|
|
| (41 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) |
| Zeile 1: |
Zeile 1: |
| '''DNS/SPF''' - SPF + DK + DKIM with Postfix | | <noinclude> |
| | <!-- |
| | ---- |
| | {{Navigation|<zurück>|<nachste>}} |
| | {{Navigation|BSI/200-3|BSI/200-3/Einleitung/Beispiele}} |
| | ---- |
| | --> |
| | '''{{BASEPAGENAME}}''' - SPF, DK und DKIM mit Postfix |
| | </noinclude> |
|
| |
|
| === Beschreibung === | | == Beschreibung == |
| Shows up a detailed process on how to set up SPF + DK + DKIM with Postfix in Plesk 11.5 on Debian Wheezy, step by step, and how to test to make sure everything is working correctly
| | <ul class="list-group"> |
| | <li class="list-group-item">[[Postfix/Installation|Postfix]]</li> |
| | <li class="list-group-item list-group-item-primary">[[Sender Policy Framework]]</li> |
| | <li class="list-group-item list-group-item-secondary">[[DomainKeys]]</li> |
| | <li class="list-group-item list-group-item-success">[[DKIM]]</li> |
| | <li class="list-group-item list-group-item-danger">[[DNS/SPF/Test|Test]]</li> |
| | </ul> |
|
| |
|
| I leased a dedicated server from [http://hetzner.de/ Hetzner], and I got the Plesk option, for administration, so I don’t have to bother with administration, but turns out I’m not so lucky, I’ve ran into a lot of issues with using Plesk, so I had to do my own fixes.
| | <noinclude> |
| | <!-- |
| | ---- |
| | {{Navigation|<zurück>|<nachste>}} |
| | ---- |
| | --> |
|
| |
|
| So let’s take a look at how we can integrate SPF + DK + DKIM with Postfix in Plesk 11.5 on Debian Wheezy.
| | == Anhang == |
| | === Siehe auch === |
| | <div style="column-count:2"> |
| | <categorytree hideroot=on mode="pages">{{BASEPAGENAME}}</categorytree> |
| | </div> |
| | ---- |
| | {{Special:PrefixIndex/{{BASEPAGENAME}}/}} |
|
| |
|
| First things, first, if you are using QMail switch to Postfix, to install Postfix you can either use the GUI, or you can do it from a console.
| | === Dokumentation === |
| | <!-- |
| | ; Man-Page |
| | # [https://manpages.debian.org/stable/procps/pgrep.1.de.html prep(1)] |
|
| |
|
| Here is how to do it from the console.
| | ; Info-Pages |
| /usr/local/psa/admin/sbin/autoinstaller --select-release-current --install-component postfix
| | --> |
|
| |
|
| === SPF === | | === Links === |
| Let’s open the DNS Template, you will see there that, there is an entry for SPF
| | ==== Projekt ==== |
| | ==== Weblinks ==== |
|
| |
|
| v=spf1 +a +mx -all
| | <!-- |
| | {{DEFAULTSORT:new}} |
| | {{DISPLAYTITLE:new}} |
| | --> |
|
| |
|
| This means the SPF is enabled on our domain.
| | [[Kategorie:DNS]] |
| | [[Kategorie:Spam]] |
| | [[Kategorie:E-Mail]] |
|
| |
|
| Let’s modify it a little bit to be better, if you are gonna host multiple domains from your server, then you should probably modify it too.
| | </noinclude> |
| | |
| v=spf1 +a +mx +ip4:<ip.mail> ?all* <tt><ip.mail></tt> - Is the IP of the mail server that is responsible for sending the mails, it is automatically filled in when you apply the zones
| |
| | |
| After you do this modification you should apply it
| |
| | |
| So now my configuration looks like this:
| |
| | |
| [[Image:Bild20.png|alt="SPF DNS Template"]]
| |
| | |
| Now let’s check with dig if the SPF is OK.
| |
| | |
| dig myserverplace.de TXT @ns1.myserverplace.de
| |
| | |
| You will see in the Answer section I have the following entry
| |
| | |
| myserverplace.de. 600 IN TXT "v=spf1 +a +mx +ip4:144.76.163.46 ?all"
| |
| | |
| So everything is ok, next onto DomainKeys
| |
| | |
| === [[DomainKeys]] ===
| |
| | |
| === [[DKIM]] ===
| |
| | |
| === Postfix ===
| |
| Now let’s see what we need to do to configure Postfix to use OpenDKIM.
| |
| | |
| Execute the following command to see the milters configured
| |
| | |
| cat /etc/postfix/main.cf | grep "milters"
| |
| smtpd_milters = , inet:127.0.0.1:12768
| |
| non_smtpd_milters = , inet:127.0.0.1:12768
| |
| | |
| You can see that we have additional milters we need to put, this one is from the process '''psa-pc-remote''', and it’s part of Plesk
| |
| | |
| Open '''/etc/postfix/main.cf''' with your favorite editor, and add the following to the end of the file
| |
| | |
| # OpenDKIM
| |
| milter_default_action = accept
| |
| milter_protocol = 6
| |
| smtpd_milters = , inet:127.0.0.1:8891, inet:127.0.0.1:12768
| |
| non_smtpd_milters = $smtpd_milters
| |
| | |
| As you can see we added the OpenDKIM milter too, and '''milter_protocol''' is set to '''6''', this is important, if it’s not set to '''6''', the '''psa-pc-remote''' process will segfault like so,
| |
| | |
| psa-pc-remote[18523]: segfault at 0 ip 00007fa5be18c034 sp 00007fa5bccffd30 error 4 in libc-2.13.so[7fa5be123000+180000]
| |
| | |
| And your messages won’t be signed with '''DomainKey''', only with '''DKIM'''
| |
| | |
| service postfix restart
| |
| | |
| === Testing ===
| |
| There is an easy way to test if everything is correct, create an email account if you haven’t already and send a test mail to the following recepients, and the results are cut down because the text is too big* check-auth@verifier.port25.com
| |
| | |
| ==========================================================
| |
| Summary of Results
| |
| ==========================================================
| |
| SPF check: pass
| |
| DomainKeys check: pass
| |
| DKIM check: pass
| |
| Sender-ID check: pass
| |
| SpamAssassin check: ham* AAAA3QcKCQwA@appmaildev.com
| |
|
| |
| ============================================================
| |
| SPF result: Pass
| |
| ============================================================
| |
| Domain: myserverplace.de
| |
| IP: 144.76.163.46
| |
|
| |
| SPF Record: myserverplace.de
| |
| IN TXT = "v=spf1 +a +mx 144.76.163.46 ?all"
| |
|
| |
| ============================================================
| |
| DomainKey result: pass
| |
| ============================================================
| |
| Signed by: admin@myserverplace.de
| |
|
| |
| PublicKey: default._domainkey.myserverplace.de
| |
| IN TXT = "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAruBNqdsSCKBLwMrFNNKH8z0e7zmlAic7iRoJsDDJK3IlnW8j6G/T6a93m+jqYc6R38MBAZbeSv2LQJ0SepJEsr4Iqk41WFXPBKnyXReO1RXPW5/YnRe6dpJMEqsmPpl2TjInY7ve/6VCiVDOHn9RRrdB+x7CGeK2crgqSZVlFwIDAQAB;"
| |
|
| |
| ============================================================
| |
| DKIM result: pass
| |
| ============================================================
| |
| Signed by: admin@myserverplace.de
| |
| Expected Body Hash: frcCV1k9oG9oKj3dpUqdJg1PxRT2RSN/XKdLCPjaYaY=
| |
| PublicKey: mail._domainkey.myserverplace.de
| |
| IN TXT = "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMziMcgPTWK0kSUKxrgHHzEiWxNkZ2/M0Ugyr/8H9WtoCsJUM+Bc1C9VwqJ6yjTidecDrX7aL0lFZ9Mylku/wtSiPw6KLxMg2LG2vrMzlPTB2lmJNmg/EOu3KPC8BtAuOhXfwVH/ttQbzdKJKWqiCJn7jhF5oqEKnOCORxOQXKIwIDAQAB;"
| |
| | |
| === Logs ===
| |
| You can check the following locations to see if there are errors
| |
| * /var/log/mail.err
| |
| * /var/log/mail.warn
| |
| * /var/log/mail.info
| |
| * /var/log/syslog
| |
| | |
| === Note ===
| |
| Make sure you enable testing mode for DKIM if you plan to test, you can also cut down the EXPIRY time so the results propagate faster, so to enable testing mode set the key <tt>'''_domainkey'''</tt> to <tt>'''t=y; o=-'''</tt>
| |
| | |
| === References ===
| |
| * https://matoski.com/article/spf-dk-dkim-plesk-debian/
| |
| * [http://kb.parallels.com/en/5801 How to define what MTA is used in Parallels Plesk Panel and how to switch from Qmail to Postfix and back?]
| |
