Good day, First take care of the dns settings:
- an A (and AAAA record for IPv6) record is declared to name your mail server
mail.nurdspace.nl A 217.69.8.253 mail.nurdspace.nl AAAA 2001:19f0:6801:867:5400:01ff:fee7:7af7
- an MX record is declared to let the world know that mail.nurdspace.nl handles mail for nurdspace.nl
- 0 is the highest preference, if we had a backup MX we'd set a higher number on it,
- let's keep that for later, shall we ?
nurdspace.nl. MX 0 mail.nurdspace.nl.
- nurdspace.nl. MX 10 mail-backup.nurdspace.nl. <- that is a backup mx record.
some vps providers use a different dns interface: use then @ insteat nurdspace.nl. MX 0 mail.nurdspace.nl.
example from transip.nl: @ mx 0 mail they fill automagisch your domainname in.
second step is check the dns setting use command host mail.nurdspace.nl. you get if everyting is good the reply mail.nurdspace.nl has address 1.1.1.1 and if yoy config ipv6 you get a ipv6 reply. then use dig -t mx nurdspace.nl +short you get if everyting is good the reply 0 mail.nurdspace.nl. also the reverse dns must also right config check host 1.1.1.1 the answer you should expect is: 1.1.1.1.in-addr.arpa domain name pointer mail.nurdspace.nl.
the third step is: makeing spf working. add the next record to your dns server: nurdspace.nl. IN TXT v=spf1 mx -all
create a directory to hold the keys:
- mkdir /etc/mail/dkim
Then, the following commands will generate the keypair and extract the public key out of the private key:
- openssl genrsa -out /etc/mail/dkim/nurdspace.nl.key 1024
Generating RSA private key, 1024 bit long modulus ..............................++++++ ...............++++++ e is 65537 (0x10001)
- openssl rsa -in /etc/mail/dkim/nurdspace.nl.key -pubout -out /etc/mail/dkim/nurdspace.nl.pub
writing RSA key
- cat /etc/mail/dkim/nurdspace.nl.pub
BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDThHqiM610nwN1nmV8OMc7PaPO uJWVGRDz5bWj4cRjTTmQYjJQd02xrydRNrRhjEKBm2mMDArNWjoM3jvN04ZifqJx DmKr7X8jsYi+MPEHz6wZxB8mayDK6glYTCyx//zl1luUdvm26PutA38K8cgnb7iT kfVP2OqK6sHAdXjnowIDAQAB
END PUBLIC KEY-----
Finally, I can create the DNS TXT record by extracting the public key out of the armor delimiters and formatting the content so it displays as follows:
<selector>._domainkey.nurdspace.nl. IN TXT "v=DKIM1;k=rsa;p=the publickey just generated ;"
The name of the record should be constructed using this pattern: <selector>._domainkey.<domain>., where <selector> is a name you chose and which allows multiple keys to coexist. next step: Create a dmarc record in your dns server: _dmarc.nurdspace.nl. IN TXT "v=DMARC1;p=none;pct=100;rua=mailto:postmaster@nurdspace.nl;"
The format of DMARC records goes beyond this article and you’ll find multiple examples in any search engine, but a very simple record will simply state a policy (p=) of none (reject if you want to be harsh, quarantine if you need more time to decide). The percentage field (pct=) declares how many of these mails should be subjected to the DMARC policy, and the Reporting URI of Aggregated field (rua=) is where you should receive DMARC reports should you want to analyze them (before switching from quarantine to reject for example)
howto make self singing tls with let's encrypt
Simply copy the example configuration from /etc/example/httpd.conf to /etc/httpd.conf, replace example.com with mail.nurdspace.nl and remove the tls block since we only care about serving the challenge. The file should now read as follow:
server "mail.nurdspace.nl" {
listen on * port 80
location "/.well-known/acme-challenge/*" {
root "/acme"
request strip 2
}
location * {
block return 302 "https://$HTTP_HOST$REQUEST_URI"
}
}
The httpd daemon can be started with the following command:
- rcctl -f start httpd
httpd(ok)
The acme-client itself is straighforward to configure, again simply copy the example configuration from /etc/example/acme-client.conf to /etc/acme-client.conf, replace example.com with mail.nurdspace.nl and you should end up with a block like this:
domain mail.nurdspace.nl {
domain key "/etc/ssl/private/mail.nurdspace.nl.key"
domain full chain certificate "/etc/ssl/mail.nurdspace.nl.fullchain.pem"
sign with letsencrypt
}
at this point you can simply run acme-client on the domain:
- acme-client -v mail.nurdspace.nl
[...] acme-client: /etc/ssl/mail.nurdspace.nl.fullchain.pem: created
The certificate and keys are created at the appropriate place, we’ll later adjust paths in OpenSMTPD and Dovecot to point to the proper files.
now install Rspamd: mail$ doas pkg_add redis rspamd opensmtpd-filter-rspamd [...] redis-4.0.14: ok rspamd-1.9.0: ok opensmtpd-filter-rspamd-0.1.1: ok The following new rcscripts were installed: /etc/rc.d/redis /etc/rc.d/rspamd See rcctl(8) for details. Rspamd is highly configurable so if you want to do funky things, it’s up to you to go read the extensive documentation. For the purpose of this article I’ll keep it very basic, as is the case on my own machines.
I could edit the configuration in /etc/rspamd/actions.conf to adjust junking thresholds to my liking, but the defaults suit me fine so this was just to show them to you:
actions {
reject = 15; # Reject when reaching this score add_header = 6; # Add header when reaching this score greylist = 4; # Apply greylisting when reaching this score (will emit `soft reject action`) [...]
And what I really, really want is for Rspamd to handle my DKIM signing because this is one of the requirements to not look bad to the world.
This is done by providing the configuration to match the DKIM key I generated earlier in /etc/rspamd/local.d/dkim_signing.conf:
- mkdir /etc/rspamd/local.d
- cat << EOF >/etc/rspamd/local.d/dkim_signing.conf
allow_username_mismatch = true;
domain {
nurdspace.nl {
path = "/etc/mail/dkim/nurdspace.nl.key";
selector = "20190913";
}
} EOF
The allow_username_mismatch configuration is needed here because Rspamd expects usernames to contain the domain name, but in this setup OpenSMTPD authenticates against simple usernames. Also make sure the dkim key file is readable by members of the _rspamd group.
- rcctl enable redis
- rcctl enable rspamd
And I can start them right away so we don’t have to wait until next reboot:
- rcctl start redis
redis(ok)
- rcctl start rspamd
rspamd(ok)
now Config opensmtpd
The default configuration for OpenSMTPD is suitable for local mail server, not accepting connections from the outside, but able to let local users exchange messages between themselves and to a remote host. It looks like this:
- $OpenBSD: smtpd.conf,v 1.11 2018/06/04 21:10:58 jmc Exp $
- This is the smtpd server system-wide configuration file.
- See smtpd.conf(5) for more information.
table aliases file:/etc/mail/aliases
- To accept external mail, replace with: listen on all
listen on lo0 <- change to your external networkcard
action "local_mail" mbox alias <aliases> action "outbound" relay pki mail.nurdspace.nl cert "/etc/ssl/mail.nurdspace.nl.fullchain.pem" pki mail.nurdspace.nl key "/etc/ssl/private/mail.nurdspace.nl.key" those 2 pki lines declare that mail.hypno.cat will use the certificate and key we generated earlier for TLS.
filter check_dyndns phase connect match rdns regex { '.*\.dyn\..*', '.*\.dsl\..*' } \
disconnect "550 no residential connections"
filter check_rdns phase connect match !rdns \
disconnect "550 no rDNS is so 80s"
filter check_fcrdns phase connect match !fcrdns \
disconnect "550 no FCrDNS is so 80s"
filter senderscore \
proc-exec "filter-senderscore -blockBelow 10 -junkBelow 70 -slowFactor 5000"
filter rspamd proc-exec "filter-rspamd"
table aliases file:/etc/mail/aliases
listen on all tls pki mail.nurdspace.nl \
filter { check_dyndns, check_rdns, check_fcrdns, senderscore, rspamd }
listen on all port submission tls-require pki mail.nurdspace.nl auth filter rspamd
- Uncomment the following to accept external mail for domain "example.org"
- match from any for domain "nurdspace.nl" action "local_mail"
match for local action "local_mail" match for any action "outbound"
this all you need to config
now install dovecot mail# pkg_add dovecot dovecot-2.3.7.2v0: ok The following new rcscripts were installed: /etc/rc.d/dovecot See rcctl(8) for details. New and changed readme(s):
/usr/local/share/doc/pkg-readmes/dovecot
[...]
And, specifically for OpenBSD, following instructions from the readme, the /etc/login.conf file should contain a dovecot class to bump the resources allowed as Dovecot is very hungry for file descriptors:
dovecot:\
:openfiles-cur=1024:\ :openfiles-max=2048:\ :tc=daemon:
I do that by tweaking the ssl_cert and ssl_key configuration keys in the /etc/dovecot/conf.d/10-ssl.conf let they point to your TLS certificate we generated earlier. Then Dovecot must be told that mails should be looked up in the user ~/Maildir directory as this is where OpenSMTPD drops files. I do that by tweaking the mail_location configuration key in the /etc/dovecot/conf.d/10-mail.conf file so it reads as follows:
mail_location = maildir:~/Maildir
We’re all set, we can enable the daemon so it’s started at next boot, and start it right away:
mail# rcctl enable dovecot mail# rcctl start dovecot dovecot(ok)
this all for working email server. greetings rubberduck