Email Server - Revision history

RobertBushman at 03:10, 28 October 2025

2025-10-28T03:10:48Z

@@ Line 1: / Line 1: @@
 [[Category:Email]]
 = GPT Recommendation =
 For a low-volume mail server setup on Debian 12 (Bookworm) that’s primarily used for sending outbound messages from a local instance of MediaWiki, you can opt for a simple yet reliable software stack. The primary goal here is to ensure that emails sent by MediaWiki (e.g., account creation confirmations, notifications) are delivered reliably without setting up a full-fledged mail receiving infrastructure.

RobertBushman at 00:18, 23 October 2025

2025-10-23T00:18:45Z

RobertBushman at 00:17, 23 October 2025

2025-10-23T00:17:56Z

← Older revision		Revision as of 00:17, 23 October 2025
Line 45:		Line 45:
	Ensure MediaWiki is configured to send email through your local Postfix installation. This is usually done in MediaWiki’s <code>LocalSettings.php</code>:		Ensure MediaWiki is configured to send email through your local Postfix installation. This is usually done in MediaWiki’s <code>LocalSettings.php</code>:

	<~~source~~ lang="php">$wgSMTP = [		<syntaxhighlight lang="php">$wgSMTP = [
	'host' => 'localhost',		'host' => 'localhost',
	'IDHost' => 'example.com',		'IDHost' => 'example.com',
	'port' => 25,		'port' => 25,
	'auth' => false,		'auth' => false,
	];</~~source~~>		];</syntaxhighlight>
	Adjust <code>example.com</code> to match your domain.		Adjust <code>example.com</code> to match your domain.

RobertBushman: Created page with "Category:Email = GPT Recommendation = For a low-volume mail server setup on Debian 12 (Bookworm) that’s primarily used for sending outbound messages from a local instance of MediaWiki, you can opt for a simple yet reliable software stack. The primary goal here is to ensure that emails sent by MediaWiki (e.g., account creation confirmations, notifications) are delivered reliably without setting up a full-fledged mail receiving infrastructure. === Software Stack: ==..."

2025-10-23T00:13:08Z

Created page with "Category:Email = GPT Recommendation = For a low-volume mail server setup on Debian 12 (Bookworm) that’s primarily used for sending outbound messages from a local instance of MediaWiki, you can opt for a simple yet reliable software stack. The primary goal here is to ensure that emails sent by MediaWiki (e.g., account creation confirmations, notifications) are delivered reliably without setting up a full-fledged mail receiving infrastructure. === Software Stack: ==..."

New page

[[Category:Email]]
= GPT Recommendation =
For a low-volume mail server setup on Debian 12 (Bookworm) that’s primarily used for sending outbound messages from a local instance of MediaWiki, you can opt for a simple yet reliable software stack. The primary goal here is to ensure that emails sent by MediaWiki (e.g., account creation confirmations, notifications) are delivered reliably without setting up a full-fledged mail receiving infrastructure.

=== Software Stack: ===

* '''Postfix''': A widely used, open-source Mail Transfer Agent (MTA) that can handle sending outbound emails. It’s relatively straightforward to configure for sending emails and can be secured to prevent unauthorized use.
* '''Optional: Dovecot''': If you ever decide to handle receiving emails (for bounces or administrative purposes), Dovecot is a secure IMAP and POP3 server that integrates well with Postfix. However, for your described use case, Dovecot may not be necessary.
* '''Certbot (Let’s Encrypt)''': For securing your connections with TLS, using Certbot to obtain a free SSL certificate from Let’s Encrypt is recommended, especially if you’ll be sending sensitive information.

=== Basic Setup Instructions: ===

==== 1. Install Postfix ====

<ol style="list-style-type: decimal;">
<li>Update your package list:
<pre>sudo apt update</pre></li>
<li>Install Postfix:
<pre>sudo apt install postfix</pre></li>
<li>During installation, you’ll be prompted for some basic configuration:
<ul>
<li>'''General type of mail configuration''': Choose “Internet Site”.</li>
<li>'''System mail name''': This should be your domain name (e.g., example.com).</li></ul>
</li></ol>

==== 2. Basic Configuration ====

<ol style="list-style-type: decimal;">
<li>Edit the main Postfix configuration file <code>/etc/postfix/main.cf</code> to ensure it’s set up for sending mail correctly. For a basic setup, you might only need to adjust or verify a few lines:
<pre>inet_interfaces = loopback-only
myhostname = example.com
mydestination =
mynetworks = 127.0.0.0/8</pre>
<ul>
<li><code>inet_interfaces</code> set to <code>loopback-only</code> ensures Postfix only listens on the localhost interface.</li>
<li><code>myhostname</code> should be your server’s FQDN.</li>
<li>Clear <code>mydestination</code> to prevent Postfix from considering itself the final destination for mail.</li>
<li><code>mynetworks</code> restricts which IPs can send mail through this server, set it to localhost only for security.</li></ul>
</li>
<li>Reload or restart Postfix to apply the changes:
<pre>sudo systemctl restart postfix</pre></li></ol>

==== 3. Configure MediaWiki for Email ====

Ensure MediaWiki is configured to send email through your local Postfix installation. This is usually done in MediaWiki’s <code>LocalSettings.php</code>:

<source lang="php">$wgSMTP = [
'host' => 'localhost',
'IDHost' => 'example.com',
'port' => 25,
'auth' => false,
];</source>
Adjust <code>example.com</code> to match your domain.

=== Security and Sending Limits ===

* '''IP and Domain Reputation''': Ensure your server’s IP and domain have a good reputation. A new IP or one previously used for spam can negatively affect deliverability.
* '''Reverse DNS''': Set up reverse DNS for your server’s IP to match your domain. This is often done through your hosting provider’s control panel.
* '''SPF Record''': Add an SPF record to your domain’s DNS to authorize your server to send email on behalf of your domain.
* '''DKIM and DMARC''': For a low-volume server used as described, DKIM and DMARC are optional but recommended for improving email authenticity.

This setup is sufficient for sending outbound emails from a MediaWiki instance. Remember to monitor your server for any abuse and ensure that it’s not configured as an open relay. For more extensive email needs in the future, consider additional configurations and possibly using external SMTP services designed for high deliverability.
== SPF, DKIM, DMARC ==
Sure, here’s a simplified overview of setting up SPF, DKIM, and DMARC through DNS records. Note that specific values can vary based on your email sending service (e.g., Google Workspace, Office 365, SendGrid, etc.) or if you’re sending emails directly from your own server.

=== SPF (Sender Policy Framework) ===

'''Purpose:''' SPF allows the owner of a domain to specify which mail servers are permitted to send email on behalf of that domain.

'''DNS Record Type:''' TXT

'''Example Value:'''

<pre class="plaintext">v=spf1 include:_spf.example.com ~all</pre>
* <code>v=spf1</code> specifies the SPF version.
* <code>include:_spf.example.com</code> tells receiving mail servers to consider the SPF record of <code>_spf.example.com</code> as part of this domain’s SPF record. Replace <code>_spf.example.com</code> with the SPF record of your email service provider or your own mail server.
* <code>~all</code> is a soft fail for mechanisms not specified in the record. It advises recipients to accept mail whether it passes the SPF check or not but to mark it as suspicious. Use <code>-all</code> for a hard fail if you’re sure all legitimate sources are listed.

==== HSL Version ====
For the HeatSync Labs wiki server, we know the domain (heatsynclabs.wiki) is dedicated to a single purpose, so we can go pretty hardcore. We'll specify that only email from the mx mail.heatsynclabs.wiki should be accepted.
<pre>
v=spf1 mx:mail.heatsynclabs.wiki -all
</pre>

=== DKIM (DomainKeys Identified Mail) ===

'''Purpose:''' DKIM provides a way to validate a domain name identity that is associated with a message through cryptographic authentication.

'''Configuration:''' You’ll generate a public/private key pair. The public key goes into your DNS records, and the private key is used by your outgoing email server to sign messages.

'''DNS Record Type:''' TXT

'''Example Value:'''

<pre class="plaintext">v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3...[your_public_key]...</pre>
* <code>v=DKIM1</code> specifies the DKIM version.
* <code>k=rsa</code> indicates the key type.
* <code>p=[your_public_key]</code> is where you paste the actual public key generated by your mail server or email service.

The specific <code>TXT</code> record name often includes a selector which is a prefix to <code>_domainkey</code>, like <code>selector1._domainkey.example.com</code>. The selector is specified by your email system when setting up DKIM.

=== DMARC (Domain-based Message Authentication, Reporting, and Conformance) ===

'''Purpose:''' DMARC uses SPF and DKIM to determine the legitimacy of an email message, providing instructions to the receiving mail server on what to do if neither of those authentication methods passes. It also specifies how an email sender can receive feedback on messages that pass and/or fail DMARC evaluation.

'''DNS Record Type:''' TXT

'''Example Value:'''

<pre class="plaintext">v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com</pre>
* <code>v=DMARC1</code> specifies the DMARC version.
* <code>p=reject</code> is the policy, telling receiving servers to reject messages that fail DMARC checks. Other options include <code>none</code> (do nothing, only log the event) and <code>quarantine</code> (mark as spam).
* <code>rua=mailto:dmarc-reports@example.com</code> specifies an email address where aggregate reports should be sent.

For all three, replace <code>example.com</code> with your domain and adjust values according to your specific setup or service provider’s guidelines. Setting up these records correctly can significantly improve your email deliverability and protect your domain against misuse. Always test your configuration using tools like Google’s Admin Toolbox or other DMARC, SPF, and DKIM validation tools available online.
== DKIM on Postfix ==
To configure Postfix with DomainKeys Identified Mail (DKIM) to sign outgoing emails, you typically use an external application like OpenDKIM. OpenDKIM provides a method to sign email messages with a DKIM signature based on your private key, enhancing email security and deliverability. Here’s a basic guide to configuring Postfix with DKIM using OpenDKIM:

=== Step 1: Install OpenDKIM ===

First, install OpenDKIM and its tools. On Debian/Ubuntu systems, you can do this with:

<source lang="bash">sudo apt-get update
sudo apt-get install opendkim opendkim-tools</source>
=== Step 2: Generate DKIM Keys ===

You’ll need to generate a private and public key pair for DKIM.

# Create a directory for your keys:

<source lang="bash">sudo mkdir -p /etc/dkimkeys/yourdomain.com</source>
<ol start="2" style="list-style-type: decimal;">
<li>Generate the keys:</li></ol>

<source lang="bash">sudo opendkim-genkey -b 2048 -d yourdomain.com -D /etc/dkimkeys/yourdomain.com -s mail -v</source>
<ol start="3" style="list-style-type: decimal;">
<li>Change ownership of the private key to the opendkim user:</li></ol>

<source lang="bash">sudo chown opendkim:opendkim /etc/dkimkeys/yourdomain.com/mail.private</source>
In this example, <code>yourdomain.com</code> should be replaced with your actual domain, and <code>mail</code> is a selector that will be part of your DKIM record.

Set the access on the private key:
<pre>
sudo chmod 0600 /etc/dkimkeys/heatsynclabs.wiki/mail.private
</pre>

==== HeatSync Labs DNS Entry ====
<pre>
mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoO06v9Pk+J4zAHn7lKAyIB+FYyph6REHI47BnXX991UWDmJNGRNBmMy3t6fBoz1j8oCzjruBdgHFrGUnXRcGZFBeJFX2/Zg/NvSTRV6axMdki936fELtZi+ftUetPHbRpD0J7yYlyOZ+816em9J68MtAfBSUj2uCcA8RVGXs2YdcfcridEFvXmzd4N0fdcU21LyMkGotyMCKZ9"
"CLnNn0BFFdVkHEtjtTqasnvzOkL002UOS+DApLdAReNCDYciJpuHusQBw5LAoj+nJO/bI4BBSVPt7jUgQv1oNWAbw7mSZRwAHNDhGs4Feh9imITw7sxsF6Q513uAFqZoXBiiADVQIDAQAB" ) ; ----- DKIM key mail for heatsynclabs.wiki
</pre>

NameCheap wants it in one long string:
<blockquote>
v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoO06v9Pk+J4zAHn7lKAyIB+FYyph6REHI47BnXX991UWDmJNGRNBmMy3t6fBoz1j8oCzjruBdgHFrGUnXRcGZFBeJFX2/Zg/NvSTRV6axMdki936fELtZi+ftUetPHbRpD0J7yYlyOZ+816em9J68MtAfBSUj2uCcA8RVGXs2YdcfcridEFvXmzd4N0fdcU21LyMkGotyMCKZ9CLnNn0BFFdVkHEtjtTqasnvzOkL002UOS+DApLdAReNCDYciJpuHusQBw5LAoj+nJO/bI4BBSVPt7jUgQv1oNWAbw7mSZRwAHNDhGs4Feh9imITw7sxsF6Q513uAFqZoXBiiADVQIDAQAB
</blockquote>

<blockquote>
v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoO06v9Pk+J4zAHn7lKAyIB+FYyph6REHI47BnXX991UWDmJNGRNBmMy3t6fBoz1j8oCzjruBdgHFrGUnXRcGZFBeJFX2/Zg/NvSTRV6axMdki936fELtZi+ftUetPHbRpD0J7yYlyOZ+816em9J68MtAfBSUj2uCcA8RVGXs2YdcfcridEFvXmzd4N0fdcU21LyMkGotyMCKZ9CLnNn0BFFdVkHEtjtTqasnvzOkL002UOS+DApLdAReNCDYciJpuHusQBw5LAoj+nJO/bI4BBSVPt7jUgQv1oNWAbw7mSZRwAHNDhGs4Feh9imITw7sxsF6Q513uAFqZoXBiiADVQIDAQAB
</blockquote>

=== Step 3: Configure OpenDKIM ===
==== Big Email System Config (don't use this) ====
Edit the OpenDKIM main configuration file (<code>/etc/opendkim.conf</code>) to specify your key and signing details. You may need root privileges to edit this file.

# Open <code>/etc/opendkim.conf</code> in your text editor.
# Add or ensure these lines are configured with your domain and key information:

<pre class="conf">KeyTable refile:/etc/opendkim/KeyTable
SigningTable refile:/etc/opendkim/SigningTable
ExternalIgnoreList refile:/etc/opendkim/TrustedHosts
InternalHosts refile:/etc/opendkim/TrustedHosts</pre>
<ol start="3" style="list-style-type: decimal;">
<li>Create or edit <code>/etc/opendkim/KeyTable</code> and add your domain’s key:</li></ol>

<pre class="conf">mail._domainkey.yourdomain.com yourdomain.com:mail:/etc/dkimkeys/yourdomain.com/mail.private</pre>
<ol start="4" style="list-style-type: decimal;">
<li>Create or edit <code>/etc/opendkim/SigningTable</code> and link email addresses to the selector and domain:</li></ol>

<pre class="conf">*@yourdomain.com mail._domainkey.yourdomain.com</pre>
<ol start="5" style="list-style-type: decimal;">
<li>Create or edit <code>/etc/opendkim/TrustedHosts</code> and add your localhost and domain names to specify which hosts can send mail that will be signed:</li></ol>

<pre class="conf">127.0.0.1
localhost
yourdomain.com</pre>

==== Simple Basic Version ====
<pre>
Domain heatsynclabs.wiki
Selector mail
KeyFile /etc/dkimkeys/heatsynclabs.wiki/mail.private
</pre>

=== Step 4: Connect OpenDKIM to Postfix ===

Configure Postfix to use OpenDKIM for signing by editing <code>/etc/postfix/main.cf</code> and adding:

<pre class="conf">milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:12301
non_smtpd_milters = inet:localhost:12301</pre>
Make sure the port (<code>12301</code> in this example) matches the one configured for OpenDKIM.

=== Step 5: Restart and Test ===

# Restart OpenDKIM and Postfix to apply changes:

<source lang="bash">sudo systemctl restart opendkim postfix</source>
<ol start="2" style="list-style-type: decimal;">
<li>Test your DKIM configuration using online tools or by sending an email to a service like <code>check-auth@verifier.port25.com</code>, which will reply with an analysis of your email’s authentication results, including DKIM.</li></ol>

=== Step 6: Publish Your DKIM Public Key ===

Don’t forget to publish your DKIM public key in your DNS. You’ll find the public key in a file named <code>mail.txt</code> within your domain’s key directory <code>/etc/opendkim/keys/yourdomain.com</code>. Create a TXT record for <code>mail._domainkey.yourdomain.com</code> with the value provided in that file.

Make sure to replace placeholders like <code>yourdomain.com</code> and <code>mail</code> (if you used a different selector) with your actual domain and selector used during key generation. This guide assumes basic familiarity with Linux server administration and might require adjustments based on your system’s specifics and the domain registrar’s DNS settings interface.
= DKIM =
== OpenDKIM Config ==
/etc/opendkim.conf, at end of file
<pre>
# -------------------------------------------------------------------------
# Custom for heatsynclabs.wiki
# ----------------------------
# See: http://www.opendkim.org/opendkim.conf.5.html

# LogWhy
# If logging is enabled (see Syslog below), issues very detailed logging
# about the logic behind the filter’s decision to either sign a message
# or verify it. The logic behind the decision is non-trivial and can be
# confusing to administrators not familiar with its operation. A
# description of how the decision is made can be found in the OPERATIONS
# section of the opendkim(8) man page. This causes a large increase in the
# amount of log data generated for each message, so it should be limited
# to debugging use and not enabled for general operation.
# LogWhy yes # enables extra logging

# Mode
# Selects operating modes. The string is a concatenation of characters that
# indicate which mode(s) of operation are desired. Valid modes are s
# (signer) and v (verifier). The default is sv except in test mode
# (see the opendkim(8) man page) in which case the default is v. When
# signing mode is enabled, one of the following combinations must also be
# set:
# (a) Domain, KeyFile, Selector, no KeyTable, no SigningTable; <-- 1 domain
# (b) KeyTable, SigningTable, no Domain, no KeyFile, no Selector;
# (c) KeyTable, SetupPolicyScript, no Domain, no KeyFile, no Selector.
# Mode sv

# Signing domain, selector, and key (required). For example, perform signing
# for domain "example.com" with selector "2020" (2020._domainkey.example.com),
# using the private key stored in /etc/dkimkeys/example.private. More granular
# setup options can be found in /usr/share/doc/opendkim/README.opendkim.
#
# Domain
# A set of domains whose mail should be signed by this filter. Mail from
# other domains will be verified rather than being signed.
Domain heatsynclabs.wiki
#
# KeyFile
# Gives the location of a PEM-formatted private key to be used for signing
# all messages. Ignored if a KeyTable is defined.
KeyFile /etc/dkimkeys/heatsynclabs.wiki/mail.private
#
# Selector
# Defines the name of the selector to be used when signing messages. See
# the DKIM specification for details. Used only when signing with a single
# key; see the SigningTable parameter below for more information.
Selector mail

# Socket for the MTA connection (required). If the MTA is inside a chroot jail,
# it must be ensured that the socket is accessible. In Debian, Postfix runs in
# a chroot in /var/spool/postfix, therefore a Unix socket would have to be
# configured as shown on the last line below.
#
# Specifies the socket that should be established by the filter to receive
# connections from sendmail(8) in order to provide service. socketspec is in
# one of two forms: local:path, which creates a UNIX domain socket at the
# specified path, or inet:port[@host] or inet6:port[@host] which creates a
# TCP socket on the specified port and in the specified protocol family. If
# the host is not given as either a hostname or an IP address, the socket
# will be listening on all interfaces. A literal IP address must be enclosed
# in square brackets. This option is mandatory either in the configuration
# file or on the command line.
Socket local:/var/spool/postfix/opendkim/opendkim.sock
# -------------------------------------------------------------------------
</pre>

== Postfix Config ==
/etc/postfix/main.cf, at end of file
<pre>
# OpenDKIM Config
milter_default_action = accept
milter_protocol = 6
smtpd_milters = local:/opendkim/opendkim.sock
non_smtpd_milters = local:/opendkim/opendkim.sock
</pre>

← Older revision		Revision as of 00:18, 23 October 2025
Line 121:		Line 121:
	First, install OpenDKIM and its tools. On Debian/Ubuntu systems, you can do this with:		First, install OpenDKIM and its tools. On Debian/Ubuntu systems, you can do this with:

	<~~source~~ lang="bash">sudo apt-get update		<syntaxhighlight lang="bash">sudo apt-get update
	sudo apt-get install opendkim opendkim-tools</~~source~~>		sudo apt-get install opendkim opendkim-tools</syntaxhighlight>
	=== Step 2: Generate DKIM Keys ===		=== Step 2: Generate DKIM Keys ===

Line 129:		Line 129:
	# Create a directory for your keys:		# Create a directory for your keys:

	<~~source~~ lang="bash">sudo mkdir -p /etc/dkimkeys/yourdomain.com</~~source~~>		<syntaxhighlight lang="bash">sudo mkdir -p /etc/dkimkeys/yourdomain.com</syntaxhighlight>
	<ol start="2" style="list-style-type: decimal;">		<ol start="2" style="list-style-type: decimal;">
	<li>Generate the keys:</li></ol>		<li>Generate the keys:</li></ol>

	<~~source~~ lang="bash">sudo opendkim-genkey -b 2048 -d yourdomain.com -D /etc/dkimkeys/yourdomain.com -s mail -v</~~source~~>		<syntaxhighlight lang="bash">sudo opendkim-genkey -b 2048 -d yourdomain.com -D /etc/dkimkeys/yourdomain.com -s mail -v</syntaxhighlight>
	<ol start="3" style="list-style-type: decimal;">		<ol start="3" style="list-style-type: decimal;">
	<li>Change ownership of the private key to the opendkim user:</li></ol>		<li>Change ownership of the private key to the opendkim user:</li></ol>

	<~~source~~ lang="bash">sudo chown opendkim:opendkim /etc/dkimkeys/yourdomain.com/mail.private</~~source~~>		<syntaxhighlight lang="bash">sudo chown opendkim:opendkim /etc/dkimkeys/yourdomain.com/mail.private</syntaxhighlight>
	In this example, <code>yourdomain.com</code> should be replaced with your actual domain, and <code>mail</code> is a selector that will be part of your DKIM record.		In this example, <code>yourdomain.com</code> should be replaced with your actual domain, and <code>mail</code> is a selector that will be part of your DKIM record.

Line 208:		Line 208:
	# Restart OpenDKIM and Postfix to apply changes:		# Restart OpenDKIM and Postfix to apply changes:

	<~~source~~ lang="bash">sudo systemctl restart opendkim postfix</~~source~~>		<syntaxhighlight lang="bash">sudo systemctl restart opendkim postfix</syntaxhighlight>
	<ol start="2" style="list-style-type: decimal;">		<ol start="2" style="list-style-type: decimal;">
	<li>Test your DKIM configuration using online tools or by sending an email to a service like <code>check-auth@verifier.port25.com</code>, which will reply with an analysis of your email’s authentication results, including DKIM.</li></ol>		<li>Test your DKIM configuration using online tools or by sending an email to a service like <code>check-auth@verifier.port25.com</code>, which will reply with an analysis of your email’s authentication results, including DKIM.</li></ol>