View source for Funtoo:User Services/Simple Mail Server

This wiki page explains how to set up a simple, secure, lightweight email server using Postfix to send emails without IMAP and POP or multiple domains.

Managing your own email server doesn't have to be mystical and impenetrable; using a simple MTA like Postfix without any IMAP or POP configuration makes the task relatively easy. Regrettably, it is difficult to find good information on how to do this. What this guide will help you to do is to install and properly configure an email server that is used only for sending, intentionally leaving other more advanced features for other tutorials.

== Limitations ==

As indicated by the wiki page title, this mail setup is '''simple''', so there are some things that this mail setup does ''not'' support, which is done intentionally for those who don't need this functionality, and to allow this document to serve as the foundation for more complicated configurations. We have found that other mail server tutorials don't explain ''why'' certain technologies are needed. We hope to make this clearer by incrementally adding functionality to this mail server via future wiki pages.

So let's cover what this mail server ''can'' do. The setup documented here allows you to set up an standards-compliant ''send-only mail server'' on the Internet that can reliably send mail to other email addresses. In addition, it is possible to allow a set of trusted IP addresses or hosts to relay mail through this mail server, which will allow reliable delivery of cron and other important email. This makes these steps very useful when deploying new server infrastructure and your services need a central mail server to get critical messages ''out'' to you or others.

Here's what's intentionally not covered in this tutorial:

;Local Mailboxes: This is not a focus of this mail server, so we are not covering this in this document. This is a delivery-only mail server. If we configure local mailboxes, we then need to probably set up POP/IMAP and SASL authentication to allow clients to access their mail, and this makes the setup more complicated. One thing at a time.

;SASL Authentication for mail servers: Postfix natively supports whitelisting hosts and IP ranges that are allowed to relay mail through the mail server. If you want to extend this functionality to allow an arbitrary server on the Internet to authenticate as a relay, you will need SASL authentication, [https://www.postfix.org/SASL_README.html#server_sasl which is not built-in to Postfix] but instead requires a third-party SASL implementation. To keep things simple, we will support only host or IP-range based whitelisting of servers that are allowed to relay outbound mail through our mail server.

;Virtual Domains: This is left out of this document.

== Prerequisites ==

If you intend to run your own mail server only for sending messages, you will need to have a DNS with at least one IP or hostname configured via TXT so that the '''SPF''' is verified by the receiving mail server, on a DNS server that can be viewed on the Internet in general. It is also essential for reliable email delivery to have a properly configured '''reverse DNS''' as many email servers will use reverse DNS and expect your IP address to resolve your advertised hostname.

== Preparation ==

The following package need to be installed first, before we can do anything: {{c|mail-mta/postfix}}

{{console|body=###i## emerge -avq mail-mta/postfix}}

== Configuration ==

Now we come to the heart of the project. First we will have to configure Postfix modifying only two files: {{c|master.cf}} and {{c|main.cf}}

=== Configuring DNS ===

create an entry of type A with the external IP of the mail server, for example:
{{console|body=
mta.funtoo.org has address 192.150.253.194
mta.funtoo.org has IPv6 address 2001:470:4b:56:216:3eff:fefa:97b7
}}

Setup reverse DNS, for example:
{{console|body=
194.253.150.192.in-addr.arpa domain name pointer mta.funtoo.org.
}}

Configure SPF using TXT entry, for example:
{{console|body=
mta.funtoo.org descriptive text "v=spf1 a mx include:mta.funtoo.org ~all"
}}

This SPF entry tells other domains that our mail server is allowed to officially send mail, and more importantly, prevents other servers on the Internet from sending email claiming to be your mail server. See [[Wikipedia:Sender Policy Framework]] for more information.

=== Configuring Postfix ===

Now we have to configure Postfix. Open your favorite text editor and uncomment the following lines at the top on {{f|/etc/postfix/main.cf}}. We will be setting up the mail server's hostname and domain. How we fill this in depends on what your DNS and TXT records point to. If you have it set up so that your main domain is of the form ''tld.ext'', then you will put that into the {{c|mydomain}} field, otherwise, you will set it the same as the {{c|myshostname}} field (in ''host.tld.ext'' form):

{{file|name=/etc/postfix/main.cf|desc=Postfix Configuration|body=
myhostname = mta.funtoo.org
}}

Finally, in this file, we have to enumerate the networks that can relay mail via our server. Generally we want to list ''only'' the subnets that we want to be able to send mail from (replace ''<LAN IP>'' with your LAN's subnet and ''<LAN netmask>'' with your LAN's netmask, and leave 127.0.0.0/8 in):

{{file|name=/etc/postfix/main.cf|desc=Postfix Configuration|body=
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 172.19.0.0/16
}}

Next, we have to change some items in the same configuration file (we will be changing the defaults in the file to what is shown here). As this is a fresh install, the developers recommended that the compatibility level be set to 3.6:

{{file|name=/etc/postfix/main.cf|desc=More Postfix configuration|body=
compatibility_level = 3.6
}}

If we want Postfix to talk on port 25, we have to make sure the following lines are uncommented in the file {{f|/etc/postfix/master.cf}} for smtp is {{c|inet}} and {{c|ipass}}:

{{file|name=/etc/postfix/master.cf|desc=Postfix master service file|body=
smtp      unix  n       -       y       -       -       smtpd
smtp      inet  n       -       n       -       1       postscreen
smtpd     pass  -       -       n       -       -       smtpd
}}

== Final Steps ==

We want Postfix to appear when our server boots up, so we need to add it to the server boot; Once that's done, we'll start postfix with the command {{c|openrc}}:

{{console|body=
###i## rc-update add postfix default
###i## openrc
}}

== Test you new e-mail server ==

{{file|name=test-mail.sh|desc=optional script for tests only|body=
#!/bin/bash
(
echo 'HELO GAT';sleep 1
echo 'MAIL FROM: <coffnix@mta.funtoo.org>';sleep 1
echo 'RCPT TO: <coffnix@gmail.com>';sleep 1
echo 'DATA';sleep 1
echo 'MIME-Version: 1.0';sleep 1
echo 'FROM: <coffnix@mta.funtoo.org>';
echo 'TO: <coffnix@gmail.com>';
echo 'SUBJECT: test';
echo 'Content-type: text/plain; charset=UTF-8; format=flowed';
echo ' ';
echo ' ';
echo 'Testing SMTP.';
echo '.';sleep 1
echo 'QUIT'; ) {{!}} nc -t mta.funtoo.org 25
}}