various fixes

This commit is contained in:
Christoph Haas 2025-11-01 22:48:07 +01:00
parent 84ca0737ab
commit 3e7fec537f
23 changed files with 108 additions and 68 deletions

View file

@ -1,6 +1,6 @@
--- ---
title: Start here title: Start here
lastUpdated: 2025-08-09 lastUpdated: 2025-11-01
slug: ispmail-trixie slug: ispmail-trixie
sidebar: sidebar:
order: 100 order: 100

View file

@ -1,6 +1,6 @@
--- ---
title: Upgrading from Debian Bookworm title: Upgrading from Debian Bookworm
lastUpdated: 2025-08-09 lastUpdated: 2025-11-01
slug: ispmail-trixie/upgrading slug: ispmail-trixie/upgrading
sidebar: sidebar:
order: 110 order: 110

View file

@ -1,6 +1,6 @@
--- ---
title: Installing Debian title: Installing Debian
lastUpdated: 2025-08-14 lastUpdated: 2025-11-01
slug: ispmail-trixie/install-debian slug: ispmail-trixie/install-debian
sidebar: sidebar:
order: 120 order: 120

View file

@ -1,6 +1,6 @@
--- ---
title: Install software packages title: Install software packages
lastUpdated: 2025-08-14 lastUpdated: 2025-11-01
slug: ispmail-trixie/install-the-software-packages slug: ispmail-trixie/install-the-software-packages
sidebar: sidebar:
order: 130 order: 130

View file

@ -1,6 +1,6 @@
--- ---
title: Virtual domains title: Virtual domains
lastUpdated: 2025-08-14 lastUpdated: 2025-11-01
slug: ispmail-trixie/virtual-domains slug: ispmail-trixie/virtual-domains
sidebar: sidebar:
order: 150 order: 150

View file

@ -1,6 +1,6 @@
--- ---
title: Database setup title: Database setup
lastUpdated: 2025-08-14 lastUpdated: 2025-11-01
slug: ispmail-trixie/database slug: ispmail-trixie/database
sidebar: sidebar:
order: 155 order: 155

View file

@ -1,6 +1,6 @@
--- ---
title: Big picture title: Big picture
lastUpdated: 2025-08-24 lastUpdated: 2025-11-01
slug: ispmail-trixie/overview slug: ispmail-trixie/overview
sidebar: sidebar:
order: 156 order: 156

View file

@ -1,6 +1,6 @@
--- ---
title: DNS records title: DNS records
lastUpdated: 2025-08-24 lastUpdated: 2025-11-01
slug: ispmail-trixie/dns-records slug: ispmail-trixie/dns-records
sidebar: sidebar:
order: 157 order: 157

View file

@ -1,6 +1,6 @@
--- ---
title: TLS certificate title: TLS certificate
lastUpdated: 2025-08-24 lastUpdated: 2025-11-01
slug: ispmail-trixie/tls-certificate slug: ispmail-trixie/tls-certificate
sidebar: sidebar:
order: 158 order: 158

View file

@ -1,6 +1,6 @@
--- ---
title: "Postfix" title: "Postfix"
lastUpdated: 2025-08-20 lastUpdated: 2025-11-01
slug: ispmail-trixie/postfix slug: ispmail-trixie/postfix
sidebar: sidebar:
order: 160 order: 160

View file

@ -1,6 +1,6 @@
--- ---
title: "Dovecot" title: "Dovecot"
lastUpdated: 2025-08-24 lastUpdated: 2025-11-01
slug: ispmail-trixie/dovecot slug: ispmail-trixie/dovecot
sidebar: sidebar:
order: 165 order: 165

View file

@ -1,6 +1,6 @@
--- ---
title: LMTP title: LMTP
lastUpdated: 2025-08-24 lastUpdated: 2025-11-01
slug: ispmail-trixie/lmtp slug: ispmail-trixie/lmtp
sidebar: sidebar:
order: 167 order: 167

View file

@ -1,6 +1,6 @@
--- ---
title: Webmail using Roundcube title: Webmail using Roundcube
lastUpdated: 2025-08-25 lastUpdated: 2025-11-01
slug: ispmail-trixie/webmail slug: ispmail-trixie/webmail
sidebar: sidebar:
order: 170 order: 170
@ -151,7 +151,7 @@ $config['password_minimum_length'] = 12;
$config['password_force_save'] = true; $config['password_force_save'] = true;
$config['password_algorithm'] = 'blowfish-crypt'; $config['password_algorithm'] = 'blowfish-crypt';
$config['password_algorithm_prefix'] = '{CRYPT}'; $config['password_algorithm_prefix'] = '{CRYPT}';
$config['password_db_dsn'] = 'mysql://mailadmin:MAILADMIN-PASSWORD-HERER@localhost/mailserver'; $config['password_db_dsn'] = 'mysql://mailadmin:MAILADMIN-PASSWORD-HERE@localhost/mailserver';
$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u"; $config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";
?> ?>
EOF EOF
@ -173,7 +173,7 @@ Lets briefly cover the meaning of those lines:
The cryptographic algorithm to encode the password. This one is considered very secure and supported by Dovecot. The cryptographic algorithm to encode the password. This one is considered very secure and supported by Dovecot.
- `$config['password_algorithm_prefix'] = '{CRYPT}';`\ - `$config['password_algorithm_prefix'] = '{CRYPT}';`\
Prepend every password with this string so that Dovecot knows how we encrypted the password. Prepend every password with this string so that Dovecot knows how we encrypted the password.
- `$config['password_db_dsn'] = 'mysql://mailadmin:MAILADMIN-PASSWORD-HERER@localhost/mailserver';`\ - `$config['password_db_dsn'] = 'mysql://mailadmin:MAILADMIN-PASSWORD-HERE@localhost/mailserver';`\
Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We Connection information for the local database. Use your own password for the _mailadmin_ (!) database user here. We
cannot use the restricted _mailserver_ user because we have to write the new password to the database. cannot use the restricted _mailserver_ user because we have to write the new password to the database.
- `$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";`\ - `$config['password_query'] = "UPDATE virtual_users SET password=%P WHERE email=%u";`\

View file

@ -1,6 +1,6 @@
--- ---
title: Sending / Relaying title: Sending / Relaying
lastUpdated: 2025-08-30 lastUpdated: 2025-11-01
slug: ispmail-trixie/relaying slug: ispmail-trixie/relaying
sidebar: sidebar:
order: 180 order: 180

View file

@ -1,6 +1,6 @@
--- ---
title: IMAP title: IMAP
lastUpdated: 2025-09-14 lastUpdated: 2025-11-01
slug: ispmail-trxie/imap slug: ispmail-trxie/imap
sidebar: sidebar:
order: 190 order: 190

View file

@ -1,6 +1,6 @@
--- ---
title: Managing users, aliases and domains title: Managing users, aliases and domains
lastUpdated: 2025-09-17 lastUpdated: 2025-11-01
slug: ispmail-trixie/managing-users-aliases-and-domains slug: ispmail-trixie/managing-users-aliases-and-domains
sidebar: sidebar:
order: 200 order: 200
@ -114,3 +114,22 @@ Christian G. has created a text-based program to help you manage your mail accou
little help adding accounts and setting passwords but not provide a full blown web interface. little help adding accounts and setting passwords but not provide a full blown web interface.
You can find his [Python script at Github](https://github.com/cgzones/ispmail-userctl). You can find his [Python script at Github](https://github.com/cgzones/ispmail-userctl).
### Adminer
You can also use a basic tool like [Adminer](https://www.adminer.org/) to manage the tables if you don't want to type
out SQL. To set it up:
```sh title="Run this on your server"
apt install -y adminer
a2enconf adminer
systemctl reload apache2
```
Now Adminer is available as `https://mailserver.example.org/adminer` and allows you to login:
![Adminer login screen](images/adminer-login.png)
After login this is how the interface looks like:
![Adminer main screen](images/adminer-main.png)

View file

@ -1,6 +1,6 @@
--- ---
title: Catching spam with rspamd title: Catching spam with rspamd
lastUpdated: 2025-10-09 lastUpdated: 2025-11-01
slug: ispmail-trixie/catching-spam-with-rspamd slug: ispmail-trixie/catching-spam-with-rspamd
sidebar: sidebar:
order: 300 order: 300
@ -140,7 +140,7 @@ X-Spam: Yes
Enable those additonal headers: Enable those additonal headers:
```sh ```sh title="Run this on your server"
# Enable rspamd's extended headers # Enable rspamd's extended headers
cat > /etc/rspamd/local.d/milter_headers.conf << EOF cat > /etc/rspamd/local.d/milter_headers.conf << EOF
extended_spam_headers = true; extended_spam_headers = true;
@ -260,7 +260,7 @@ in the `99-ispmail-sieve.conf` file.
That will give you a much deeper insight of what Dovecot has been doing. Restart Dovecot, send another email with That will give you a much deeper insight of what Dovecot has been doing. Restart Dovecot, send another email with
_swaks_ and check the logs again: _swaks_ and check the logs again:
```sh ```sh title="Run this on your server"
systemctl reload dovecot systemctl reload dovecot
journalctl -eu dovecot journalctl -eu dovecot
``` ```
@ -290,7 +290,7 @@ loss.) People use Redis as a cache or for very fast lookups of simple data struc
You have already installed the "redis-server" package earlier. It has started automatically and listens to incoming You have already installed the "redis-server" package earlier. It has started automatically and listens to incoming
connections on TCP port 6379 on localhost. You just need to tell rspamd to use it: connections on TCP port 6379 on localhost. You just need to tell rspamd to use it:
```sh ```sh title="Run this on your server"
# Create a config file to enable automatic spam training # Create a config file to enable automatic spam training
cat > /etc/rspamd/local.d/classifier-bayes.conf << 'EOF' cat > /etc/rspamd/local.d/classifier-bayes.conf << 'EOF'
# Store training data in the Redis database # Store training data in the Redis database
@ -320,7 +320,7 @@ The defaults for auto-learning are:
See [rspamd's documentation](https://docs.rspamd.com/configuration/statistic/#statistics-configuration) if you want to See [rspamd's documentation](https://docs.rspamd.com/configuration/statistic/#statistics-configuration) if you want to
fine-tune that. fine-tune that.
```sh ```sh title="Run this on your server"
rspamc stat rspamc stat
``` ```
@ -391,7 +391,7 @@ Or as a diagram:
Create a new Dovecot configuration file (`99-ispmail-imapsieve.conf`) to enable the required functionality and add Create a new Dovecot configuration file (`99-ispmail-imapsieve.conf`) to enable the required functionality and add
triggers on the Junk folder: triggers on the Junk folder:
```sh ```sh title="Run this on your server"
cat > /etc/dovecot/conf.d/99-ispmail-imapsieve.conf << 'EOF' cat > /etc/dovecot/conf.d/99-ispmail-imapsieve.conf << 'EOF'
# Enable the imap_sieve plugin # Enable the imap_sieve plugin
protocol imap { protocol imap {
@ -443,7 +443,7 @@ the `/etc/dovecot/sieve/learn-ham.sieve` Sieve script is called.
Let's create both Sieve scripts: Let's create both Sieve scripts:
```sh ```sh title="Run this on your server"
# Create spam learning script # Create spam learning script
cat > /etc/dovecot/sieve/learn-spam.sieve << 'EOF' cat > /etc/dovecot/sieve/learn-spam.sieve << 'EOF'
require ["vnd.dovecot.pipe", "copy", "imapsieve"]; require ["vnd.dovecot.pipe", "copy", "imapsieve"];
@ -472,7 +472,7 @@ errors. So if your changes do not seem to work it might be worth compiling them
And the last step is to create the simple shell scripts that do the actual spam/ham training: And the last step is to create the simple shell scripts that do the actual spam/ham training:
```sh ```sh title="Run this on your server"
# Create the shell script for learning spam # Create the shell script for learning spam
cat > /etc/dovecot/sieve/rspamd-learn-spam.sh << 'EOF' cat > /etc/dovecot/sieve/rspamd-learn-spam.sh << 'EOF'
#!/bin/sh #!/bin/sh
@ -552,7 +552,7 @@ Andi Olsen pointed out that Dovecot has introduced an
delete emails in a folder that reach a certain age. This is especially useful for the "Trash" and "Junk" folders. To delete emails in a folder that reach a certain age. This is especially useful for the "Trash" and "Junk" folders. To
enable this feature, create yet another configuration file: enable this feature, create yet another configuration file:
```sh ```sh title="Run this on your server"
cat > /etc/dovecot/conf.d/99-ispmail-autoexpunge.conf << 'EOF' cat > /etc/dovecot/conf.d/99-ispmail-autoexpunge.conf << 'EOF'
# Remove mails from the Junk and Trash folders after 30 days # Remove mails from the Junk and Trash folders after 30 days
mailbox Junk { mailbox Junk {
@ -599,7 +599,7 @@ RewriteRule ^/rspamd/(.*) http://localhost:11334/$1 [P,L]
You also need to enable Apaches modules for HTTP proxying and rewriting: You also need to enable Apaches modules for HTTP proxying and rewriting:
```sh ```sh title="Run this on your server"
# Enable the required Apache modules # Enable the required Apache modules
a2enmod proxy_http a2enmod proxy_http
a2enmod rewrite a2enmod rewrite
@ -614,7 +614,7 @@ thus give you access to the rspamd web interface.
The web interface is password protected. Lets generate a new access password, hash it and add it to rspamd's The web interface is password protected. Lets generate a new access password, hash it and add it to rspamd's
configuration: configuration:
```sh ```sh title="Run this on your server"
# Generate a random password that is 15 characters long # Generate a random password that is 15 characters long
PW=$(pwgen 15 1) PW=$(pwgen 15 1)

View file

@ -1,6 +1,6 @@
--- ---
title: Prevent spoofing using DKIM and SPF title: Prevent spoofing using DKIM and SPF
lastUpdated: 2023-10-04 lastUpdated: 2025-11-01
slug: ispmail-trxie/anti-spoofing-dkim-spf slug: ispmail-trxie/anti-spoofing-dkim-spf
sidebar: sidebar:
order: 310 order: 310
@ -21,9 +21,7 @@ And bad guys obviously don't care.
On this page I will help you set up the three common measures to prevent spoofing: On this page I will help you set up the three common measures to prevent spoofing:
- [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework) (_Sender Policy Framework_) - [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework) (_Sender Policy Framework_)
- [DKIM](https://en.wikipedia.org/wiki/DomainKeys) (_DomainKeys Identified Mail_) - [DKIM](https://en.wikipedia.org/wiki/DomainKeys) (_DomainKeys Identified Mail_)
- [DMARC](https://en.wikipedia.org/wiki/DMARC) (_Domain-based Message Authentication, Reporting and Conformance_) - [DMARC](https://en.wikipedia.org/wiki/DMARC) (_Domain-based Message Authentication, Reporting and Conformance_)
## Envelope sender or visible sender? ## Envelope sender or visible sender?
@ -42,20 +40,13 @@ The **visible sender** (this is not an official term) is what the recipient sees
email this is the `From: John <john@example.org>` header. If you think of a written letter, then this is the sender as email this is the `From: John <john@example.org>` header. If you think of a written letter, then this is the sender as
found in the actual letter within the envelope. found in the actual letter within the envelope.
This is important to understand the three mechanisms described here:
- SPF checks the _envelope sender_
- DKIM verifies the _visible sender_
- DMARC verifies that the _envelope sender_ and the _visible sender_ are the same
## SPF ## SPF
SPF defines which servers (IP addresses) are allowed to send emails on behalf of a specific domain. SPF defines which servers (IP addresses) are allowed to send emails on behalf of a specific domain.
Essentially SPF is a TXT record in your DNS zone. It contains machine-readable information for other mail server on A SPF is essentially a TXT record in your DNS zone that provides machine-readable information for other mail servers. When
receiving mail server can (and usually does) check if there is an SPF record for your domain. which IP addresses are an email is received, the receiving server can (and usually does) check for an SPF record for your domain to determine
allowed to send emails on behalf of that domain. A receiving mail server can (and usually does) check if there is an SPF which IP addresses are authorized to send emails on its behalf.
record for your domain.
Lets take a look at a typical SPF record: Lets take a look at a typical SPF record:
@ -71,8 +62,8 @@ What it means:
your domain) your domain)
4. any other email should be considered suspicious proceed with caution 4. any other email should be considered suspicious proceed with caution
There are [websites](https://easydmarc.com/tools/spf-record-generator) that help you create your SPF string to add to There are websites like [EasyDMARC](https://easydmarc.com/tools/spf-record-generator) that help you create your SPF
your DNS domain. Keep in mind: string to add to your DNS domain. Keep in mind:
- You must know which mail servers send email from your domain. Do not forget to include mailing list or newsletter - You must know which mail servers send email from your domain. Do not forget to include mailing list or newsletter
services that send in your name. services that send in your name.
@ -93,9 +84,9 @@ email. It also uses a TXT record in your domain's DNS zone to publish the public
If you run the _sending_ mail server, you need to: If you run the _sending_ mail server, you need to:
1. Create a **public key** and a **private key**. 1. Create a **public key** and a **private key** for each domain.
2. Publish the **public key** through a DNS record of your domain. Obviously only the administrator of the sending 2. Publish the **public key** through a DNS record of your domain. As only an administrator of the sending domain has
domain has access to the DNS zone which makes it safe. access to the DNS zone, this proves the authenticity.
3. Give your mail server the **private key** so it can **sign** all emails automatically. 3. Give your mail server the **private key** so it can **sign** all emails automatically.
On the other hand the _receiving_ mail server needs to: On the other hand the _receiving_ mail server needs to:
@ -105,11 +96,11 @@ On the other hand the _receiving_ mail server needs to:
3. Make a cryptographic check if the **signature** matches the **public key**. 3. Make a cryptographic check if the **signature** matches the **public key**.
I don't want to dive deeper into public key cryptography. Take a look at the I don't want to dive deeper into public key cryptography. Take a look at the
[Wikipedia article](https://en.wikipedia.org/wiki/Public-key_cryptography) for a good explanation. [Wikipedia article](https://en.wikipedia.org/wiki/Public-key_cryptography) for a decent explanation.
Obviously your mail server will both _receive_ and _send_ emails. So if you want to use DKIM (which I recommend) then Obviously your mail server will both _receive_ and _send_ emails. So if you want to use DKIM (which I recommend) then
you need to take care of both parts. But luckily that's not too hard. The _rspamd_ software on your mail server can take you need to take care of both parts. But luckily that's not too hard. The _rspamd_ software on your mail server can take
care of both adding new signatures and validating incoming signatures. care of both signing outgoing emails and validating incoming signatures.
### Example ### Example
@ -118,13 +109,13 @@ my own mail server. Google uses DKIM signing so the email got this additional he
``` ```
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1760017775; x=1760622575; darn=christoph-haas.de; d=gmail.com; s=20230601; t=1760017775; x=1760622575; darn=workaround.org;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to; :date:message-id:reply-to;
bh=HmztzLfHhgZON2788h5cwCX7liAbwFqnFGISA15M18Q=; bh=HmztzLfHhgZON2788h5cwCX7liAbwFqnFGISA15M18Q=;
b=OKu5D/Ejp7tGy3uxydb7qDccK03OxrdD9vxEKiAXk/y9T5WViCqpg3HrdeB5Izkzdq b=OKu5D/Ejp7tGy3uxydb7qDccK03OxrdD9vxEKiAXk/y9T5WViCqpg3HrdeB5Izkzdq
MXvQ+SgGVzJmy9ZgV1A930RRqUIoR2wmlr3GDXPDyRfagJMRV/3v9J71lfSduOFE8q7t MXvQ+SgGVzJmy9ZgV1A930RRqUIoR2wmlr3GDXPDyRfagJMRV/3v9J71lfSduOFE8q7t
AIw4oWBm91QAnC5gW+XS7h4lNmRd4pVILkoe09qkLz+7WrU5Xp/WGIKHRK0ST5+EAR25… AIw4oWBm91QAnC5gW+XS7h4lNmRd4pVILkoe09qkLz+7WrU5Xp/WGIKHRK0ST5+EAR25…
``` ```
I need Googles DKIM public key to verify that signature. It is stored in their DNS zone as a TXT record of I need Googles DKIM public key to verify that signature. It is stored in their DNS zone as a TXT record of
@ -132,7 +123,7 @@ I need Googles DKIM public key to verify that signature. It is stored in thei
"s=**20230601**". You can use multiple keys as long as you create the signatures with the matching private key. The "s=**20230601**". You can use multiple keys as long as you create the signatures with the matching private key. The
"\_domainkey" part is the standard subdomain for DKIM keys. So lets get that TXT record: "\_domainkey" part is the standard subdomain for DKIM keys. So lets get that TXT record:
```sh ```sh title="Run this on your server"
dig +short 20230601._domainkey.google.com txt dig +short 20230601._domainkey.google.com txt
``` ```
@ -166,7 +157,7 @@ Sounds good? Then lets implement that for your email domains, too.
If you have skipped the previous section on detecting and filtering out spam emails, then just run these two commands to If you have skipped the previous section on detecting and filtering out spam emails, then just run these two commands to
tell Postfix to send all emails through rspamd: tell Postfix to send all emails through rspamd:
```sh ```sh title="Run this on your server"
postconf smtpd_milters=inet:127.0.0.1:11332 postconf smtpd_milters=inet:127.0.0.1:11332
postconf non_smtpd_milters=inet:127.0.0.1:11332 postconf non_smtpd_milters=inet:127.0.0.1:11332
``` ```
@ -177,7 +168,7 @@ added to your DNS zone.
If you put your key file into /var/lib/rspamd/dkim/ using a certain naming scheme, `rspamd` will pick it up If you put your key file into /var/lib/rspamd/dkim/ using a certain naming scheme, `rspamd` will pick it up
automatically: automatically:
```sh ```sh title="Run this on your server but use your own domain here"
# Create the directory # Create the directory
mkdir /var/lib/rspamd/dkim mkdir /var/lib/rspamd/dkim
@ -250,7 +241,7 @@ your own name server with `bind` then you can just take that record as is. Other
may expect a different syntax. In the end the value of the TXT record needs to be one long string. You can use *dig* to may expect a different syntax. In the end the value of the TXT record needs to be one long string. You can use *dig* to
verify that: verify that:
```sh ```sh title="Run this on your server"
dig +short 2025100901._domainkey.example.org txt dig +short 2025100901._domainkey.example.org txt
``` ```
@ -275,7 +266,7 @@ get an error in your rspamd.log file like "_lua_dkim_sign_handler: cannot load d
Make sure that only the `_rspamd` user can read it: Make sure that only the `_rspamd` user can read it:
```sh ```sh title="Run this on your server"
chown _rspamd /var/lib/rspamd/dkim/* chown _rspamd /var/lib/rspamd/dkim/*
chmod u=r,go= /var/lib/rspamd/dkim/* chmod u=r,go= /var/lib/rspamd/dkim/*
``` ```
@ -292,7 +283,7 @@ into trouble.
Using maps is simple. First we need to change the *selector_map* setting of the dkim_signing module. Create a new rspamd Using maps is simple. First we need to change the *selector_map* setting of the dkim_signing module. Create a new rspamd
configuration file: configuration file:
```sh ```sh title="Run this on your server"
# Tell rspamd to look up selectors in our mapping file # Tell rspamd to look up selectors in our mapping file
cat > /etc/rspamd/local.d/dkim_signing.conf << 'EOF' cat > /etc/rspamd/local.d/dkim_signing.conf << 'EOF'
path = "/var/lib/rspamd/dkim/$domain.$selector.key"; path = "/var/lib/rspamd/dkim/$domain.$selector.key";
@ -306,12 +297,12 @@ systemctl restart rspamd
The configuration is simple. rspamd will look for the domain-to-key mapping in the `dkim_selectors.map` file. Create The configuration is simple. rspamd will look for the domain-to-key mapping in the `dkim_selectors.map` file. Create
that file for your own domain and selector: that file for your own domain and selector:
```sh ```sh title="Run this on your server"
# Add the mapping of domain/selector (use your own domain here) # Add the mapping of domain/selector (use your own domain here)
echo example.org 20251000901 > /etc/rspamd/dkim_selectors.map echo example.org 20251000901 > /etc/rspamd/dkim_selectors.map
``` ```
Thats all. rspamd now knows that whenever it sees an outgoing email from anyone@example.org it will get the DKIM Thats all. rspamd now knows that whenever it sees an outgoing email from `anyone@example.org` it will get the DKIM
private key from /var/lib/rspamd/dkim/**example.org**.**2025100901**.key and use it to sign the email. private key from /var/lib/rspamd/dkim/**example.org**.**2025100901**.key and use it to sign the email.
### Send a test email ### Send a test email
@ -319,7 +310,7 @@ private key from /var/lib/rspamd/dkim/**example.org**.**2025100901**.key and use
You could either just send an email from your mail client (or Roundcube) through your mail server to another email You could either just send an email from your mail client (or Roundcube) through your mail server to another email
address. Or you could use swaks. Use your own addresses and password of course: address. Or you could use swaks. Use your own addresses and password of course:
```sh ```sh title="Run this on your server"
swaks --server localhost:587 swaks --server localhost:587
--from some.address@example.org --from some.address@example.org
--to some.external.address@example.net --to some.external.address@example.net
@ -342,15 +333,15 @@ run *opendkim-testmsg* in your shell and paste the email (finish with CTRL-D).
If you get no output then the signature verified correctly. But if you get something like "opendkim-testmsg: dkim_eom(): If you get no output then the signature verified correctly. But if you get something like "opendkim-testmsg: dkim_eom():
Unable to verify" then double-check your DNS record. Unable to verify" then double-check your DNS record.
You can also use websites like [dkimvalidator.com](http://dkimvalidator.com/), [isnotspam.com](http://isnotspam.com/) or You can also use websites like [dkimvalidator.com](http://dkimvalidator.com/) or
[mail-tester.com](https://www.mail-tester.com/) service to verify that your signatures are working well. [mail-tester.com](https://www.mail-tester.com/) to verify that your signatures are working well.
<details class="collapsible"> <details class="collapsible">
<summary>Click here if you do not get a DKIM signature…</summary> <summary>Click here if you do not get a DKIM signature…</summary>
Enable logging: Enable logging:
```sh ```sh title="Run this on your server"
cat > /etc/rspamd/local.d/logging.inc << 'EOF' cat > /etc/rspamd/local.d/logging.inc << 'EOF'
debug_modules = ["dkim", "dkim_signing"]; debug_modules = ["dkim", "dkim_signing"];
EOF EOF

View file

@ -0,0 +1,15 @@
---
title: Catch-all addresses
lastUpdated: 2025-11-01
slug: ispmail-trxie/catch-all
sidebar:
order: 320
---
import { Aside } from "@astrojs/starlight/components";
<Aside type="tip" title="Coming soon">
This page is currently rewritten. It will be online in a couple of days.
</Aside>
![Under construction](images/under-construction.jpg)

View file

@ -0,0 +1,15 @@
---
title: Quotas
lastUpdated: 2025-11-01
slug: ispmail-trxie/quotas
sidebar:
order: 330
---
import { Aside } from "@astrojs/starlight/components";
<Aside type="tip" title="Coming soon">
This page is currently rewritten. It will be online in a couple of days.
</Aside>
![Under construction](images/under-construction.jpg)

Binary file not shown.

After

Width:  |  Height:  |  Size: 15 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 70 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 28 KiB