| OpenBSD &Opensmtpd | |
|---|---|
 | |
| Participants | |
| Skills | Programming, Reading docs |
| Status | Active |
| Niche | Infra |
| Purpose | Communication |
| Tool | No |
| Location | At space |
| Cost | |
| Tool category | Infra |
Openbsd.svg {{#if:No | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:No | [[Tool Cost::{{{Cost}}} | }}
Good day, First take care of the dns settings:
- an A (and AAAA record for IPv6) record is declared to name your mail server
mail.nurdspace.nl A 217.69.8.253 mail.nurdspace.nl AAAA 2001:19f0:6801:867:5400:01ff:fee7:7af7
- an MX record is declared to let the world know that mail.nurdspace.nl handles mail for nurdspace.nl
- 0 is the highest preference, if we had a backup MX we'd set a higher number on it,
- let's keep that for later, shall we ?
nurdspace.nl. MX 0 mail.nurdspace.nl.
- nurdspace.nl. MX 10 mail-backup.nurdspace.nl. <- that is a backup mx record.
some vps providers use a different dns interface: use then @ insteat nurdspace.nl. MX 0 mail.nurdspace.nl.
example from transip.nl: @ mx 0 mail they fill automagisch your domainname in.
second step is check the dns setting use command host mail.nurdspace.nl. you get if everyting is good the reply mail.nurdspace.nl has address 1.1.1.1 and if yoy config ipv6 you get a ipv6 reply. then use dig -t mx nurdspace.nl +short you get if everyting is good the reply 0 mail.nurdspace.nl. also the reverse dns must also right config check host 1.1.1.1 the answer you should expect is: 1.1.1.1.in-addr.arpa domain name pointer mail.nurdspace.nl.
the third step is: makeing spf working. add the next record to your dns server: nurdspace.nl. IN TXT v=spf1 mx -all
create a directory to hold the keys:
- mkdir /etc/mail/dkim
Then, the following commands will generate the keypair and extract the public key out of the private key:
- openssl genrsa -out /etc/mail/dkim/nurdspace.nl.key 1024
Generating RSA private key, 1024 bit long modulus ..............................++++++ ...............++++++ e is 65537 (0x10001)
- openssl rsa -in /etc/mail/dkim/nurdspace.nl.key -pubout -out /etc/mail/dkim/nurdspace.nl.pub
writing RSA key
- cat /etc/mail/dkim/nurdspace.nl.pub
BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDThHqiM610nwN1nmV8OMc7PaPO uJWVGRDz5bWj4cRjTTmQYjJQd02xrydRNrRhjEKBm2mMDArNWjoM3jvN04ZifqJx DmKr7X8jsYi+MPEHz6wZxB8mayDK6glYTCyx//zl1luUdvm26PutA38K8cgnb7iT kfVP2OqK6sHAdXjnowIDAQAB
END PUBLIC KEY-----
Finally, I can create the DNS TXT record by extracting the public key out of the armor delimiters and formatting the content so it displays as follows:
<selector>._domainkey.nurdspace.nl. IN TXT "v=DKIM1;k=rsa;p=the publickey just generated ;"
The name of the record should be constructed using this pattern: <selector>._domainkey.<domain>., where <selector> is a name you chose and which allows multiple keys to coexist. next step: Create a dmarc record in your dns server: _dmarc.hypno.cat. IN TXT "v=DMARC1;p=none;pct=100;rua=mailto:postmaster@nurdspace.nl;"
The format of DMARC records goes beyond this article and you’ll find multiple examples in any search engine, but a very simple record will simply state a policy (p=) of none (reject if you want to be harsh, quarantine if you need more time to decide). The percentage field (pct=) declares how many of these mails should be subjected to the DMARC policy, and the Reporting URI of Aggregated field (rua=) is where you should receive DMARC reports should you want to analyze them (before switching from quarantine to reject for example)