p E-mail itself is a system consisting of several parts. A main E-mail protocol — SMTP is used for exchanging of mail between servers. For a user to manage his mail IMAP and POP3 protocols are used. Difference between IMAP and POP3 is that IMAP manages mail stored on a server, while POP3, once fetched mail, deletes it from server.
p As SMTP server I use Postfix. For IMAP (I don't use POP3 because I need access from multiple devices) I use Dovecot. Dovecot is also being used for SASL authentication in Postfix. And Dovecot supports Sieve protocol, through its implementation called Pigeonhole, that allows users to write their own message filtering rules.
p But, as you know, there is a major problem called spam. And in order to withstand this problem there was mechanisms created. So that no one could impersonate you DKIM, DMARC and SPF were created. To ensure encrypted connection a MTA-STS (RFC8461) standard was made. To resist incoming spam anti-spam systems like SpamAssassin or spamd are used. Also it is good to check incoming mail for viruses, there are many antiviruses and I use one called ClamAV.
p I have mentioned DKIM (DomainKeys Identified Mail), it is used to sign mail going out that it is indeed comes from your server, and verify incoming mail. And for that I use OpenDKIM implementation.
p DMARC (Domain-based Message Authentication, Reporting and Conformance) is a policy that tells the server what to do if received mail failed some checks. To perform DMARC policy checks I use OpenDMARC implementation. OpenDMARC also performs SPF policy checks.
p SPF (Sender Policy Framework) allows the server to check that an incoming mail came from an IP address set in SPF DNS record for domain it originates from.
p Many servers will reject mail from a dynamic IP-address, so a static address is a must. But, from my experience, GMail, Yandex and Rambler will at least place my message to Junk directory. On Gmail I get to Inbox most of the time btw. There is such thing used against spam called block lists, and Spamhaus is the biggest player here. So, if a server uses such lists I get rejected at the stage of establishing a connection with no chance to get through anti-spam system.
p If you have a static address then in Spamhaus you can submit your address for deletion.
p Also, while not stated by RFCs, some servers will still reject your mail if your IP-address doesn't have a PTR DNS record set, and some will expect a PTR record to be a hostname of your server, like mail.example.org, or like my the.arav.su.
p There is another problem known as not trusted top level domain, like mine .su domain. :) Because of how cheap it is, it is popular among spammers.
p You need to install following packages: #[code postfix], #[code dovecot], #[code pigeonhole] (or could be named as #[code dovecot-sieve]), #[code clamav], #[code opendkim], #[code opendmarc], #[code spamassassin], and #[code postgrey].
p Its configuration files are in directory #[code /etc/postfix]. There are two configuration files we'll work with. The first one is a #[code main.cf] file. Then we configure services in #[code master.cf]. Also I'll show you how to make aliases for users.
p #[code myhostname] should be a subdomain that points to an IP of a mail server. This hostname is usually an A DNS record even if you have only one IP-address it is discuraged making it a CNAME.
p #[code mydomain] is your domain. In #[code myorigin] we set a domain name from what sent mail appear. Yes, you can use other options as a variable to reduce copy-pasting.
p Here we leave only IPv4 support, if you have an IPv6 address then you may want to add #[code ipv6].
p So here we are done with an existing configuration and ready to make our additions to add encryption, milters, configure SASL authentication, restrictions and make some tweaks.
p And we start with configuring milters. Milter stands for mail filter, a special protocol originated in Sendmail SMTP server.
p #[code smtpd_milters] is a list of milters the messages will go through. You can connect to milter with internet protocol with #[code inet:], with a unix socket #[code unix:]. The last one with port 7357 is a ClamAV.
p #[code mailbox_size_limit] and #[code message_size_limit] sets maximum size of a whole mailbox and of each email. Here I set no limit for a mailbox, and max of 50MiB for an email message.
p It's pretty clear. We chose dovecot as our SASL server, set path to it that lies within /var/spool directory, and then enabled it. Then we prohibit anonymous connections. Add our domain for SASL authentication, and deny access for the clients with obsolete version of AUTH command.
p It's time for encryption, lets specify a list of high (strong) ciphers to use:
p First we enable it with a #[code smtp_use_tls]. Enforce use of encryption with (#[code smtp_tls_security_level]) set to encrypt. Noting servers of our ability to use encryption with option #[code smtp_tls_note_starttls_offer]. Reuse connection instead of opening the new one each time.
p #[code smtp_tls_key_file] and #[code smtp_tls_cert_file] are paths to our TLS key and certificate.
p In #[code smtp_tls_mandatory_protocols] and #[code smtp_tls_protocols] we disallow old vulnerable protocols to use. Leave only TLS version 1.2 and 1.3 available.
p In #[code smtp_tls_mandatory_ciphers] we declare to use only good secure cyphers we previously set.
p For incoming connections everything is the same, just a few more options added:
p The final part is my "favorite". :) The restrictions! There is a set of them for each stage the message falls through. Here are the ones I configured:#[code smtpd_helo_restrictions], #[code smtpd_relay_restrictions], #[code smtpd_data_restrictions], #[code smtpd_sender_restrictions], and #[code smtpd_recipient_restrictions].
p In order to explain what every restriction does I'd have to copy-paste from #[code man 5 postconf]. :)
p The first set of restrictions are for HELO or EHLO command, that we force the client to send with priorly set option #[code smtpd_helo_required] to yes. Here #[code reject_unknown_helo_hostname] rejects hostnames that doesn't have DNS A or MX records. #[code reject_invalid_helo_hostname] rejects malformed hostnames, and #[code reject_non_fqdn_helo_hostname] ensures that the hostname is a fully-qualified domain name.
p The second one are for DATA command. And here man page is better than me at explaining it. Here is the link for #[a(href='http://www.postfix.org/postconf.5.html#reject_multi_recipient_bounce') reject_multi_recipient_bounce] and #[a(href='http://www.postfix.org/postconf.5.html#reject_unauth_pipelining') reject_unauth_pipelining]. Or just look them up in #[code man 5 postconf]. All I can say is that it is better to have them than not to. :)
p The rest is simpler, #[code permit_sasl_authenticated] in #[code smtpd_sender_restrictions] accepts the senders that were authenticated by SASL (e.g. Dovecot or Cyrus). And all the #[code reject_unknown_*] and #[code reject_non_fqdn_*] has the same meaning as for theirs *_helo_* counterparts, just used in theirs specific places.
p The following services are needed: #[code smtp], #[code submission], #[code smtps], and we add #[code spamassassin] service. The rest in this file left untouchable.
p #[code smtp] is listening on port 25, and #[code smtps] on port 465. #[code submission] is listening on port 587 and is used by mail client to send mail.
p User aliases are in #[code aliases] file. They has a form "#[code <alias>: <username>]", e.g. #[code me: arav]. Where #[code username] may be other alias. After editing you need to run #[code newaliases] program to update #[code aliases.db] file.
p To start a Postfix service on systemd-based Linux distro run #[code systemctl start postfix]. To make Postfix run on every boot run #[code systemctl enable postfix].
p As I stated in the Introduction I use only IMAP, since it keeps mail on a server.
p First we need to create a #[code /etc/dovecot] directory and copy example configuration there, but we don't need everything. Example configuration lies in a #[code /usr/share/doc/dovecot/example-config] directory.
p Copy #[code dovecot.conf] file and #[code conf.d] directory.
p We will need #[code dovecot.conf] and files from a #[code conf.d] directory: 10-auth.conf, 10-mail.conf, 10-ssl.conf, 15-mailboxes.conf, 20-lmtp.conf, 90-sieve.conf, 10-logging.conf, 10-master.conf, 15-lda.conf, 20-managesieve.conf, auth-system.conf.ext.
p Here I will leave a brief necessary explanation of options, since you will see theirs documentation when will be editing configs.
p Set #[code ssl = required] to enable and enforce encryption.
p In #[code ssl_cert] and #[code ssl_key] set paths to your TLS certificate and key.
p Next you will see #[code ssl_key_password] where you type in your certificate's password if it is set.
p And if you run your own PKI then you can specify your CA cert in #[code ssl_ca].
p Next good thing to do is to generate Diffie-Hellmann parameters file and set it in #[code ssl_dh] option. How to do it is written in a help comment for this option.
p Next set a cipher list #[code ssl_cipher_list] to a list you previously specified in Postfix's #[code main.cf] file.
p And finally #[code ssl_prefer_server_ciphers = yes].
p Here in a namespace inbox leave Drafts, Junk, Trash, and Sent mailboxes. Additionally, for every mailbox I added #[code auto = subscribe] options so they will appear in a mail client.
p Uncomment #[code protocols] option, #[code service managesieve-login], and #[code service managesieve] sections.
p Within #[code service managesieve-login] section uncomment fully #[code inet_listener sieve] sub-section. And next you can tweak #[code service_count], #[code process_min_avail] and #[code vsz_limit] options to your taste.
p For training use #[code sa-learn] utility and use #[code --ham] and #[code --spam] to mark messages as normal mail and spam. I additionaly have to specify a path to database with #[code --dbpath /var/lib/spamassassin/.spamassassin], otherwise it will complain, so try first without it.
p I myself set up a multi-domain variant just in case. So, here we have two main tables: #[code KeyTable] and #[code SigningTable]. Those files tells OpenDKIM where to find keys and what domains to sign. You may use one key for all domains or generate keys for each domain.
p #[code InternalHosts] tells OpenDKIM what hosts should be signed rather than verified.
p #[code Socket] tells where to listen to connections, in this case we use UNIX sockets.
p #[code Mode] selects operating mode(s). In our case we have two modes: (s)igner and (v)erifier.
p #[code SubDomains] set to yes tells that we allow subdomains of our domains to be signed and verified.
p #[code Canonicalization] selects the canonicalization method(s) to be used with signing. We set relaxed for header and simple for body. I don't fully understand it and just use what suggested.
p Below are logging options that tells to write in syslog.
p With #[code SoftwareHeader] set to yes OpenDKIM will be always adding "DKIM-Filter" header field.
p This command will generate a key pair stored in files "myselector.private" and "myselector.txt" for a given domain.
p #[code -r] restricts the key to emails use only. #[code -s] is a name of selector.#[code -b] is the size of the key in bits. #[code -d] is our domain.
p Name of a selector is usually a #[code mail], but that's just what I use, you can choose whatever you want.
p #[code systemctl start opendkim] and #[code systemctl enable opendkim] to start and enable OpenDKIM service to run on OS start up if you got Poetteringed just like me. :)
p It's good to have a dedicated A (IPv4 address) or AAAA (IPv6 address) record for a mail server's hostname instead of a CNAME record so other servers won't need to do two DNS requests. Hostname is usually mail.example.org if there's just one server, you can call it whatever you want. Remind you that we set it in Postfix in #[code myhostname] option.
p PTR is a reverse DNS record that stands for pointer and is used to “bind” a hostname to IP-address. Mail servers looks for this record and check so this name equals to a hostname provided in EHLO. Most servers will reject your mail if your PTR looks something like 1.2.3.4.pppoe.someisp.net or not set at all.
p There are three ways to set this record: ask your hosting or internet-provider, or get your own Autonomous System (:^)).
p SPF stands for Sender Policy Framework and in my case it looks exactly like this:
pre
| v=spf1 +a +mx -all
p So, #[code v] is a version of a protocol. #[code +a +mx] means that only servers specified in the A and MX DNS records could send email, and #[code -all] that no one else could do that.
p #[code p] is a default policy that could be set to #[code none], #[code quarantine] and #[code reject]. I chose to #[code reject] mail that comes from «me” if there's something wrong with a origin of a message. If you could get email from subdomains then you need to set #[code sp] as well.
p #[code rua] is an address for the reports and #[code ruf] is for the forensic reports. #[code aspf] verifies that an address in the MAIL FROM command and #[code From:] header matches example.org in strict (s) mode, and in relaxed (default, r) mode matches domain or its subdomains. For #[code adkim] is the same except in this case sender domain name should match a domain in #[code d=domain] in a #[code DKIM-Signature] header.
p All you need to make it work together with Postfix is to add #[code /run/clamav/milter.sock] to #[code smtpd_milters] and #[code non_smtpd_milters] options in Postfix, also make some changes in configs of ClamAV.
p In #[code clamav-milter.conf] you need the following:
pre
| MilterSocket unix:/run/clamav/milter.sock
| ClamdSocket unix:/run/clamav/clamd.ctl
p Also, in case you need ClamAV to add headers also in case a message is free of viruses add #[code AddHeader Add] or #[code AddHeader Replace] option. The difference between them is detaily described in config file itself.
p Before starting ClamAV you need to update its virus definitions with #[code freshclam] util. Also, enable and start #[code clamav-freshclam] systemd service to keep definitions recent.
p I don't know how it is in other distros, but, for whatever reason, an Arch Linux's package doesn't come with a systemd service file for the ClamAV milter. So I just copy it here from <a href="https://wiki.archlinux.org/index.php/ClamAV#Using_the_milter" rel="noopener noreferrer" target="_blank">ArchWiki</a>:
p Next you need to enable and start #[code clamav-daemon] and #[code clamav-milter].
h3#art-10 #[a(href='#art-10') 10. Greylisting with postgrey]
p #[code postgrey] is being configured primarily by passing arguments you configure in its service file. I go by defaults. So it is listening on #[code 127.0.0.1:10030].
p So, to set a listen port pass this option: #[code --inet=127.0.0.1:10030].
p To configure greylisting duration use option #[code --delay=seconds]. #[code --max-age=N] to delete entries older than N days since the last time that they have been seen.
p Look #[code perldoc postgrey] for help.
p There are two configuaration files named #[code postgrey_whitelist_clients] and #[code postgrey_whitelist_recipients]. Dunno about other distros, but in ArchLinux they are in #[code /etc/postfix]. Could be in #[code /etc/postgrey] in other distros.
p #[code postgrey_whitelist_clients] is list of trusted SMTP servers that will not be greylisted. Also there comes some problematic servers that will not attempt to send a mail again, or have a large pool of addresses. This file comes pre-filled with some known server such as #[code gmail.com] and #[code outlook.com].
p #[code postgrey_whitelist_recipients] contains a list of recipients for which mail won't be greylisted. By default there are #[code postmaster] and #[code abuse] recipients listed.
p In postfix's #[code main.cf] you need just add this last line:
