Configure proper mail delivery

You need access to your domain DNS records, this is mandatory.

SPF works both outbound and inbound

This is the most difficult, but critical step. You need to add to your DNS a TXT record shaped like this:

mydomain.com.  IN TXT  "v=spf1 +a +mx +ptr -all"

This record specify who is allowed to send email for the mydomain.com domain and who is not allowed to. Anything with a + is allowed while with a - is not allowed.

For the above example:

• v=spf1: the type (SPF) and version (1) of the record
• a: refer to mydomain.com
• mx: refer to the mx record of the domain
• ptr: refer to mydomain.com reverse hostname
• -all: anybody. Always always always put -all as the last part of the record.

In short, the above record allow only our mx record and main domain to send emails for mydomain.com, while everybody else is not allowed. So, email providers that follow SPF standard will reject any email sent as mydomain.com sender if not coming from mydomain.com or mail.mydomain.com (i am assuming mail is your mx record).

This will be enough to protect your outgoing email from being flagged as spam.

You have already installed Engine-SPF which is a very nice python script that acts as a mail filter and, if added to Postfix chain, will automatically do the SPF check on incoming email for you and flag it as spam if it breaks the SPF rules.

There is nothing to configure! If you followed this page, it's already setup.

OpenDKIM provides great documentation http://www.opendkim.org/docs.html!here.

You need to choose a selector name, and i suggest you use mydomain.com as selector, and you need to generate a set of keys and DNS record with the following command:

cd /etc/opendkim
opendkim-genkey -s mydomain.com

This will create two files: mydomain.com.private, which contains the secret key, and mydomain.com.txt which contains the DKIM public signature that you need to incorporate in your DNS as a TXT record.

+ Check postfix setup

You also need to edit /etc/opendkim/opendkim.conf like this:

opendkim.conf

Syslog                  yes
SyslogSuccess           yes
Canonicalization        relaxed/relaxed
SendReports             yes
PidFile /run/opendkim/opendkim.pid
Socket local:/var/run/opendkim/opendkim.sock
UMask 0117
UserID opendkim:dkimsocket

+ qui cosa manca

AutoRestart             Yes
AutoRestartRate         10/1h
Mode                    sv

rc-update add opendkim default
/etc/init.d/opendkim start

After your DNS record has propagated, you can test it with:

opendkim-testkey -d mydomain.com -s mydomain.com -k mydomain.com.private