Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| email:configure-dkim-spf-dmarc [2025/03/06 06:51] – willy | email:configure-dkim-spf-dmarc [2025/06/13 12:43] (current) – willy | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Configure proper mail delivery ====== | + | ====== |
| You need access to your domain DNS records, this is mandatory. | You need access to your domain DNS records, this is mandatory. | ||
| Line 63: | Line 63: | ||
| === Socket Setup === | === Socket Setup === | ||
| - | For security reasons you want the DKIM keys not to be readable by Postfix, but you want Postfix capable to access the OpenDKIM socket or it would not be possible to actually sign any outbound email at all. The default Gentoo users setup is not ideal for this, as you either let Postfix access the keys by adding it to the // | + | For security reasons you want the DKIM keys not to be readable by Postfix, but you want Postfix capable to access the OpenDKIM socket or it would not be possible to actually sign any outbound email at all. The default Gentoo users setup is not ideal for this, as you either let Postfix access the keys by adding it to the // |
| The solution is to add a new group, called **dkimsocket**, | The solution is to add a new group, called **dkimsocket**, | ||
| Line 76: | Line 76: | ||
| Let's wrap it all up with the following **/ | Let's wrap it all up with the following **/ | ||
| <file - opendkim.conf> | <file - opendkim.conf> | ||
| + | Syslog | ||
| + | SyslogSuccess | ||
| + | Canonicalization | ||
| + | SendReports | ||
| + | PidFile / | ||
| + | Socket local:/ | ||
| + | UMask 0117 | ||
| + | UserID opendkim: | ||
| + | AutoRestart | ||
| + | AutoRestartRate | ||
| + | Mode sv | ||
| + | # Use the following lines for a single domain/ | ||
| + | Domain | ||
| + | Selector | ||
| + | KeyFile | ||
| + | # Use the following lines for multiple domain/ | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| </ | </ | ||
| + | If you want to use multiple domains and selectors, you need to create the table files and put the multiple references there. Check the official OpenDKIM documentation linked above. | ||
| === Start & Autostart OpenDKIM === | === Start & Autostart OpenDKIM === | ||
| Line 95: | Line 115: | ||
| + | |||
| + | ===== DMARC (Domain-based Message Authentication, | ||
| + | |||
| + | OpenDMARC sample configutation can be found [[https:// | ||
| + | |||
| + | This is pretty easy to setup, just edit the **/ | ||
| + | <file - opendmarc.conf> | ||
| + | AuthservID mydomain.com | ||
| + | FailureReports true | ||
| + | RejectFailures false | ||
| + | SPFSelfValidate yes | ||
| + | Socket local:/ | ||
| + | SoftwareHeader true | ||
| + | Syslog true | ||
| + | SyslogFacility mail | ||
| + | TrustedAuthservIDs mail.mydomain.com | ||
| + | HistoryFile / | ||
| + | UMask 0002 | ||
| + | UserID opendmarc | ||
| + | PidFile / | ||
| + | </ | ||
| + | |||
| + | === DNS record === | ||
| + | |||
| + | A DMARC DNS record can be pretty simple or pretty complex. [[https:// | ||
| + | |||
| + | The following is a simple example that you can start from: | ||
| + | < | ||
| + | _dmarc IN TXT ( " | ||
| + | </ | ||
| + | |||
| + | where: | ||
| + | * p: policy, you want reject here most probably | ||
| + | * rua: email address to sent aggregate reports to (optional) | ||
| + | * ruf: email address to sent failure reports to (optional) | ||
| + | |||
| + | === Postfix setup === | ||
| + | |||
| + | OpenDMARC acts as a //milter//, which means a mail filter, for Postfix. The postfix configuration described [[email: | ||
| + | |||
| + | === Start & Autostart OpenDMARC === | ||
| + | |||
| + | <code bash> | ||
| + | rc-update add opendmarc default | ||
| + | / | ||
| + | </ | ||