diff --git a/src/content/docs/ispmail-trixie/155-database.mdx b/src/content/docs/ispmail-trixie/155-database.mdx
index 00890d0..ab1c6fe 100644
--- a/src/content/docs/ispmail-trixie/155-database.mdx
+++ b/src/content/docs/ispmail-trixie/155-database.mdx
@@ -248,3 +248,5 @@ you should run before taking your mail server into production:
```sql
DELETE FROM mailserver.virtual_domains WHERE name='example.org';
```
+
+TODO: move to final step
diff --git a/src/content/docs/ispmail-trixie/157-dns.mdx b/src/content/docs/ispmail-trixie/157-dns.mdx
new file mode 100644
index 0000000..a041d43
--- /dev/null
+++ b/src/content/docs/ispmail-trixie/157-dns.mdx
@@ -0,0 +1,108 @@
+---
+title: DNS records
+lastUpdated: 2025-08-24
+slug: ispmail-trixie/dns-records
+sidebar:
+ order: 157
+---
+
+import { Aside } from "@astrojs/starlight/components";
+
+import "@splidejs/splide/css";
+import { Splide, SplideSlide } from "astro-splide";
+
+import { Steps } from "@astrojs/starlight/components";
+
+import Box from "../../../components/Box.astro";
+
+import StepListReceive from "../../../components/StepListReceive.astro";
+
+I have created a slideshow to help you understand the process of receiving an email from a remote mail server. Use the
+arrows to navigate between slides:
+
+
+ {Array.from({ length: 24 }, (_, i) => i + 1).map((i) => (
+
+
+
+ ))}
+
+
+---
+
+Let's tackle the receiving of emails step by step:
+
+## DNS
+
+
+
+As shown in the slideshow, you need to have proper DNS records set up. Say that you want to receive emails for the
+`example.com` domain. If some other mail server on the internet wants to send an email to your server, it looks for two
+records:
+
+- **MX record (`example.com`)**
+ The MX (Mail Exchange) record tells other mail servers _where to deliver emails_ for the domain `example.com`.
+ Instead of pointing directly to an IP address, it points to a **hostname** (for example, `smtp.example.com`).
+ MX records also include a **priority value**. If multiple mail servers are listed, the one with the lowest priority
+ number is tried first. Others are used as fallback if the first is unavailable.
+
+- **A / AAAA record (`smtp.example.com`)**
+ The hostname specified in the MX record (`smtp.example.com`) must resolve to an IP address so that other mail servers
+ know how to reach it.
+ - An **A record** maps the hostname to an IPv4 address.
+ - An **AAAA record** maps the hostname to an IPv6 address.
+
+ Once resolved, the sending mail server connects to that IP address on **TCP port 25**, which is the standard port for
+ email delivery (SMTP).
+
+
+
+
+
+In zone syntax you would create something like:
+
+```
+@ IN MX 10 smtp
+smtp IN A 100.64.17.3
+smtp IN A fd7a:115c:a1e0::17
+```
+
+If possible, also add a PTR record that makes the IP addresses point back to the name `smtp.example.com`. Other mail
+servers may be more likely so flag your sent emails as spam if you do not have a PTR record. Preferable the forward
+(A/AAAA) and reverse (PTR) records match.
+
+
diff --git a/src/content/docs/ispmail-trixie/140-certbot.mdx b/src/content/docs/ispmail-trixie/158-certbot.mdx
similarity index 96%
rename from src/content/docs/ispmail-trixie/140-certbot.mdx
rename to src/content/docs/ispmail-trixie/158-certbot.mdx
index f1d85c2..3c101fd 100644
--- a/src/content/docs/ispmail-trixie/140-certbot.mdx
+++ b/src/content/docs/ispmail-trixie/158-certbot.mdx
@@ -3,9 +3,13 @@ title: TLS certificate
lastUpdated: 2025-08-24
slug: ispmail-trixie/tls-certificate
sidebar:
- order: 140
+ order: 158
---
+import StepListReceive from "../../../components/StepListReceive.astro";
+
+
+
Your mail server can't work properly without a valid TLS certificate. It will be used in three places:
1. the **webmail** interface (driven by the Apache web server)
@@ -13,7 +17,7 @@ Your mail server can't work properly without a valid TLS certificate. It will be
3. **Dovecot** (to encrypt IMAP/POP3 communication)
Your mail server will be able to host email addresses for many domains. But a TLS certificate is usually issued for a
-single [FQDN](https://en.wikipedia.org/wiki/Fully_qualified_domain_name) like “mail.example.org”. That _common name_ is
+single [FQDN](https://en.wikipedia.org/wiki/Fully_qualified_domain_name) like `mail.example.org`. That _common name_ is
an important part of the certificate. It must match the name you use to talk to the server.
**Correct**: Your mail server is addressed as `mail.example.org`. The TLS certificate was also issued to
diff --git a/src/content/docs/ispmail-trixie/160-receive-emails-postfix.mdx b/src/content/docs/ispmail-trixie/160-receive-emails-postfix.mdx
index cbb2215..80ab197 100644
--- a/src/content/docs/ispmail-trixie/160-receive-emails-postfix.mdx
+++ b/src/content/docs/ispmail-trixie/160-receive-emails-postfix.mdx
@@ -8,108 +8,13 @@ sidebar:
import { Aside } from "@astrojs/starlight/components";
-import "@splidejs/splide/css";
-import { Splide, SplideSlide } from "astro-splide";
-
import { Steps } from "@astrojs/starlight/components";
import Box from "../../../components/Box.astro";
import StepListReceive from "../../../components/StepListReceive.astro";
-I have created a slideshow to help you understand the process of receiving an email from a remote mail server. Use the
-arrows to navigate between slides:
-
-
- {Array.from({ length: 24 }, (_, i) => i + 1).map((i) => (
-
-
-
- ))}
-
-
----
-
-Let's tackle the receiving of emails step by step:
-
-## DNS
-
-
-
-As shown in the slideshow, you need to have proper DNS records set up. Say that you want to receive emails for the
-`example.com` domain. If some other mail server on the internet wants to send an email to your server, it looks for two
-records:
-
-- **MX record (`example.com`)**
- The MX (Mail Exchange) record tells other mail servers _where to deliver emails_ for the domain `example.com`.
- Instead of pointing directly to an IP address, it points to a **hostname** (for example, `smtp.example.com`).
- MX records also include a **priority value**. If multiple mail servers are listed, the one with the lowest priority
- number is tried first. Others are used as fallback if the first is unavailable.
-
-- **A / AAAA record (`smtp.example.com`)**
- The hostname specified in the MX record (`smtp.example.com`) must resolve to an IP address so that other mail servers
- know how to reach it.
- - An **A record** maps the hostname to an IPv4 address.
- - An **AAAA record** maps the hostname to an IPv6 address.
-
- Once resolved, the sending mail server connects to that IP address on **TCP port 25**, which is the standard port for
- email delivery (SMTP).
-
-
-
-
-
-In zone syntax you would create something like:
-
-```
-@ IN MX 10 smtp
-smtp IN A 100.64.17.3
-smtp IN A fd7a:115c:a1e0::17
-```
-
-If possible, also add a PTR record that makes the IP addresses point back to the name `smtp.example.com`. Other mail
-servers may be more likely so flag your sent emails as spam if you do not have a PTR record. Preferable the forward
-(A/AAAA) and reverse (PTR) records match.
-
-
-
-## Postfix
-
-
+
Now that other mail servers can locate your mail server, the next step is to make sure it can receive and process
incoming emails. This task is handled by Postfix, which communicates using the SMTP protocol.
diff --git a/src/content/docs/ispmail-trixie/165-deliver-emails-dovecot.mdx b/src/content/docs/ispmail-trixie/165-deliver-emails-dovecot.mdx
index 6dc819b..f9e127d 100644
--- a/src/content/docs/ispmail-trixie/165-deliver-emails-dovecot.mdx
+++ b/src/content/docs/ispmail-trixie/165-deliver-emails-dovecot.mdx
@@ -109,127 +109,101 @@ authenticate your users which is relevant later when we set up _relaying_.
### 10-ssl.conf
-TODO: verify
-
-Earlier in this guide you created both a key and a certificate file to encrypt the communication with POP3, IMAPs and
-HTTPS between the users and your mail server. You need to tell Dovecot where to find these files:
-
-```
-ssl\_cert = \
- Ending a line with a backslash (\) means that it is continued on the next line. It keeps the configuration more
- readable when it is split over multiple lines.
-
-
-What these lines mean:
-
-- driver: the kind of database. MariaDB is the same kind as MySQL.
-- connect: where to find the MySQL database and how to access it (username, password)
-- user_query: an SQL query that returns the user name (=the email address), the quota, the home directory, user ID and
- group ID.
-- password_query: this SQL query just gets the password hash from the database
-- iterate_query: ‘doveadm’ uses this query to get a list of all users. That allows you to use the “doveadm user ‘\*'”
- command later.
-
-The _user_query_ gets several pieces of information from the database. Let’s look at it one by one:
-
-- email AS user
- It gets the the _email_ field from the database which corresponds to the user name. Dovecot expects it in the _user_
- field so we set an alias to _“user”._
-- userdb_quota_rule
- This is the user’s quota in bytes. Think of it as the maximum possible space on disk that the user can occupy. As
- [documented](https://doc.dovecot.org/configuration_manual/quota/#per-user-quota) Dovecot expects the quota in a
- special format like “\*:bytes=10000” if the user should not be able to store more than 10,000 bytes. That’s why we
- begin the string with ‘\*:bytes=’.
-- userdb_home
- This leads to the directory where all emails and various control files for this user are located. The placeholder
- ‘%d’ replaces the domain and ‘%n’ the user part. So for John that makes it “/var/vmail/example.org/john”.
-- userdb*uid and userdb_gid
- Those are the user ID and group ID of \_vmail* user – 5000 for both. Dovecot uses it to set the permissions of files
- it creates. As all users share the same system user “vmail” this is just a static number.s
-
-## Fix permissions
+Dovecot can also read the path to a user's home directory and the user-ID and group-ID from the database. Our setup has
+a fixed schema for the home directory (`/var/vmail/DOMAIN/USER`) and the user-ID and group-ID are always `vmail` and
+`vmail`.
Make sure that only root can access the SQL configuration file so nobody else is reading your database access passwords:
+```sh
+chown root:root /etc/dovecot/conf.d/auth-sql.conf.ext
+chmod go= /etc/dovecot/conf.d/auth-sql.conf.ext
```
-chown root:root /etc/dovecot/dovecot-sql.conf.ext
-chmod go= /etc/dovecot/dovecot-sql.conf.ext
-```
+
+## Restart Dovecot
Restart Dovecot from the shell:
-```
+```sh
systemctl restart dovecot
```
-Look at your /var/log/mail.log logfile. You should see:
+Check your logs:
+
+```sh
+journalctl -fu dovecot
+```
+
+You should see:
```
-... Dovecot v2.3.13 (f79e8e7e4) starting up for imap, lmtp, sieve, pop3 (core dumps disabled)
+dovecot[13309]: master: Dovecot v2.4.1-4 (7d8c0e5759) starting up for imap, lmtp, sieve (core dumps disabled)
+systemd[1]: Started dovecot.service - Dovecot IMAP/POP3 email server.
```
If you get any error messages please double-check your configuration files.
+
+