2.2 KiB
Mail Server: Deployment
-
Create MX and TXT records. For example, here are example records defined in dnscontrol:
D('example.com', REG_NAMECHEAP, DnsProvider(DSP_NAMECHEAP), A('mail', '10.87.129.99'), MX('@', 10, 'mail.example.com.'), TXT('_dmarc', 'v=DMARC1; p=none'), TXT('@', 'v=spf1 mx ~all') );
The
A
andMX
records are required, while theTXT
records are optional but recommended. -
Configure your playbook's variables and run this playbook.
-
Configure credentials for the "hello" virtual inbox on the server. Use your favorite password manager to generate a passphrase and then run this to configure it:
sudo echo hello:$(doveadm pw -s BLF-CRYPT):$(id -u maildir):$(id -g maildir) >> /etc/dovecot/imap.passwd
Also, if you use
doas
rather thansudo
, you need to permit your ansible_user to become opendkim in your/etc/doas.conf
:permit nopass blee as opendkim
-
configure some virtual aliases in /etc/postfix/virtual and run:
postmap virtual
(Seeman 5 postconf
for details)
Validate your dns records: mxtoolbox.com
Optional: sending authenticated mail
-
Create another TXT record for DKIM using the contents of /etc/dkimkeys/mail.txt
Here's an example line in dnscontrol:
TXT('mail._domainkey', 'v=DKIM1; h=sha256; k=rsa; s=email; p=MIIBIjANB...QIDAQAB')
- See print-rdata.py for a (kind of bad) example of how to automatically parse mail.txt
- You can codify your records in a git repo using a tool like dnscontrol as well as octodns
-
If you're really feeling adventurous, you could even set up a proper dmarc address to replace the original placeholder TXT record.
TXT('_dmarc', 'v=DMARC1; p=reject; rua=mailto:dmarc@satstack.cloud; fo=1')
After records propogate, verify outbound mail using mail-tester or learndmarc. I can score 10/10 by sending an email with an html mime type (just copypasta something from chatgpt).