|
|
| (60 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) |
| Zeile 1: |
Zeile 1: |
| == Setting up SPF + DK + DKIM with Postfix ==
| | <noinclude> |
| * https://matoski.com/article/spf-dk-dkim-plesk-debian/
| | <!-- |
| | ---- |
| | {{Navigation|<zurück>|<nachste>}} |
| | {{Navigation|BSI/200-3|BSI/200-3/Einleitung/Beispiele}} |
| | ---- |
| | --> |
| | '''{{BASEPAGENAME}}''' - SPF, DK und DKIM mit Postfix |
| | </noinclude> |
|
| |
|
| Shows up a detailed process on how to set up SPF + DK + DKIM with Postfix in Plesk 11.5 on Debian Wheezy, step by step, and how to test to make sure everything is working correctly
| | == Beschreibung == |
| | <ul class="list-group"> |
| | <li class="list-group-item">[[Postfix/Installation|Postfix]]</li> |
| | <li class="list-group-item list-group-item-primary">[[Sender Policy Framework]]</li> |
| | <li class="list-group-item list-group-item-secondary">[[DomainKeys]]</li> |
| | <li class="list-group-item list-group-item-success">[[DKIM]]</li> |
| | <li class="list-group-item list-group-item-danger">[[DNS/SPF/Test|Test]]</li> |
| | </ul> |
|
| |
|
| I leased a dedicated server from [http://hetzner.de/ Hetzner], and I got the Plesk option, for administration, so I don’t have to bother with administration, but turns out I’m not so lucky, I’ve ran into a lot of issues with using Plesk, so I had to do my own fixes.
| | <noinclude> |
| | <!-- |
| | ---- |
| | {{Navigation|<zurück>|<nachste>}} |
| | ---- |
| | --> |
|
| |
|
| So let’s take a look at how we can integrate SPF + DK + DKIM with Postfix in Plesk 11.5 on Debian Wheezy.
| | == Anhang == |
| | === Siehe auch === |
| | <div style="column-count:2"> |
| | <categorytree hideroot=on mode="pages">{{BASEPAGENAME}}</categorytree> |
| | </div> |
| | ---- |
| | {{Special:PrefixIndex/{{BASEPAGENAME}}/}} |
|
| |
|
| First things, first, if you are using QMail switch to Postfix, to install Postfix you can either use the GUI, or you can do it from a console.
| | === Dokumentation === |
| | <!-- |
| | ; Man-Page |
| | # [https://manpages.debian.org/stable/procps/pgrep.1.de.html prep(1)] |
|
| |
|
| Here is how to do it from the console.
| | ; Info-Pages |
| /usr/local/psa/admin/sbin/autoinstaller --select-release-current --install-component postfix
| | --> |
|
| |
|
| === SPF === | | === Links === |
| Let’s open the DNS Template, you will see there that, there is an entry for SPF
| | ==== Projekt ==== |
| | ==== Weblinks ==== |
|
| |
|
| v=spf1 +a +mx -all
| | <!-- |
| | {{DEFAULTSORT:new}} |
| | {{DISPLAYTITLE:new}} |
| | --> |
|
| |
|
| This means the SPF is enabled on our domain.
| | [[Kategorie:DNS]] |
| | [[Kategorie:Spam]] |
| | [[Kategorie:E-Mail]] |
|
| |
|
| Let’s modify it a little bit to be better, if you are gonna host multiple domains from your server, then you should probably modify it too.
| | </noinclude> |
| | |
| v=spf1 +a +mx +ip4:<ip.mail> ?all* <tt><ip.mail></tt> - Is the IP of the mail server that is responsible for sending the mails, it is automatically filled in when you apply the zones
| |
| | |
| After you do this modification you should apply it
| |
| | |
| So now my configuration looks like this:
| |
| | |
| [[Image:Bild20.png|alt="SPF DNS Template"]]
| |
| | |
| Now let’s check with dig if the SPF is OK.
| |
| | |
| dig myserverplace.de TXT @ns1.myserverplace.de
| |
| | |
| You will see in the Answer section I have the following entry
| |
| | |
| myserverplace.de. 600 IN TXT "v=spf1 +a +mx +ip4:144.76.163.46 ?all"
| |
| | |
| So everything is ok, next onto DomainKeys
| |
| | |
| === DomainKeys ===
| |
| First let’s activate DomainKeys, take a look at the screenshot, and compare my options with yours.
| |
| | |
| [[Image:Bild21.png|alt="Plesk Panel DK Enabled"]]
| |
| | |
| Ok, now that this has been enabled, let’s go and enable for the domain in question, if it was already checked, uncheck it press OK, and then check it again and press OK, this is so it will regenerate the DomainKeys data in the DNS zone, as I’ve had some problems with the data not present in the DNS zone file
| |
| | |
| [[Image:Bild22.png|alt="Enable DK Domain"]]
| |
| | |
| OK, now let’s see if the correct data is there, usually it takes a long time for DNS to propagate between 24-48h, there is a simple way to test if the data is there, by querying the Nameserver that hosts your DNS zone, in my case I host my own Nameserver
| |
| | |
| dig _domainkey.myserverplace.de TXT @ns1.myserverplace.de
| |
| | |
| You will see in the Answer section I have the following entry
| |
| | |
| _domainkey.myserverplace.de. 600 IN TXT "o=-"
| |
| | |
| Now let’s see if the DomainKey is there too
| |
| | |
| dig default._domainkey.myserverplace.de TXT @ns1.myserverplace.de
| |
| | |
| In the Answer section you should see something like
| |
| | |
| default._domainkey.myserverplace.de. 600 IN TXT "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAruBNqdsSCKBLwMrFNNKH8z0e7zmlAic7iRoJsDDJK3IlnW8j6G/T6a93m+jqYc6R38MBAZbeSv2LQJ0SepJEsr4Iqk41WFXPBKnyXReO1RXPW5/YnRe6dpJMEqsmPpl2TjInY7ve/6VCiVDOHn9RRrdB+x7CGeK2crgqSZVlFwIDAQAB\;"
| |
| | |
| As you can see everything is in place now for DomainKeys to work, now let’s continue on to DKIM
| |
| | |
| === DKIM (DomainKeys Identified Mail) ===
| |
| As always lets update the system first
| |
| | |
| aptitude update
| |
| aptitude safe-upgrade
| |
| | |
| Now we need to install the DKIM filter, or as it’s called now [http://opendkim.org/ OpenDKIM], for full specification take a look at their site.
| |
| | |
| aptitude install opendkim opendkim-tools
| |
| | |
| Now we need to create the necessary folders so OpenDKIM can work proplery
| |
| | |
| mkdir -pv /etc/opendkim/keys
| |
| chown -Rv opendkim:opendkim /etc/opendkim
| |
| chmod go-rwx /etc/opendkim/*
| |
| | |
| This will create the directory where we will hold the keys for OpenDKIM, after this step let’s take a look at how the process will look like, so we can create a script to automate this.
| |
| | |
| mkdir -p /etc/opendkim/keys/myserverplace.de
| |
| cd /etc/opendkim/keys/myserverplace.de
| |
| opendkim-genkey -d myserverplace.de -s mail
| |
| chown -Rv opendkim:opendkim /etc/opendkim/keys/myserverplace.de
| |
| chmod -v u=rw,go-rwx *
| |
| | |
| This easily understandble, what happens here.
| |
| | |
| Now you have two files '''/etc/opendkim/keys/myserverplace.de'''
| |
| | |
| ls -lah /etc/opendkim/keys/myserverplace.de
| |
| total 16K
| |
| drwxr-xr-x 2 opendkim opendkim 4.0K Oct 9 18:43 .
| |
| drwxr-xr-x 5 opendkim opendkim 4.0K Oct 9 19:39 ..
| |
| -rw------- 1 opendkim opendkim 887 Oct 9 18:43 mail.private
| |
| -rw------- 1 opendkim opendkim 303 Oct 9 18:43 mail.txt* '''/etc/opendkim/keys/myserverplace.de/mail.private'''
| |
| | |
| contains the RSA PRIVATE KEY* '''/etc/opendkim/keys/myserverplace.de/mail.txt'''
| |
| | |
| Contains the record you need to add to your DNS zone
| |
| | |
| Next set is to setup the key tables, signing tables, and trusted hosts
| |
| | |
| First let’s prepare the files
| |
| | |
| touch /etc/opendkim/KeyTable
| |
| touch /etc/opendkim/SigningTable
| |
| touch /etc/opendkim/TrustedHosts* '''/etc/opendkim/TrustedHosts'''
| |
| | |
| needs to contain some data before we continue, so add the following information to this file, and adjust accordingly
| |
| | |
| 127.0.0.1
| |
| localhost
| |
| 144.76.163.46
| |
| 144.76.163.57
| |
| ns1.myserverplace.de
| |
| ns2.myserverplace.de
| |
| myserverplace.deSo let’s see what does what:* '''/etc/opendkim/KeyTable'''
| |
| | |
| KeyID Domain:Selector:PathToPrivateKey* '''/etc/opendkim/SigningTable'''
| |
| | |
| * The filter used is programmed to read the table by looking for matched domain
| |
| * '''/etc/opendkim/TrustedHosts'''
| |
| | |
| It will list the top trusted hosts as you desire
| |
| | |
| Those three files contain all the necessary information for the signing to work.
| |
| | |
| So in my case for my domain I do.
| |
| | |
| echo "myserverplace.de myserverplace.de:mail:/etc/opendkim/keys/myserverplace.de/mail.private" >> /etc/opendkim/KeyTable
| |
| echo "*@myserverplace.de myserverplace.de" >> /etc/opendkim/SigningTable
| |
| echo "myserverplace.de" >> /etc/opendkim/TrustedHosts
| |
| echo "mail.myserverplace.de" >> /etc/opendkim/TrustedHosts
| |
| | |
| So let’s put all this together in a script so we don’t have to do it all the time
| |
| | |
| #!/bin/bash
| |
| # /opt/generatedkim.sh
| |
| die () {
| |
| echo >&2 "$@"
| |
| exit 1
| |
| }
| |
| | |
| [ "$#" -eq 1 ] || die "1 argument required, $# provided, domain required, ex: ./script example.com"
| |
| | |
| cwd=`pwd`
| |
| opendkim="/etc/opendkim"
| |
| location="$opendkim/keys/$1"
| |
| [ -d "$location" ] && die "There is already a directory in the folder, delete the folder if you want to create a new one"
| |
| | |
| mkdir -p "$location"
| |
| cd "$location"
| |
| opendkim-genkey -d $1 -s mail
| |
| chown opendkim:opendkim *
| |
| chown opendkim:opendkim "$location"
| |
| chmod u=rw,go-rwx *
| |
| echo "$1 $1:mail:$location/mail.private" >> "$opendkim/KeyTable"
| |
| echo "*@$1 $1" >> "$opendkim/SigningTable"
| |
| echo "$1" >> "$opendkim/TrustedHosts"
| |
| echo "mail.$1" >> "$opendkim/TrustedHosts"
| |
| echo
| |
| echo "Put this in the DNS ZONE for domain: $1"
| |
| echo
| |
| cat "$location/mail.txt"
| |
| echo
| |
| cd "$cwd"
| |
| | |
| So if we run the script, we should get output like this, and this is the data we need to put in the DNS zone.
| |
| | |
| /opt/generatedkim.sh test.de
| |
| | |
| Put this in the DNS ZONE for domain: test.de
| |
| | |
| mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPzE0GmvFwAQsgcFzopy4zMNWUbL6JM5XIyjBy3bUnANI5axeb/Lw/GBjUoSFLEiO80Tt8m3A5YrBKcodRQQURYiW6/YtElhLupHyfcxQhfNLU4z9JUOJKPjcpMZCj0Xv873QgVOl+7U605JdBHSPOx4ybBZwDq68cw9YFYRPmEwIDAQAB" ; ----- DKIM key mail for test.de
| |
| | |
| Unfortunatly I don’t have time to create a script to do this automatically, you can always insert a record in MySQL database so it’s in the ZONE and you can regenerate the DNS Zone from the command line, and I won’t be having a lot of domains, so I can add this entry manually to a domain I want DKIM enabled
| |
| | |
| Let’s open the domain and go to DNS Settings, and you can click ** ''Add Resource'' **
| |
| | |
| You popuplate the following data in the inputboxes* Record type
| |
| | |
| TXT* Domain name
| |
| | |
| mail._domainkey* TXT Record
| |
| | |
| In the text record you copy a part of the contents from the file '''/etc/opendkim/keys/myserverplace.de/mail.txt''', it data should start from '''v=DKIM1; k=rsa;''' to the end, without the quotes as you can see it’s in quotes.
| |
| | |
| In the example above for domain test.de you add only the following contents in the input box
| |
| | |
| v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPzE0GmvFwAQsgcFzopy4zMNWUbL6JM5XIyjBy3bUnANI5axeb/Lw/GBjUoSFLEiO80Tt8m3A5YrBKcodRQQURYiW6/YtElhLupHyfcxQhfNLU4z9JUOJKPjcpMZCj0Xv873QgVOl+7U605JdBHSPOx4ybBZwDq68cw9YFYRPmEwIDAQAB
| |
| | |
| [[Image:Bild23.png|alt="DKIM Add DNS Zone"]]
| |
| | |
| Well that’s it for this, now let’s check with dig if the record is there
| |
| | |
| dig mail._domainkey.myserverplace.de TXT @ns1.myserverplace.de
| |
| | |
| You will see in the Answer section I have the following entry
| |
| | |
| mail._domainkey.myserverplace.de. 600 IN TXT "v=DKIM1\; k=rsa\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMziMcgPTWK0kSUKxrgHHzEiWxNkZ2/M0Ugyr/8H9WtoCsJUM+Bc1C9VwqJ6yjTidecDrX7aL0lFZ9Mylku/wtSiPw6KLxMg2LG2vrMzlPTB2lmJNmg/EOu3KPC8BtAuOhXfwVH/ttQbzdKJKWqiCJn7jhF5oqEKnOCORxOQXKIwIDAQAB"
| |
| | |
| Well everything is setup up at least from the DNS side, now we need to configure Postfix to use this data and sign the emails.
| |
| | |
| You can also use the following URLs to check the validity of your key* [http://www.protodave.com/tools/dkim-key-checker dkim-key-checker]
| |
| * [http://dkimcore.org/tools/ DKIM Core Tool]
| |
| | |
| In the selector fields try with both '''mail''', and '''default''', you shold be getting valid results
| |
| | |
| === OpenDKIM ===
| |
| We need to edit the configuration file to configure DKIM, open '''/etc/opendkim.conf''' with your favorite editor and add the following lines to the end of the file
| |
| | |
| # Enable Logging
| |
| Syslog yes
| |
| SyslogSuccess yes
| |
| LogWhy yes
| |
| | |
| # User mask
| |
| UMask 002
| |
| | |
| # Always oversign From (sign using actual From and a null From to prevent malicious signatures header fields (From and/or others) between the signer and the verifier)
| |
| OversignHeaders From
| |
| | |
| # Our KeyTable and SigningTable
| |
| KeyTable refile:/etc/opendkim/KeyTable
| |
| SigningTable refile:/etc/opendkim/SigningTable
| |
| | |
| # Trusted Hosts
| |
| ExternalIgnoreList /etc/opendkim/TrustedHosts
| |
| InternalHosts /etc/opendkim/TrustedHosts
| |
| | |
| # Hashing Algorithm
| |
| SignatureAlgorithm rsa-sha256
| |
| | |
| # Auto restart when the failure occurs. CAUTION: This may cause a tight fork loops
| |
| AutoRestart Yes
| |
| | |
| # Set the user and group to opendkim user
| |
| UserID opendkim:opendkim
| |
| | |
| # Specify the working socket
| |
| Socket inet:8891@localhost
| |
| | |
| That’s it for OpenDKIM, now we should restart the service
| |
| | |
| service opendkim restart
| |
| | |
| === Postfix ===
| |
| Now let’s see what we need to do to configure Postfix to use OpenDKIM.
| |
| | |
| Execute the following command to see the milters configured
| |
| | |
| cat /etc/postfix/main.cf | grep "milters"
| |
| smtpd_milters = , inet:127.0.0.1:12768
| |
| non_smtpd_milters = , inet:127.0.0.1:12768
| |
| | |
| You can see that we have additional milters we need to put, this one is from the process '''psa-pc-remote''', and it’s part of Plesk
| |
| | |
| Open '''/etc/postfix/main.cf''' with your favorite editor, and add the following to the end of the file
| |
| | |
| # OpenDKIM
| |
| milter_default_action = accept
| |
| milter_protocol = 6
| |
| smtpd_milters = , inet:127.0.0.1:8891, inet:127.0.0.1:12768
| |
| non_smtpd_milters = $smtpd_milters
| |
| | |
| As you can see we added the OpenDKIM milter too, and '''milter_protocol''' is set to '''6''', this is important, if it’s not set to '''6''', the '''psa-pc-remote''' process will segfault like so,
| |
| | |
| psa-pc-remote[18523]: segfault at 0 ip 00007fa5be18c034 sp 00007fa5bccffd30 error 4 in libc-2.13.so[7fa5be123000+180000]
| |
| | |
| And your messages won’t be signed with '''DomainKey''', only with '''DKIM'''
| |
| | |
| service postfix restart
| |
| | |
| === Testing ===
| |
| There is an easy way to test if everything is correct, create an email account if you haven’t already and send a test mail to the following recepients, and the results are cut down because the text is too big* check-auth@verifier.port25.com
| |
| | |
| ==========================================================
| |
| Summary of Results
| |
| ==========================================================
| |
| SPF check: pass
| |
| DomainKeys check: pass
| |
| DKIM check: pass
| |
| Sender-ID check: pass
| |
| SpamAssassin check: ham* AAAA3QcKCQwA@appmaildev.com
| |
| | |
| ============================================================
| |
| SPF result: Pass
| |
| ============================================================
| |
| Domain: myserverplace.de
| |
| IP: 144.76.163.46
| |
| | |
| SPF Record: myserverplace.de
| |
| IN TXT = "v=spf1 +a +mx 144.76.163.46 ?all"
| |
| | |
| ============================================================
| |
| DomainKey result: pass
| |
| ============================================================
| |
| Signed by: admin@myserverplace.de
| |
| | |
| PublicKey: default._domainkey.myserverplace.de
| |
| IN TXT = "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAruBNqdsSCKBLwMrFNNKH8z0e7zmlAic7iRoJsDDJK3IlnW8j6G/T6a93m+jqYc6R38MBAZbeSv2LQJ0SepJEsr4Iqk41WFXPBKnyXReO1RXPW5/YnRe6dpJMEqsmPpl2TjInY7ve/6VCiVDOHn9RRrdB+x7CGeK2crgqSZVlFwIDAQAB;"
| |
| | |
| ============================================================
| |
| DKIM result: pass
| |
| ============================================================
| |
| Signed by: admin@myserverplace.de
| |
| Expected Body Hash: frcCV1k9oG9oKj3dpUqdJg1PxRT2RSN/XKdLCPjaYaY=
| |
| PublicKey: mail._domainkey.myserverplace.de
| |
| IN TXT = "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMziMcgPTWK0kSUKxrgHHzEiWxNkZ2/M0Ugyr/8H9WtoCsJUM+Bc1C9VwqJ6yjTidecDrX7aL0lFZ9Mylku/wtSiPw6KLxMg2LG2vrMzlPTB2lmJNmg/EOu3KPC8BtAuOhXfwVH/ttQbzdKJKWqiCJn7jhF5oqEKnOCORxOQXKIwIDAQAB;"
| |
| | |
| === Logs ===
| |
| You can check the following locations to see if there are errors* /var/log/mail.err
| |
| * /var/log/mail.warn
| |
| * /var/log/mail.info
| |
| * /var/log/syslog
| |
| | |
| === Note ===
| |
| Make sure you enable testing mode for DKIM if you plan to test, you can also cut down the EXPIRY time so the results propagate faster, so to enable testing mode set the key <tt>'''_domainkey'''</tt> to <tt>'''t=y; o=-'''</tt>
| |
| | |
| === References ===
| |
| [http://kb.parallels.com/en/5801 How to define what MTA is used in Parallels Plesk Panel and how to switch from Qmail to Postfix and back?]
| |
| | |
| == Mailserver Administration ==
| |
| === [https://matoski.com/article/spf-dk-dkim-plesk-debian/ Setting up SPF + DK + DKIM ] ===
| |
| '''Postfix in Plesk 11.5 on Debian Wheezy'''
| |
| | |
| [https://matoski.com/tags/debian debian] [https://matoski.com/tags/wheezy wheezy] [https://matoski.com/tags/postfix postfix] [https://matoski.com/tags/installation installation] [https://matoski.com/tags/configuration configuration] [https://matoski.com/tags/plesk plesk] [https://matoski.com/tags/dk dk] [https://matoski.com/tags/domainkeys DomainKeys] [https://matoski.com/tags/dkim dkim] [https://matoski.com/tags/domainkeys-identified-mail DomainKeys Identified Mail]
| |
| | |
| Shows up a detailed process on how to set up SPF + DK + DKIM with Postfix in Plesk 11.5 on Debian Wheezy, step by step, and how to test to make sure everything is working correctly
| |
| | |
| I leased a dedicated server from [http://hetzner.de/ Hetzner], and I got the Plesk option, for administration, so I don’t have to bother with administration, but turns out I’m not so lucky, I’ve ran into a lot of issues with using Plesk, so I had to do my own fixes.
| |
| | |
| So let’s take a look at how we can integrate SPF + DK + DKIM with Postfix in Plesk 11.5 on Debian Wheezy.
| |
| | |
| First things, first, if you are using QMail switch to Postfix, to install Postfix you can either use the GUI, or you can do it from a console.
| |
| | |
| Here is how to do it from the console.
| |
| | |
| /usr/local/psa/admin/sbin/autoinstaller --select-release-current --install-component postfix
| |
| | |
| ==== SPF ====
| |
| Let’s open the DNS Template, you will see there that, there is an entry for SPF
| |
| | |
| v=spf1 +a +mx -all
| |
| | |
| This means the SPF is enabled on our domain.
| |
| | |
| Let’s modify it a little bit to be better, if you are gonna host multiple domains from your server, then you should probably modify it too.
| |
| | |
| v=spf1 +a +mx +ip4:<ip.mail> ?all* <tt><ip.mail></tt> - Is the IP of the mail server that is responsible for sending the mails, it is automatically filled in when you apply the zones
| |
| | |
| [[Image:Bild9.png|right|top|alt="SPF DNS Template"]]After you do this modification you should apply it
| |
| | |
| So now my configuration looks like this:
| |
| | |
| Now let’s check with dig if the SPF is OK.
| |
| | |
| dig myserverplace.de TXT @ns1.myserverplace.de
| |
| | |
| You will see in the Answer section I have the following entry
| |
| | |
| myserverplace.de. 600 IN TXT "v=spf1 +a +mx +ip4:144.76.163.46 ?all"
| |
| | |
| So everything is ok.
| |
| | |
| ==== DomainKeys ====
| |
| [[Image:Bild10.png|right|top|alt="Plesk Panel DK Enabled"]]First let’s activate DomainKeys, take a look at the screenshot, and compare my options with yours.
| |
| | |
| Ok, now that this has been enabled, let’s go and enable for the domain in question, if it was already checked, uncheck it press OK, and then check it again and press OK, this is so it will regenerate the DomainKeys data in the DNS zone, as I’ve had some problems with the data not present in the DNS zone file
| |
| | |
| [[Image:Bild1.png|alt="Enable DK Domain"]]
| |
| | |
| OK, now let’s see if the correct data is there, usually it takes a long time for DNS to propagate between 24-48h, there is a simple way to test if the data is there, by querying the Nameserver that hosts your DNS zone, in my case I host my own Nameserver
| |
| | |
| dig _domainkey.myserverplace.de TXT @ns1.myserverplace.de
| |
| | |
| You will see in the Answer section I have the following entry
| |
| | |
| _domainkey.myserverplace.de. 600 IN TXT "o=-"
| |
| | |
| Now let’s see if the DomainKey is there too
| |
| | |
| dig default._domainkey.myserverplace.de TXT @ns1.myserverplace.de
| |
| | |
| In the Answer section you should see something like
| |
| | |
| default._domainkey.myserverplace.de. 600 IN TXT "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAruBNqdsSCKBLwMrFNNKH8z0e7zmlAic7iRoJsDDJK3IlnW8j6G/T6a93m+jqYc6R38MBAZbeSv2LQJ0SepJEsr4Iqk41WFXPBKnyXReO1RXPW5/YnRe6dpJMEqsmPpl2TjInY7ve/6VCiVDOHn9RRrdB+x7CGeK2crgqSZVlFwIDAQAB\;"
| |
| | |
| As you can see everything is in place now for DomainKeys to work, now let’s continue on to DKIM
| |
| | |
| ==== DKIM (DomainKeys Identified Mail) ====
| |
| As always lets update the system first
| |
| | |
| aptitude update
| |
| aptitude safe-upgrade
| |
| | |
| Now we need to install the DKIM filter, or as it’s called now [http://opendkim.org/ OpenDKIM], for full specification take a look at their site.
| |
| | |
| aptitude install opendkim opendkim-tools
| |
| | |
| Now we need to create the necessary folders so OpenDKIM can work proplery
| |
| | |
| mkdir -pv /etc/opendkim/keys
| |
| chown -Rv opendkim:opendkim /etc/opendkim
| |
| chmod go-rwx /etc/opendkim/*
| |
| | |
| This will create the directory where we will hold the keys for OpenDKIM, after this step let’s take a look at how the process will look like, so we can create a script to automate this.
| |
| | |
| mkdir -p /etc/opendkim/keys/myserverplace.de
| |
| cd /etc/opendkim/keys/myserverplace.de
| |
| opendkim-genkey -d myserverplace.de -s mail
| |
| chown -Rv opendkim:opendkim /etc/opendkim/keys/myserverplace.de
| |
| chmod -v u=rw,go-rwx *
| |
| | |
| This easily understandble, what happens here.
| |
| | |
| Now you have two files '''/etc/opendkim/keys/myserverplace.de'''
| |
| | |
| ls -lah /etc/opendkim/keys/myserverplace.de
| |
| total 16K
| |
| drwxr-xr-x 2 opendkim opendkim 4.0K Oct 9 18:43 .
| |
| drwxr-xr-x 5 opendkim opendkim 4.0K Oct 9 19:39 ..
| |
| -rw------- 1 opendkim opendkim 887 Oct 9 18:43 mail.private
| |
| -rw------- 1 opendkim opendkim 303 Oct 9 18:43 mail.txt* '''/etc/opendkim/keys/myserverplace.de/mail.private'''
| |
| | |
| contains the RSA PRIVATE KEY* '''/etc/opendkim/keys/myserverplace.de/mail.txt'''
| |
| | |
| Contains the record you need to add to your DNS zone
| |
| | |
| Next set is to setup the key tables, signing tables, and trusted hosts
| |
| | |
| First let’s prepare the files
| |
| | |
| touch /etc/opendkim/KeyTable
| |
| touch /etc/opendkim/SigningTable
| |
| touch /etc/opendkim/TrustedHosts* '''/etc/opendkim/TrustedHosts'''
| |
| | |
| needs to contain some data before we continue, so add the following information to this file, and adjust accordingly
| |
| | |
| 127.0.0.1
| |
| localhost
| |
| 144.76.163.46
| |
| 144.76.163.57
| |
| ns1.myserverplace.de
| |
| ns2.myserverplace.de
| |
| myserverplace.deSo let’s see what does what:* '''/etc/opendkim/KeyTable'''
| |
| | |
| KeyID Domain:Selector:PathToPrivateKey* '''/etc/opendkim/SigningTable'''
| |
| | |
| The filter used is programmed to read the table by looking for matched domain* '''/etc/opendkim/TrustedHosts'''
| |
| | |
| It will list the top trusted hosts as you desire
| |
| | |
| Those three files contain all the necessary information for the signing to work.
| |
| | |
| So in my case for my domain I do.
| |
| | |
| echo "myserverplace.de myserverplace.de:mail:/etc/opendkim/keys/myserverplace.de/mail.private" >> /etc/opendkim/KeyTable
| |
| echo "*@myserverplace.de myserverplace.de" >> /etc/opendkim/SigningTable
| |
| echo "myserverplace.de" >> /etc/opendkim/TrustedHosts
| |
| echo "mail.myserverplace.de" >> /etc/opendkim/TrustedHosts
| |
| | |
| So let’s put all this together in a script so we don’t have to do it all the time
| |
| | |
| #!/bin/bash
| |
| # /opt/generatedkim.sh
| |
| die () {
| |
| echo >&2 "$@"
| |
| exit 1
| |
| }
| |
| | |
| [ "$#" -eq 1 ] || die "1 argument required, $# provided, domain required, ex: ./script example.com"
| |
| | |
| cwd=`pwd`
| |
| opendkim="/etc/opendkim"
| |
| location="$opendkim/keys/$1"
| |
| [ -d "$location" ] && die "There is already a directory in the folder, delete the folder if you want to create a new one"
| |
| | |
| mkdir -p "$location"
| |
| cd "$location"
| |
| opendkim-genkey -d $1 -s mail
| |
| chown opendkim:opendkim *
| |
| chown opendkim:opendkim "$location"
| |
| chmod u=rw,go-rwx *
| |
| echo "$1 $1:mail:$location/mail.private" >> "$opendkim/KeyTable"
| |
| echo "*@$1 $1" >> "$opendkim/SigningTable"
| |
| echo "$1" >> "$opendkim/TrustedHosts"
| |
| echo "mail.$1" >> "$opendkim/TrustedHosts"
| |
| echo
| |
| echo "Put this in the DNS ZONE for domain: $1"
| |
| echo
| |
| cat "$location/mail.txt"
| |
| echo
| |
| cd "$cwd"
| |
| | |
| So if we run the script, we should get output like this, and this is the data we need to put in the DNS zone.
| |
| | |
| /opt/generatedkim.sh test.de
| |
| | |
| Put this in the DNS ZONE for domain: test.de
| |
| | |
| mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPzE0GmvFwAQsgcFzopy4zMNWUbL6JM5XIyjBy3bUnANI5axeb/Lw/GBjUoSFLEiO80Tt8m3A5YrBKcodRQQURYiW6/YtElhLupHyfcxQhfNLU4z9JUOJKPjcpMZCj0Xv873QgVOl+7U605JdBHSPOx4ybBZwDq68cw9YFYRPmEwIDAQAB" ; ----- DKIM key mail for test.de
| |
| | |
| Unfortunatly I don’t have time to create a script to do this automatically, you can always insert a record in MySQL database so it’s in the ZONE and you can regenerate the DNS Zone from the command line, and I won’t be having a lot of domains, so I can add this entry manually to a domain I want DKIM enabled
| |
| | |
| Let’s open the domain and go to DNS Settings, and you can click ** ''Add Resource'' **
| |
| | |
| You popuplate the following data in the inputboxes* Record type
| |
| | |
| TXT* Domain name
| |
| | |
| mail._domainkey* TXT Record
| |
| | |
| [[Image:Bild12.png|right|top|alt="DKIM Add DNS Zone"]]In the text record you copy a part of the contents from the file '''/etc/opendkim/keys/myserverplace.de/mail.txt''', it data should start from '''v=DKIM1; k=rsa;''' to the end, without the quotes as you can see it’s in quotes.
| |
| | |
| In the example above for domain test.de you add only the following contents in the input box
| |
| | |
| v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPzE0GmvFwAQsgcFzopy4zMNWUbL6JM5XIyjBy3bUnANI5axeb/Lw/GBjUoSFLEiO80Tt8m3A5YrBKcodRQQURYiW6/YtElhLupHyfcxQhfNLU4z9JUOJKPjcpMZCj0Xv873QgVOl+7U605JdBHSPOx4ybBZwDq68cw9YFYRPmEwIDAQAB
| |
| | |
| Well that’s it for this, now let’s check with dig if the record is there
| |
| | |
| dig mail._domainkey.myserverplace.de TXT @ns1.myserverplace.de
| |
| | |
| You will see in the Answer section I have the following entry
| |
| | |
| mail._domainkey.myserverplace.de. 600 IN TXT "v=DKIM1\; k=rsa\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMziMcgPTWK0kSUKxrgHHzEiWxNkZ2/M0Ugyr/8H9WtoCsJUM+Bc1C9VwqJ6yjTidecDrX7aL0lFZ9Mylku/wtSiPw6KLxMg2LG2vrMzlPTB2lmJNmg/EOu3KPC8BtAuOhXfwVH/ttQbzdKJKWqiCJn7jhF5oqEKnOCORxOQXKIwIDAQAB"
| |
| | |
| Well everything is setup up at least from the DNS side, now we need to configure Postfix to use this data and sign the emails.
| |
| | |
| You can also use the following URLs to check the validity of your key* [http://www.protodave.com/tools/dkim-key-checker dkim-key-checker]
| |
| * [http://dkimcore.org/tools/ DKIM Core Tool]
| |
| | |
| In the selector fields try with both '''mail''', and '''default''', you shold be getting valid results
| |
| | |
| ==== OpenDKIM ====
| |
| We need to edit the configuration file to configure DKIM, open '''/etc/opendkim.conf''' with your favorite editor and add the following lines to the end of the file
| |
| | |
| # Enable Logging
| |
| Syslog yes
| |
| SyslogSuccess yes
| |
| LogWhy yes
| |
| | |
| # User mask
| |
| UMask 002
| |
| | |
| # Always oversign From (sign using actual From and a null From to prevent malicious signatures header fields (From and/or others) between the signer and the verifier)
| |
| OversignHeaders From
| |
| | |
| # Our KeyTable and SigningTable
| |
| KeyTable refile:/etc/opendkim/KeyTable
| |
| SigningTable refile:/etc/opendkim/SigningTable
| |
| | |
| # Trusted Hosts
| |
| ExternalIgnoreList /etc/opendkim/TrustedHosts
| |
| InternalHosts /etc/opendkim/TrustedHosts
| |
| | |
| # Hashing Algorithm
| |
| SignatureAlgorithm rsa-sha256
| |
| | |
| # Auto restart when the failure occurs. CAUTION: This may cause a tight fork loops
| |
| AutoRestart Yes
| |
| | |
| # Set the user and group to opendkim user
| |
| UserID opendkim:opendkim
| |
| | |
| # Specify the working socket
| |
| Socket inet:8891@localhost
| |
| | |
| That’s it for OpenDKIM, now we should restart the service
| |
| | |
| service opendkim restart
| |
| | |
| ==== Postfix ====
| |
| Now let’s see what we need to do to configure Postfix to use OpenDKIM.
| |
| | |
| Execute the following command to see the milters configured
| |
| | |
| cat /etc/postfix/main.cf | grep "milters"
| |
| smtpd_milters = , inet:127.0.0.1:12768
| |
| non_smtpd_milters = , inet:127.0.0.1:12768
| |
| | |
| You can see that we have additional milters we need to put, this one is from the process '''psa-pc-remote''', and it’s part of Plesk
| |
| | |
| Open '''/etc/postfix/main.cf''' with your favorite editor, and add the following to the end of the file
| |
| | |
| # OpenDKIM
| |
| milter_default_action = accept
| |
| milter_protocol = 6
| |
| smtpd_milters = , inet:127.0.0.1:8891, inet:127.0.0.1:12768
| |
| non_smtpd_milters = $smtpd_milters
| |
| | |
| As you can see we added the OpenDKIM milter too, and '''milter_protocol''' is set to '''6''', this is important, if it’s not set to '''6''', the '''psa-pc-remote''' process will segfault like so,
| |
| | |
| psa-pc-remote[18523]: segfault at 0 ip 00007fa5be18c034 sp 00007fa5bccffd30 error 4 in libc-2.13.so[7fa5be123000+180000]
| |
| | |
| And your messages won’t be signed with '''DomainKey''', only with '''DKIM'''
| |
| | |
| service postfix restart
| |
| | |
| ==== Testing ====
| |
| There is an easy way to test if everything is correct, create an email account if you haven’t already and send a test mail to the following recepients, and the results are cut down because the text is too big* check-auth@verifier.port25.com
| |
| | |
| ==========================================================
| |
| Summary of Results
| |
| ==========================================================
| |
| SPF check: pass
| |
| DomainKeys check: pass
| |
| DKIM check: pass
| |
| Sender-ID check: pass
| |
| SpamAssassin check: ham* AAAA3QcKCQwA@appmaildev.com
| |
| | |
| ============================================================
| |
| SPF result: Pass
| |
| ============================================================
| |
| Domain: myserverplace.de
| |
| IP: 144.76.163.46
| |
| | |
| SPF Record: myserverplace.de
| |
| IN TXT = "v=spf1 +a +mx 144.76.163.46 ?all"
| |
| | |
| ============================================================
| |
| DomainKey result: pass
| |
| ============================================================
| |
| Signed by: admin@myserverplace.de
| |
| | |
| PublicKey: default._domainkey.myserverplace.de
| |
| IN TXT = "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAruBNqdsSCKBLwMrFNNKH8z0e7zmlAic7iRoJsDDJK3IlnW8j6G/T6a93m+jqYc6R38MBAZbeSv2LQJ0SepJEsr4Iqk41WFXPBKnyXReO1RXPW5/YnRe6dpJMEqsmPpl2TjInY7ve/6VCiVDOHn9RRrdB+x7CGeK2crgqSZVlFwIDAQAB;"
| |
| | |
| ============================================================
| |
| DKIM result: pass
| |
| ============================================================
| |
| Signed by: admin@myserverplace.de
| |
| Expected Body Hash: frcCV1k9oG9oKj3dpUqdJg1PxRT2RSN/XKdLCPjaYaY=
| |
| PublicKey: mail._domainkey.myserverplace.de
| |
| IN TXT = "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMziMcgPTWK0kSUKxrgHHzEiWxNkZ2/M0Ugyr/8H9WtoCsJUM+Bc1C9VwqJ6yjTidecDrX7aL0lFZ9Mylku/wtSiPw6KLxMg2LG2vrMzlPTB2lmJNmg/EOu3KPC8BtAuOhXfwVH/ttQbzdKJKWqiCJn7jhF5oqEKnOCORxOQXKIwIDAQAB;"
| |
| | |
| ==== Logs ====
| |
| You can check the following locations to see if there are errors* /var/log/mail.err
| |
| * /var/log/mail.warn
| |
| * /var/log/mail.info
| |
| * /var/log/syslog
| |
| | |
| ==== Note ====
| |
| Make sure you enable testing mode for DKIM if you plan to test, you can also cut down the EXPIRY time so the results propagate faster, so to enable testing mode set the key <tt>_domainkey</tt> to <tt>t=y; o=-</tt>
| |
| | |
| ==== References ====
| |
| * How to define what MTA is used in Parallels Plesk Panel and how to switch from Qmail to Postfix and back?http://kb.parallels.com/en/5801
| |
| | |
| === Email Bounces / Address requirements ===
| |
| We require that users provide a valid and properly configured email address for the purposes of being able to contact the user in case of problems and other details surrounding their account.
| |
| | |
| We thus expect users to provide an email account that they actually read on a regular basis.
| |
| | |
| A personal/non-role account is prefered.
| |
| | |
| SixXS does not send any email newsletters, hence there is no need to setup a specific account for this.
| |
| | |
| The current policy is codified and the validity of an e-mail address is determined as follows: # <div >It is syntactically correct (ie, it has one <tt>@</tt>) </div>
| |
| # <div >If it is in a domain whitelist, it is accepted </div>
| |
| # <div >If it is in a domain blacklist, it is rejected </div>
| |
| # <div >The local name (part in front of the <tt>@</tt>) is less than 64 characters </div>
| |
| # <div >The local part is not a role account¹ </div>
| |
| # <div >The domain name (part after the <tt>@</tt>) is less than 255 characters </div>
| |
| # <div >The local name and domain name is valid (ie does not have two consecutive dots), do not have non ISO characters, and are quoted properly </div>
| |
| # <div >The domain is configured properly (see below) </div>
| |
| | |
| For the domain, the NS and MX records are looked up and resolved to their A and AAAA records so that we have a list of addresses. The MX records are then checked in the white- and blacklist again (such that we can accept e-mail domains hosted on well-known clusters. For each of the A (IPv4) addresses, we check a number of policy DNSBLs (such as <tt>zen.spamhaus.org</tt>, <tt>dul.dnsbl.sorbs.net</tt>, and <tt>dialups.mail-abuse.org</tt>) with the intent to find home-setups, which we do not accept.
| |
| | |
| Note:In a study performed by SixXS on 32019 e-mail addresses, we found that 11.2% of all addresses (3608) bounced at least once. Of the valid addresses, 9.49% bounced. Of the addresses that our new policy considers invalid, 16.6% bounced. We understand that our policy comes across as harsh, but we assert that it makes a difference to be strict.
| |
| | |
| [[Image:Bild14.png|top|alt="Information"]]In general: use your ISP's mail address, or a hosted solution, but don't run a mailserver at home - you may be listed in DNSBLs!
| |
| | |
| ===== Bouncing Email =====
| |
| We expect that email accounts are reachable. If you are not reachable by email we cannot contact you regarding (mal)function of your tunnel. When we receive a bounce on an email address the account will automatically and directly be set into the disabled state. Connectivity provided to a disabled account will therefor be disabled.
| |
| | |
| If your e-mail address bounced, and you would like to have your connectivity back, [https://www.sixxs.net/faq/account/?faq=updating update your handle] with a valid email address in the appropriate registry and notify SixXS of the change, we can then reinstate your account.
| |
| | |
| Messages from your mailhost notifying us that the message we send could not be delivered (for example, greylisting longer than 5hrs) and other automatic replies are also treated as bounces and thus will automatically disable your account.
| |
| | |
| ===== Common Email Configuration/Setup Mistakes =====
| |
| [http://www.ietf.org/rfc/rfc1912.txt RFC1912 - Common DNS Operational and Configuration Errors] lists a number of common problems, for instance MX DNS records pointing to CNAMEs². Domains that are misconfigured are not accepted.
| |
| | |
| Make sure that the domain of your email address is RFC compliant and has at least 2 distinctly separate working MX servers or a proven cluster solution. If your DNS contains only one MX record and it has a cluster behind it, direct signups will not be able to detect that, thus contact SixXS in that case. Mail servers on dynamically-assigned IP addresses and/or DSL/cable links are not accepted as they have proven not to be stable enough.
| |
| | |
| Check your domain using for example using [http://www.zonecheck.fr/ ZoneCheck], [http://dnscheck.iis.se// IIS.SE DNS Check] if it looks okay. If you have weird DNS records or had problems in your DNS setup, note well these could get cached in which case you won't be reachable either.
| |
| | |
| ===== SPF, DKIM, DMARC and forwarding email =====
| |
| SixXS uses [http://www.openspf.org/ SPF], [http://www.dkim.org/ DKIM] and [http://dmarc.org/ DMARC] in strict modes. Thus be very mindful when forwarding email as it can cause email to bounce because the address you are forwarding from is not in our SPF records. Also make sure to not break DKIM signed headers.
| |
| | |
| Forwarding email breaks SPF verification unless you are able to control the receiving end to ignore SPF checks for forwarded messages.
| |
| | |
| ===== White- and Blacklists =====
| |
| In an attempt to be transparent on the e-mail verification system, here's the currently configured regular expressions for domains and MX hosts from which we automatically reject any e-mail address:
| |
| | |
| Blacklist
| |
| | |
| @users\.(sf|sourceforge)\.net$
| |
| @(sf|sourceforge)\.net$
| |
| @rediffmail\.com$
| |
| (@|\.)moerstaal\.nl$
| |
| (@|\.)mail386\.com$
| |
| (@|\.)(mailhop\.org|(mydyndns|dyndns)\.(com|org))$
| |
| (@|\.)homeip\.net$
| |
| (@|\.)afraid\.org$
| |
| (@|\.)no-ip\.(com|org)$
| |
| (@|\.)wdyn\.de$
| |
| (@|\.)ath\.cx$
| |
| (@|\.)eu\.org$
| |
| (@|\.)hushmail.com$
| |
| (@|\.)mailinator\.com$
| |
| (@|\.)spamgourmet\.com$
| |
| (@|\.)163\.com$
| |
| (@|\.)trash-mail\.com$
| |
| (@|\.)zoneedit\.com$
| |
| (@|\.)xname\.org$
| |
| (@|\.)42\.pl$
| |
| (@|\.)riseup\.net$
| |
| (@|\.)(gmx|web|yandex|rambler|alice|mail|qq|126|o2|)\.[^\.]+$
| |
| (@|\.)(protonmail|tuta|tutanota)\.[^\.]+$
| |
| (@|\.)(hotmail|live|msn|aol)\.[^\.]+$
| |
| (@|\.)(yahoo)\.[^\.]+$
| |
| | |
| As we do not want to encourage the usage of any provider we do not publish the whitelist. Of course, the white and blacklists are not final, if we notice that a domain is unacceptable even though it passes the above tests we may still consider rejecting the address.
| |
| | |
| If you have a properly set up ISP account, or another email account like one from work we prefer that you provide and use that. Setting up throwaway accounts will be noticed and such accounts will be rejected or disabled. To note, we specifically reject mailinator kind of accounts as these accounts are definitely not intended for proper email communication.
| |
| | |
| If you would like to file a petition to be added (or removed) from our white or blacklist, please [https://www.sixxs.net/contact/ contact SixXS] and provide proper argumentation.
| |
| | |
| ¹ = A role account is an account that is not associated with a particular person, but with an office, position, or task. Those doing the task use the account only to do the task. They have other accounts for other work.
| |
| | |
| ² = Using a CNAME in your domain breaks your email because [http://www.sendmail.org/ sendmail] (and possibly other SMTP software) will rewrite the domain portion of the destination email address to that of the label in the CNAME. See also [http://cr.yp.to/im/cname.html CNAME records in mail] by D. J. Bernstein. Note that having a CNAME for example.tld is of course impossible unless you get the tld to have the same record. Having an MX point to a CNAME record causes additional DNS lookups, which might cross a threshold, and thus cause your mail to be dropped. Additionally "Mail loops back to me" errors might be caused by this. Also see [http://www.ietf.org/rfc/rfc1034.txt RFC1034 - DOMAIN NAMES - CONCEPTS AND FACILITIES] for more details. In short: Don't use CNAMEs in relation to SMTP.
| |
