https://www.linuxbabe.com/mail-server/setting-up-dkim-and-spf
DNS Entries
hensler.net TXT "v=spf1 ip4:3.225.201.202 ~all" default._domainkey.hensler.net. TXT "v=DKIM1;k=rsa;" "part I" "part II" _dmarc TXT v=DMARC1; p=none; pct=100; rua=mailto:dmarc-reports@hensler.net DNS Type SPF use has been removed in the standards track version of SPF, RFC 7208. Your DNS Type SPF record should be republished as Type TXT instead. dig hensler.net txt http://spf.myisp.ch/ https://www.kitterman.com/spf/validate.html?
spf
sudo apt install postfix-policyd-spf-python sudo vim /etc/postfix/master.cf policyd-spf unix - n n - 0 spawn user=policyd-spf argv=/usr/bin/policyd-spf sudo vim /etc/postfix/main.cf #smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination policyd-spf_time_limit = 3600 smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination,check_policy_service unix:private/policyd-spf
dkim
sudo apt install opendkim opendkim-tools sudo gpasswd -a postfix opendkim sudo vim /etc/opendkim.conf Canonicalization relaxed/simple Mode sv SubDomains no #ADSPAction continue AutoRestart yes AutoRestartRate 10/1M Background yes DNSTimeout 5 SignatureAlgorithm rsa-sha256 #OpenDKIM user Remember to add user postfix to group opendkim UserID opendkim #Map domains in From addresses to keys used to sign messages KeyTable refile:/etc/opendkim/key.table SigningTable refile:/etc/opendkim/signing.table #Hosts to ignore when verifying signatures ExternalIgnoreList /etc/opendkim/trusted.hosts #A set of internal hosts whose mail should be signed InternalHosts /etc/opendkim/trusted.hosts
sudo mkdir /etc/opendkim sudo mkdir /etc/opendkim/keys sudo chown -R opendkim:opendkim /etc/opendkim sudo chmod go-rw /etc/opendkim/keys sudo vim /etc/opendkim/signing.table *@hensler.net default._domainkey.hensler.net sudo vim /etc/opendkim/key.table default._domainkey.hensler.net hensler.net:default:/etc/opendkim/keys/hensler.net/default.private sudo vim /etc/opendkim/trusted.hosts 127.0.0.1 localhost *.hensler.net
CREATE PUBLIC KEY
sudo mkdir /etc/opendkim/keys/hensler.net
sudo opendkim-genkey -b 2048 -d hensler.net -D /etc/opendkim/keys/hensler.net -s default -v
sudo chown opendkim:opendkim /etc/opendkim/keys/hensler.net/default.private
sudo cat /etc/opendkim/keys/hensler.net/default.txt
Copy public key to DNS and test; Important note: separate strings with a single space, e.g. "v=DKIM1;k=rsa;" "part I" "part II"
sudo opendkim-testkey -d hensler.net -s default -vvv
opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: checking key 'default._domainkey.hensler.net'
opendkim-testkey: key not secure
opendkim-testkey: key OK
socket
sudo mkdir /var/spool/postfix/opendkim sudo chown opendkim:postfix /var/spool/postfix/opendkim sudo vim /etc/opendkim.conf Socket local:/var/spool/postfix/opendkim/opendkim.sock sudo vim /etc/default/opendkim SOCKET="local:/var/spool/postfix/opendkim/opendkim.sock" sudo vim /etc/postfix/main.cf Milter configuration milter_default_action = accept milter_protocol = 6 smtpd_milters = local:opendkim/opendkim.sock non_smtpd_milters = $smtpd_milters
dmarc
sudo apt install opendmarc
sudo useradd -m -G mail -s /bin/bash dmarc-reports
opendmarc-check hensler.net
DMARC record for hensler.net:
Sample percentage: 100
DKIM alignment: relaxed
SPF alignment: relaxed
Domain policy: none
Subdomain policy: unspecified
Aggregate report URIs: mailto:dmarc-reports@hensler.net
Forensic report URIs: (none)