revsuine/revsuine.xyz
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

content/blog/mail_server_alpine_postfix_dovecot_tutorial.md: postfix-policyd-spf-perl section

Browse source
This commit is contained in:
revsuine 2024-11-23 20:47:15 +00:00
parent 343a2d8f22
commit 19c742b0b4
Signed by: revsuine
GPG key ID: 3F257B68F5BC9339
1 changed files with 77 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

77
content/blog/mail_server_alpine_postfix_dovecot_tutorial/index.md
View file

@ -94,10 +94,18 @@ The mail server will be composed of the following software:
<td>Mail delivery agent</td> <td>Mail delivery agent</td>
<td colspan="2">Dovecot</td> <td colspan="2">Dovecot</td>
</tr> </tr>
<tr>
<td>SPF authentication</td>
<td colspan="2">postfix-policyd-spf-perl</td>
</tr>
<tr> <tr>
<td>DKIM authentication and signing</td> <td>DKIM authentication and signing</td>
<td colspan="2">OpenDKIM</td> <td colspan="2">OpenDKIM</td>
</tr> </tr>
<tr>
<td>DMARC authentication</td>
<td colspan="2">OpenDMARC</td>
</tr>
<tr> <tr>
<td>Spam filter</td> <td>Spam filter</td>
<td rowspan="2">Amavis</td> <td rowspan="2">Amavis</td>
@ -801,6 +809,8 @@ checks.
## Sender Policy Framework ## Sender Policy Framework
### Set up your DNS record
Add a TXT record for your root domain with the contents `v=spf1 mx ~all`, like: Add a TXT record for your root domain with the contents `v=spf1 mx ~all`, like:
```dns ```dns
@ -863,6 +873,68 @@ Breaking down the TXT data:
</tr> </tr>
</table> </table>
### Get Postfix to validate SPF
We're going to use a Postfix SMTPd policy server called postfix-policyd-spf-perl to check SPF of incoming emails.
postfix-policyd-spf-perl is very simple and requires almost no configuration.
Install `postfix-policyd-spf-perl` and create a user, `policyd-spf` for it:
# apk add postfix-policyd-spf-perl
# adduser -S -s /sbin/nologin -h /dev/null -H policyd-spf
Explanation of `adduser` flags:
<table>
<tr>
<th>Option</th>
<th>Explanation</th>
</tr>
<tr>
<td><code>-S</code></td>
<td>Create a system user</td>
</tr>
<tr>
<td><code>-s /sbin/nologin</code></td>
<td>Set shell to <code>/sbin/nologin</code> so the user doesn't have a shell</td>
</tr>
<tr>
<td><code>-h /dev/null</code></td>
<td>Set home directory to <code>/dev/null</code></td>
</tr>
<tr>
<td><code>-H</code></td>
<td>
Don't create a home directory (if you try to create <code>/dev/null</code> and assign it to
<code>policyd-spf</code> there will be all sorts of permissions issues)
</td>
</tr>
</table>
Now edit `/etc/postfix/master.cf` to tell Postfix to start up the postfix-policyd-spf-perl daemon:
```conf
policyd-spf unix - n n - 0 spawn
user=policyd-spf argv=/usr/bin/postfix-policyd-spf-perl
```
Now get Postfix to use postfix-policyd-spf-perl in `/etc/postfix/main.cf` by adding the following lines:
```conf
smtpd_recipient_restrictions =
permit_mynetworks,
reject_unauth_destination,
check_policy_service unix:private/policyd-spf
policyd-spf_time_limit = 3600
```
postfix-policyd-spf-perl is now set up, and you can test it by sending yourself an email from a mainstream email
provider (which ought to have an SPF record) and checking for the presence of this header:
```
Received-SPF: pass (protonmail.com: Sender is authorized to use 'revsuine@protonmail.com' in 'mfrom' identity (mechanism 'include:_spf.protonmail.ch' matched))
```
## DomainKeys Identified Mail ## DomainKeys Identified Mail
### Configure OpenDKIM ### Configure OpenDKIM
@ -1065,6 +1137,11 @@ non_smtpd_milters = $smtpd_milters
This uses the Milter extension, which is something that can be used to process mail; in this case, to add headers to This uses the Milter extension, which is something that can be used to process mail; in this case, to add headers to
emails relating to DKIM. emails relating to DKIM.
You can, again, test this on both incoming and outgoing mail. On outgoing mail, there should be a `DKIM-Signature:`
header present. On incoming mail from domains implementing DKIM, there should be a
`Authentication-Results: master.revsuine.xyz;` header (obviously replacing `master.revsuine.xyz` with your hostname)
indicating whether or not the email has passed DKIM authentication.
## Domain-based Message Authentication, Reporting, and Conformance ## Domain-based Message Authentication, Reporting, and Conformance
### Ensure your domains are aligned in email headers ### Ensure your domains are aligned in email headers