
|
||||||
### Example
|
### Example
|
||||||
|
|
||||||
|
|
@ -118,7 +109,7 @@ my own mail server. Google uses DKIM signing so the email got this additional he
|
||||||
|
|
||||||
```
|
```
|
||||||
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
|
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
|
||||||
d=gmail.com; s=20230601; t=1760017775; x=1760622575; darn=christoph-haas.de;
|
d=gmail.com; s=20230601; t=1760017775; x=1760622575; darn=workaround.org;
|
||||||
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
|
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
|
||||||
:date:message-id:reply-to;
|
:date:message-id:reply-to;
|
||||||
bh=HmztzLfHhgZON2788h5cwCX7liAbwFqnFGISA15M18Q=;
|
bh=HmztzLfHhgZON2788h5cwCX7liAbwFqnFGISA15M18Q=;
|
||||||
|
|
@ -132,7 +123,7 @@ I need Google’s DKIM public key to verify that signature. It is stored in thei
|
||||||
"s=**20230601**". You can use multiple keys as long as you create the signatures with the matching private key. The
|
"s=**20230601**". You can use multiple keys as long as you create the signatures with the matching private key. The
|
||||||
"\_domainkey" part is the standard subdomain for DKIM keys. So let’s get that TXT record:
|
"\_domainkey" part is the standard subdomain for DKIM keys. So let’s get that TXT record:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
dig +short 20230601._domainkey.google.com txt
|
dig +short 20230601._domainkey.google.com txt
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
@ -166,7 +157,7 @@ Sounds good? Then let’s implement that for your email domains, too.
|
||||||
If you have skipped the previous section on detecting and filtering out spam emails, then just run these two commands to
|
If you have skipped the previous section on detecting and filtering out spam emails, then just run these two commands to
|
||||||
tell Postfix to send all emails through rspamd:
|
tell Postfix to send all emails through rspamd:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
postconf smtpd_milters=inet:127.0.0.1:11332
|
postconf smtpd_milters=inet:127.0.0.1:11332
|
||||||
postconf non_smtpd_milters=inet:127.0.0.1:11332
|
postconf non_smtpd_milters=inet:127.0.0.1:11332
|
||||||
```
|
```
|
||||||
|
|
@ -177,7 +168,7 @@ added to your DNS zone.
|
||||||
If you put your key file into /var/lib/rspamd/dkim/ using a certain naming scheme, `rspamd` will pick it up
|
If you put your key file into /var/lib/rspamd/dkim/ using a certain naming scheme, `rspamd` will pick it up
|
||||||
automatically:
|
automatically:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server – but use your own domain here"
|
||||||
# Create the directory
|
# Create the directory
|
||||||
mkdir /var/lib/rspamd/dkim
|
mkdir /var/lib/rspamd/dkim
|
||||||
|
|
||||||
|
|
@ -250,7 +241,7 @@ your own name server with `bind` then you can just take that record as is. Other
|
||||||
may expect a different syntax. In the end the value of the TXT record needs to be one long string. You can use *dig* to
|
may expect a different syntax. In the end the value of the TXT record needs to be one long string. You can use *dig* to
|
||||||
verify that:
|
verify that:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
dig +short 2025100901._domainkey.example.org txt
|
dig +short 2025100901._domainkey.example.org txt
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
@ -275,7 +266,7 @@ get an error in your rspamd.log file like "_lua_dkim_sign_handler: cannot load d
|
||||||
|
|
||||||
Make sure that only the `_rspamd` user can read it:
|
Make sure that only the `_rspamd` user can read it:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
chown _rspamd /var/lib/rspamd/dkim/*
|
chown _rspamd /var/lib/rspamd/dkim/*
|
||||||
chmod u=r,go= /var/lib/rspamd/dkim/*
|
chmod u=r,go= /var/lib/rspamd/dkim/*
|
||||||
```
|
```
|
||||||
|
|
@ -292,7 +283,7 @@ into trouble.
|
||||||
Using maps is simple. First we need to change the *selector_map* setting of the dkim_signing module. Create a new rspamd
|
Using maps is simple. First we need to change the *selector_map* setting of the dkim_signing module. Create a new rspamd
|
||||||
configuration file:
|
configuration file:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
# Tell rspamd to look up selectors in our mapping file
|
# Tell rspamd to look up selectors in our mapping file
|
||||||
cat > /etc/rspamd/local.d/dkim_signing.conf << 'EOF'
|
cat > /etc/rspamd/local.d/dkim_signing.conf << 'EOF'
|
||||||
path = "/var/lib/rspamd/dkim/$domain.$selector.key";
|
path = "/var/lib/rspamd/dkim/$domain.$selector.key";
|
||||||
|
|
@ -306,12 +297,12 @@ systemctl restart rspamd
|
||||||
The configuration is simple. rspamd will look for the domain-to-key mapping in the `dkim_selectors.map` file. Create
|
The configuration is simple. rspamd will look for the domain-to-key mapping in the `dkim_selectors.map` file. Create
|
||||||
that file for your own domain and selector:
|
that file for your own domain and selector:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
# Add the mapping of domain/selector (use your own domain here)
|
# Add the mapping of domain/selector (use your own domain here)
|
||||||
echo example.org 20251000901 > /etc/rspamd/dkim_selectors.map
|
echo example.org 20251000901 > /etc/rspamd/dkim_selectors.map
|
||||||
```
|
```
|
||||||
|
|
||||||
That’s all. rspamd now knows that whenever it sees an outgoing email from anyone@example.org it will get the DKIM
|
That’s all. rspamd now knows that whenever it sees an outgoing email from `anyone@example.org` it will get the DKIM
|
||||||
private key from /var/lib/rspamd/dkim/**example.org**.**2025100901**.key and use it to sign the email.
|
private key from /var/lib/rspamd/dkim/**example.org**.**2025100901**.key and use it to sign the email.
|
||||||
|
|
||||||
### Send a test email
|
### Send a test email
|
||||||
|
|
@ -319,7 +310,7 @@ private key from /var/lib/rspamd/dkim/**example.org**.**2025100901**.key and use
|
||||||
You could either just send an email from your mail client (or Roundcube) through your mail server to another email
|
You could either just send an email from your mail client (or Roundcube) through your mail server to another email
|
||||||
address. Or you could use swaks. Use your own addresses and password of course:
|
address. Or you could use swaks. Use your own addresses and password of course:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
swaks --server localhost:587
|
swaks --server localhost:587
|
||||||
--from some.address@example.org
|
--from some.address@example.org
|
||||||
--to some.external.address@example.net
|
--to some.external.address@example.net
|
||||||
|
|
@ -342,15 +333,15 @@ run *opendkim-testmsg* in your shell and paste the email (finish with CTRL-D).
|
||||||
If you get no output then the signature verified correctly. But if you get something like "opendkim-testmsg: dkim_eom():
|
If you get no output then the signature verified correctly. But if you get something like "opendkim-testmsg: dkim_eom():
|
||||||
Unable to verify" then double-check your DNS record.
|
Unable to verify" then double-check your DNS record.
|
||||||
|
|
||||||
You can also use websites like [dkimvalidator.com](http://dkimvalidator.com/), [isnotspam.com](http://isnotspam.com/) or
|
You can also use websites like [dkimvalidator.com](http://dkimvalidator.com/) or
|
||||||
[mail-tester.com](https://www.mail-tester.com/) service to verify that your signatures are working well.
|
[mail-tester.com](https://www.mail-tester.com/) to verify that your signatures are working well.
|
||||||
|
|
||||||
<details class="collapsible">
|
<details class="collapsible">
|
||||||
<summary>Click here if you do not get a DKIM signature…</summary>
|
<summary>Click here if you do not get a DKIM signature…</summary>
|
||||||
|
|
||||||
Enable logging:
|
Enable logging:
|
||||||
|
|
||||||
```sh
|
```sh title="Run this on your server"
|
||||||
cat > /etc/rspamd/local.d/logging.inc << 'EOF'
|
cat > /etc/rspamd/local.d/logging.inc << 'EOF'
|
||||||
debug_modules = ["dkim", "dkim_signing"];
|
debug_modules = ["dkim", "dkim_signing"];
|
||||||
EOF
|
EOF
|
||||||
|
|
|
||||||
15
src/content/docs/ispmail-trixie/320-catchall.mdx
Normal file
15
src/content/docs/ispmail-trixie/320-catchall.mdx
Normal file
|
|
@ -0,0 +1,15 @@
|
||||||
|
---
|
||||||
|
title: Catch-all addresses
|
||||||
|
lastUpdated: 2025-11-01
|
||||||
|
slug: ispmail-trxie/catch-all
|
||||||
|
sidebar:
|
||||||
|
order: 320
|
||||||
|
---
|
||||||
|
|
||||||
|
import { Aside } from "@astrojs/starlight/components";
|
||||||
|
|
||||||
|
<Aside type="tip" title="Coming soon">
|
||||||
|
This page is currently rewritten. It will be online in a couple of days.
|
||||||
|
</Aside>
|
||||||
|
|
||||||
|

|
||||||
15
src/content/docs/ispmail-trixie/330-quotas.mdx
Normal file
15
src/content/docs/ispmail-trixie/330-quotas.mdx
Normal file
|
|
@ -0,0 +1,15 @@
|
||||||
|
---
|
||||||
|
title: Quotas
|
||||||
|
lastUpdated: 2025-11-01
|
||||||
|
slug: ispmail-trxie/quotas
|
||||||
|
sidebar:
|
||||||
|
order: 330
|
||||||
|
---
|
||||||
|
|
||||||
|
import { Aside } from "@astrojs/starlight/components";
|
||||||
|
|
||||||
|
<Aside type="tip" title="Coming soon">
|
||||||
|
This page is currently rewritten. It will be online in a couple of days.
|
||||||
|
</Aside>
|
||||||
|
|
||||||
|

|
||||||
BIN
src/content/docs/ispmail-trixie/images/adminer-login.png
Normal file
BIN
src/content/docs/ispmail-trixie/images/adminer-login.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
BIN
src/content/docs/ispmail-trixie/images/adminer-main.png
Normal file
BIN
src/content/docs/ispmail-trixie/images/adminer-main.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 70 KiB |
BIN
src/content/docs/ispmail-trixie/images/under-construction.jpg
Normal file
BIN
src/content/docs/ispmail-trixie/images/under-construction.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 28 KiB |
Loading…
Add table
Add a link
Reference in a new issue