{"id":11,"date":"2018-12-03T06:50:00","date_gmt":"2018-12-03T13:50:00","guid":{"rendered":"https:\/\/www.stauber.org\/?p=11"},"modified":"2018-12-05T07:59:15","modified_gmt":"2018-12-05T14:59:15","slug":"setting-up-your-own-mail-server-postfix-dovecot-mailutils","status":"publish","type":"post","link":"https:\/\/www.stauber.org\/index.php\/2018\/12\/03\/setting-up-your-own-mail-server-postfix-dovecot-mailutils\/","title":{"rendered":"Setting Up Your Own Mail Server (Postfix, Dovecot, Mailutils)"},"content":{"rendered":"<p>In this post I will tell you how to set up your own mail server using <b>Postfix<\/b> and <b>Dovecot<\/b>.\u00a0 <strong>Postfix<\/strong> functions as a <strong>Mail Delivery Agent (MDA)<\/strong>, so any apps you have running on the server can send out emails, and <strong>Dovecot<\/strong> functions as a <strong>Mail Transfer Agent (MTA)<\/strong>, which lets you hook up a <strong>Mail User Agent (MUA)<\/strong>, such as Windows 10&#8217;s <strong>Mail<\/strong> app, or <strong>Thunderbird<\/strong>.\u00a0 Because I&#8217;m moving away from PHP, I did not experiment with webmail.\u00a0 There are no real popular Node.js webmail apps yet.<\/p>\n<p>To set up your own mail server, you have to have a public facing server with a domain name, static IP, and Certificate Authority (CA) signed SSL certificate, there&#8217;s just no way around that.\u00a0 Mail programs balk at connecting with self-signed certs, and services like Gmail won&#8217;t even accept mail from dynamic IP addresses on servers hosted on home networks.\u00a0 You can still set one up on your home server to test a lot of things, and send mail between different users on the same server.<\/p>\n<p>The real deal can be cheap, though.\u00a0 <a href=\"https:\/\/www.digitalocean.com\/\">DigitalOcean<\/a> offers servers (which they call Droplets) as cheap as $5\/month (mine is $20\/month), and <a href=\"https:\/\/letsencrypt.org\/\">Let&#8217;s Encrypt<\/a> can hook you up with a signed wildcard SSL-cert for free.\u00a0 I will go over how to get your cert in a <a href=\"https:\/\/www.stauber.org\/index.php\/2018\/12\/02\/creating-a-wildcard-ssl-certificate-for-a-digitalocean-droplet\/\">linked post<\/a>, because it will be useful for all kinds of things.<\/p>\n<h3><a href=\"#Networking-Setup\">Networking Setup<\/a><\/h3>\n<ul>\n<li>\n<h4><a href=\"#Obtaining-your-signed-wildcard-SSL-certificate\">Obtaining your signed wildcard SSL certificate<\/a><\/h4>\n<\/li>\n<li>\n<h4><a href=\"#Creating-the-necessary-DNS-entries\">Creating the necessary DNS entries<\/a><\/h4>\n<\/li>\n<li>\n<h4><a href=\"#Configuring-the-firewall-on-your-server\">Configuring the firewall on your server<\/a><\/h4>\n<\/li>\n<\/ul>\n<h3><a href=\"#Application-Setup\">Application Setup<\/a><\/h3>\n<ul>\n<li>\n<h4><a href=\"#Mailutils\">Mailutils<\/a><\/h4>\n<\/li>\n<li>\n<h4><a href=\"#Postfix\">Postfix<\/a><\/h4>\n<\/li>\n<li>\n<h4><a href=\"#Dovecot\">Dovecot<\/a><\/h4>\n<\/li>\n<\/ul>\n<h3><a href=\"#Troubleshooting\">Troubleshooting<\/a><\/h3>\n<ul>\n<li>\n<h4><a href=\"#log-files\">log files<\/a><\/h4>\n<\/li>\n<li>\n<h4><a href=\"#nmap\">nmap<\/a><\/h4>\n<\/li>\n<li>\n<h4><a href=\"#sslscan\">sslscan<\/a><\/h4>\n<\/li>\n<li>\n<h4><a href=\"#dig\">dig<\/a><\/h4>\n<\/li>\n<li>\n<h4><a href=\"#openssl\">openssl<\/a><\/h4>\n<\/li>\n<\/ul>\n<h3><a href=\"#References\">References<\/a><\/h3>\n<h3 id=\"Networking-Setup\">Networking Setup<\/h3>\n<p>Note, all my DNS examples are shown using DigitalOcean, but any hosting service should have a similar operation (e.g. GoDaddy.com).<\/p>\n<h4 id=\"Obtaining-your-signed-wildcard-SSL-certificate\">Obtaining your signed wildcard SSL certificate<\/h4>\n<p>I go over that <a href=\"https:\/\/www.stauber.org\/index.php\/2018\/12\/02\/creating-a-wildcard-ssl-certificate-for-a-digitalocean-droplet\/\">here<\/a>.<\/p>\n<p>If you are setting this up on a server hosted at home and just want a self-signed one to see if everything else works before you promote to production, I&#8217;ve got another post <a href=\"https:\/\/www.stauber.org\/index.php\/2018\/12\/02\/creating-a-self-signed-ssl-certificate\/\">here<\/a> that goes over that.<\/p>\n<h4 id=\"Creating-the-necessary-DNS-entries\">Creating the necessary DNS entries<\/h4>\n<p>I added this one early on because DNS records take a while to propagate through the world, so if you do this now, it will likely have taken effect everywhere by the time you&#8217;re done with this post.<\/p>\n<p>If you have a domain name that points to your server, you&#8217;ll have <strong>A<\/strong> records already.\u00a0 I have two, one for jogerfy.com and one for *.jogerfy.com.\u00a0 This means that if a user goes to <a href=\"https:\/\/jogerfy.com\/\">https:\/\/jogerfy.com\/<\/a> or <a href=\"https:\/\/www.jogerfy.com\/\">https:\/\/www.jogerfy.com\/<\/a> they will get to the same server, and beyond that redirection is handled with <strong>Nginx<\/strong>.\u00a0 If you do not have these already, you create them like so from your DNS management panel (obviously substituting your own server&#8217;s IP for the one in these screenshots, which was made up).<\/p>\n<p><a href=\"https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/a1_record.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-42 size-full\" src=\"https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/a1_record.png\" alt=\"\" width=\"1200\" height=\"267\" srcset=\"https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/a1_record.png 1200w, https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/a1_record-300x67.png 300w, https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/a1_record-768x171.png 768w, https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/a1_record-1024x228.png 1024w\" sizes=\"auto, (max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/a2_record.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-41 size-full\" src=\"https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/a2_record.png\" alt=\"\" width=\"1198\" height=\"267\" srcset=\"https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/a2_record.png 1198w, https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/a2_record-300x67.png 300w, https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/a2_record-768x171.png 768w, https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/a2_record-1024x228.png 1024w\" sizes=\"auto, (max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" \/><\/a><\/p>\n<p>Note that for <strong>example.com<\/strong>, the HOSTNAME is <strong>@<\/strong>, and for <strong>*.example.com<\/strong>, the HOSTNAME is <strong>*<\/strong>.<\/p>\n<p>Once your A records are there, you&#8217;ll need to add at least two more DNS records, an <strong>MX<\/strong> record, and a <strong>TXT<\/strong> record.\u00a0 These tell other mail services like Gmail that you are a real mail service that can be reached by a reply,and not a spam factory running on a home network.<\/p>\n<p>The MX record is entered as follows, again using an <strong>@<\/strong> for the HOSTNAME.<\/p>\n<p><a href=\"https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/mx_record.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-40 size-full\" src=\"https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/mx_record.png\" alt=\"\" width=\"1198\" height=\"267\" srcset=\"https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/mx_record.png 1198w, https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/mx_record-300x67.png 300w, https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/mx_record-768x171.png 768w, https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/mx_record-1024x228.png 1024w\" sizes=\"auto, (max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" \/><\/a><\/p>\n<p>The TXT record is a special one called a Sender Policy Framework (SPF) record, and it is technically optional, but Gmail will not accept mail unless you have one.\u00a0\u00a0The exact wording may vary, but this one is a good generic setting.<\/p>\n<p><a href=\"https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/txt_record.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-39 size-full\" src=\"https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/txt_record.png\" alt=\"\" width=\"1180\" height=\"330\" srcset=\"https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/txt_record.png 1180w, https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/txt_record-300x84.png 300w, https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/txt_record-768x215.png 768w, https:\/\/www.stauber.org\/wp-content\/uploads\/2018\/12\/txt_record-1024x286.png 1024w\" sizes=\"auto, (max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" \/><\/a><\/p>\n<p>There you go.\u00a0 In a couple hours at most, Gmail will know you&#8217;re legit.\u00a0 It will still route any mail sent to a user to their Spam folder at this point, until they email you back once, and from then onward messages sent to that user will go into their Inbox.\u00a0 Most other services are not so cautious and will pass along mail straight to the Inbox after seeing the MX and TXT records.<\/p>\n<h4 id=\"Configuring-the-firewall-on-your-server\">Configuring the firewall on your server<\/h4>\n<p>I&#8217;m a big believer in security, so though I don&#8217;t understand a lot, I do know that we don&#8217;t want open ports that we&#8217;re not using.\u00a0 If you have a an SSH server and a web server running, you most likely have open only ports 22, 80, and 443.\u00a0 SSH uses port 22.\u00a0 Web servers use ports 80 and 443 (HTTP defaults to port 80, and HTTPS defaults to port 443).\u00a0 For mail, you&#8217;ll need to open ports <strong>25<\/strong>, <strong>143<\/strong>, <strong>465<\/strong>, and <strong>587<\/strong>.\u00a0 Incoming mail is relayed on port 25, mail software like Windows 10&#8217;s Mail app uses ports 143 for incoming mail, and usually 587 for outgoing, and submission of mail by apps, such as a Node.js app you may have running, likes to send on port 465.\u00a0 By setting up your own server, you can create as many accounts as you want and avoid sending through your personal Gmail account.\u00a0 Here&#8217;s how you open those ports.<\/p>\n<p>You should have <strong>iptables<\/strong>\u00a0(and it&#8217;s IPv6 equivalent, <strong>ip6tables<\/strong>) installed, whether you&#8217;re using Ubuntu or CentOS.\u00a0 You&#8217;ll need another tool that isn&#8217;t usually installed called <strong>iptables-persistent<\/strong> in order to save your settings.<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo apt-get install iptables-persistent<\/pre>\n<p>A lot of people now are using an extra administration tool called <strong>Uncomplicated Firewall<\/strong> (UFW).\u00a0 To see if you have it installed, do<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">which ufw<\/pre>\n<p>If you don&#8217;t see it, you can do<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo apt-get ufw\r\nsudo ufw enable<\/pre>\n<p>Then you can simply open the ports like so<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">\r\nsudo ufw allow 22\r\nsudo ufw allow 143\r\nsudo ufw allow 465\r\nsudo ufw allow 587\r\n<\/pre>\n<p>I don&#8217;t use UFW. As I said above, I don&#8217;t understand security very well, and although UFW is supposed to be\u00a0<em>Un<\/em>complicated Firewall, it seems to add a lot of entries to the iptables that I don&#8217;t understand and therefore won&#8217;t put my money on.\u00a0 If you do all these UFW steps above and type<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo iptables -S<\/pre>\n<p>you&#8217;ll see what I mean.\u00a0 Therefore, I just use iptables manually. I type<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo iptables -S<\/pre>\n<p>It should start with three -P entries and then have at least 3 -A entries, one of them being port 22.<\/p>\n<pre>-A INPUT -i lo -j ACCEPT\r\n-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\r\n-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT<\/pre>\n<p>These are Allow entries. The port 22 one allows you to connect via SSH. Make sure you don&#8217;t delete this one. To add more entries, you&#8217;d type:<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">\r\nsudo iptables -I INPUT 4 -p tcp --dport 25 -j ACCEPT\r\nsudo iptables -I INPUT 5 -p tcp --dport 143 -j ACCEPT\r\nsudo iptables -I INPUT 6 -p tcp --dport 465 -j ACCEPT\r\nsudo iptables -I INPUT 7 -p tcp --dport 587 -j ACCEPT\r\nsudo ip6tables -I INPUT 4 -p tcp --dport 25 -j ACCEPT\r\nsudo ip6tables -I INPUT 5 -p tcp --dport 143 -j ACCEPT\r\nsudo ip6tables -I INPUT 6 -p tcp --dport 465 -j ACCEPT\r\nsudo ip6tables -I INPUT 7 -p tcp --dport 587 -j ACCEPT\r\n<\/pre>\n<p>The number after the INPUT argument tells where in the order of Allow entries it should be added. So if you have a lot of Allow entries, such as for port 80 and port 443 and maybe 1521 (Oracle) and 5432 (PostgreSQL), you may want to place them further down the list, and you&#8217;d raise that number appropriately. You can do<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo iptables -S<\/pre>\n<p>To check your work. Once you are satisfied, save the settings with<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo service netfilter-persistent save<\/pre>\n<p>If you don&#8217;t use this command, once you reboot, none of your changes are saved, which is actually handy if you screw something up. If you just added an entry twice or added it in the wrong order and wish to delete it, you can do<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo iptables -D INPUT -p tcp -m tcp --dport 143 -j ACCEPT<\/pre>\n<p>And obviously substitute the port you want to delete for the 143. Don&#8217;t forget to run the same command with ip6tables if you want to delete it there as well.\u00a0 Save your settings with netfilter-persistent save.<\/p>\n<h3 id=\"Application-Setup\">Application Setup<\/h3>\n<h4 id=\"Mailutils\">Mailutils<\/h4>\n<p>This is a set of tools for sending and reading mail from the command line. You can use it to test to see if your Postfix installation and mailboxes are set up correctly. Linux has a built-in mail command. So, why Mailutils? The built-in mail command only reads form \/var\/mail\/$USER, and we would like to keep our mail in \/home\/$USER\/Maildir so that it is more compatible with our endpoint app, like Window 10&#8217;s Mail app, or Thunderbird, which use a folder structure, rather than keeping all mail in a single file. Let&#8217;s configure this.<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo apt-get install mailutils<\/pre>\n<p>Thence, create the file&#8230;<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo nano \/etc\/mailutils.conf<\/pre>\n<p>And fill it with&#8230;<\/p>\n<pre>mailbox {\r\n  # Create mailbox url using pattern.\r\n  mailbox-pattern \"maildir:\/\/\/home\/${user}\/Maildir\";\r\n}<\/pre>\n<p>You will also need to change PAM so when you log in it will look in this new location.<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo nano \/etc\/pam.d\/sshd<\/pre>\n<p>Change<\/p>\n<pre>session    optional     pam_mail.so standard noenv # [1]<\/pre>\n<p>to:<\/p>\n<pre>session    optional     pam_mail.so dir=~\/Maildir standard noenv # [1]<\/pre>\n<h4 id=\"Postfix\">Postfix<\/h4>\n<p>This is the majority of the mail server, and it requires the most configuration. Start by installing it.<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo apt-get install postfix<\/pre>\n<p>Whether or not it is already installed, you&#8217;ll need to run its configuration tool.<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo dpkg-reconfigure postfix<\/pre>\n<pre>General type of mail configuration: <strong>Internet Site<\/strong>\r\nSystem mail name: <strong>example.com<\/strong>\r\nRoot and postmaster mail recipient: <strong>john.doe<\/strong>\r\nOther Destinations to accept mail for (blank for none): <strong>$myhostname, $myhostname.$mydomain, $mydomain, localhost, localhost.localdomain<\/strong>\r\nForce synchronous update on mail queue?: <strong>&lt;No&gt;<\/strong>\r\nLocal networks: <strong>127.0.0.0\/8 [::ffff:127.0.0.0]\/104 [::1]\/128<\/strong>\r\nUse procmail for local delivery? <strong>&lt;No&gt;<\/strong>\r\nMailbox size limit (bytes): <strong>0<\/strong>\r\nLocal address extension character: <strong>+<\/strong>\r\nInternet protocols to use: <strong>all<\/strong><\/pre>\n<p>john.doe is the administrator of this machine.\u00a0 You should substitute your main account for this username.<\/p>\n<p>There is a lot more configuration to come.\u00a0 No worries, if you want to have a basic level of security, paste in the following, substituting your own domain for example.com.\u00a0 If you haven&#8217;t set up a real wildcard CA-signed cert as I wrote about earlier, make sure your <strong>smptd_tls_cert_file<\/strong> and <strong>smtpd_tls_key_file<\/strong> point to the appropriate files.\u00a0 You would also omit the\u00a0<strong>smtpd_tls_CAfile<\/strong> line since self-signed SSL certificates do not have a Certificate Authority (CA).<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">\r\nsudo postconf -e 'mydomain = example.com'\r\nsudo postconf -e 'home_mailbox = Maildir\/'\r\nsudo postconf -e 'smtpd_sasl_type = dovecot'\r\nsudo postconf -e 'smtpd_sasl_path = private\/auth'\r\nsudo postconf -e 'smtpd_sasl_local_domain ='\r\nsudo postconf -e 'smtpd_sasl_security_options = noanonymous'\r\nsudo postconf -e 'broken_sasl_auth_clients = yes'\r\nsudo postconf -e 'smtpd_sasl_auth_enable = yes'\r\nsudo postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination'\r\nsudo postconf -e 'smtp_tls_security_level = may'\r\nsudo postconf -e 'smtpd_tls_security_level = may'\r\nsudo postconf -e 'smtpd_tls_protocols = !SSLv2, !SSLv3'\r\nsudo postconf -e 'smtp_tls_note_starttls_offer = yes'\r\nsudo postconf -e 'smtpd_tls_cert_file = \/etc\/letsencrypt\/live\/example.com\/cert.pem'\r\nsudo postconf -e 'smtpd_tls_key_file = \/etc\/letsencrypt\/live\/example.com\/privkey.pem'\r\nsudo postconf -e 'smtpd_tls_CAfile = \/etc\/letsencrypt\/live\/example.com\/fullchain.pem'\r\nsudo postconf -e 'smtpd_tls_loglevel = 1'\r\nsudo postconf -e 'smtpd_tls_received_header = yes'\r\n<\/pre>\n<p>&nbsp;<\/p>\n<p>I won&#8217;t go over all of this, but the <strong>smtpd_tls_protocols<\/strong> says that we will only be accepting TLS connections, which are currently the most secure, <strong>home_mailbox<\/strong> sets us up to use the same Maildir directory that we configured for Mailutils earlier, which is more modern than keeping all users in a central \/var\/mail\/$USER file, and <strong>smtpd_sasl_type<\/strong> sets us up to use Dovecot, which I&#8217;ll be going over in the next section.<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo nano master.cf<\/pre>\n<p>Uncomment the following lines (delete the prefixing #)<\/p>\n<pre>submission inet n       -       y       -       -       smtpd\r\n  -o syslog_name=postfix\/submission\r\n  -o smtpd_tls_security_level=encrypt\r\n  -o smtpd_sasl_auth_enable=yes\r\n  -o smtpd_tls_auth_only=yes<\/pre>\n<p>And<\/p>\n<pre>smtps     inet  n       -       y       -       -       smtpd\r\n  -o syslog_name=postfix\/smtps\r\n  -o smtpd_tls_wrappermode=yes\r\n  -o smtpd_sasl_auth_enable=yes<\/pre>\n<p>This enables both the SMTPS and submission services, which are used to sent mail via an MUA app (mail app) and submit mail on behalf of other apps (e.g. Node.js apps).<\/p>\n<p>Let&#8217;s add a few aliases to \/etc\/aliases because root cannot receive mail by default on modern systems<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo nano \/etc\/aliases<\/pre>\n<p>Replace its content with the following<\/p>\n<pre>mailer-daemon: postmaster\r\npostmaster: root\r\nnobody: root\r\nhostmaster: root\r\nusenet: root\r\nnews: root\r\nwebmaster: root\r\nwww: root\r\nftp: root\r\nabuse: root\r\nroot: john.doe<\/pre>\n<p>Replace john.doe with the user doing this configuration.<\/p>\n<p>Restart Postfix to activate the changes with the following command<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo systemctl restart postfix.service<\/pre>\n<p>You are ready to test it with Mailutils to see if mail gets delivered. Send some to yourself. If your username is john.doe, try<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">\r\necho &quot;mail body&quot;| mail -r &quot;john.doe@example.com&quot; -s &quot;test mail&quot; john.doe\r\nmail\r\n<\/pre>\n<p>You can also try sending mail to other users on the same machine, with the exception of root, who will not receive it, for security purposes.<\/p>\n<p>If it arrived, you&#8217;ll see it listed in the mail command line utility. You can read it by typing its number and then enter, e.g. <strong>1<\/strong>, and then delete it with <strong>d1<\/strong> and then exit with <strong>q<\/strong>. You also should now have a directory called Maildir under \/home\/john.doe. We changed it from \/var\/mail\/john.doe because Dovecot defaults to this newer convention.<\/p>\n<h4 id=\"Dovecot\">Dovecot<\/h4>\n<p>The final step. Install it and a couple of necessary accessories with the following command<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo apt-get install dovecot dovecot-imapd dovecot-pop3d<\/pre>\n<p>Now edit three configuration files for it<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo nano \/etc\/dovecot\/conf.d\/10-master.conf<\/pre>\n<p>Find the section <strong>Postfix smtp-auth<\/strong> and uncomment and change it as follows<\/p>\n<pre># Postfix smtp-auth\r\nunix_listener \/var\/spool\/postfix\/private\/auth {\r\n  mode = 0660\r\n  user = postfix\r\n  group = postfix\r\n}<\/pre>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo nano \/etc\/dovecot\/conf.d\/10-mail.conf<\/pre>\n<p>Change the <strong>mail_location<\/strong> to match that which we set up for Mailutils earlier<\/p>\n<pre>mail_location = mbox:~\/mail:INBOX=\/var\/mail\/%u<\/pre>\n<p>becomes<\/p>\n<pre>mail_location = maildir:~\/Maildir:LAYOUT=fs<\/pre>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo nano \/etc\/dovecot\/conf.d\/10-auth.conf<\/pre>\n<p>Change the <strong>auth_mechanisms<\/strong> to add the login option (basic encryption)<\/p>\n<pre>auth_mechanisms = plain<\/pre>\n<p>becomes<\/p>\n<pre>auth_mechanisms = plain login<\/pre>\n<p>And finally update Dovecot&#8217;s certificates and the protocols it will support<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo nano \/etc\/dovecot\/conf.d\/10-ssl.conf<\/pre>\n<p>Change the lines<\/p>\n<pre>ssl_cert = &lt;\/etc\/dovecot\/private\/dovecot.pem\r\nssl_key = &lt;\/etc\/dovecot\/private\/dovecot.key<\/pre>\n<p>to<\/p>\n<pre>ssl_cert = &lt;\/etc\/letsencrypt\/live\/jogerfy.com\/fullchain.pem \r\nssl_key = &lt;\/etc\/letsencrypt\/live\/jogerfy.com\/privkey.pem<\/pre>\n<p>and the line<\/p>\n<pre>ssl_protocols = !SSLv3<\/pre>\n<p>to<\/p>\n<pre>ssl_protocols = !SSLv2, !SSLv3<\/pre>\n<p>Now restart Dovecot<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo systemctl restart dovecot<\/pre>\n<p>Now you can hook up modern mail apps to it, such as Windows 10&#8217;s Mail. Try this.<br \/>\n<em>Settings-&gt;Manage accounts-&gt;Add an account-&gt;Advanced setup-&gt;Internet email<\/em><br \/>\nEnter your settings like so<\/p>\n<pre>Email address: <strong>john.doe@example.com\r\n<\/strong>User name: <strong>john.doe<\/strong>\r\nPassword: <strong>&lt;john.doe's Linux account password&gt;<\/strong>\r\nAccount name: <strong>john.doe@example.com<\/strong>\r\nSend your messages using this name: <strong>John Doe<\/strong>\r\nIncoming mail server: <strong>imap.example.com<\/strong>\r\nAccount type: <strong>IMAP4<\/strong>\r\nOutgoing (SMTP) email server: <strong>smtp.example.com<\/strong>\r\n\u2611 Outgoing server requires authentication\r\n\u2611 Use the same user name and password for sending mail\r\n\u2611 Require SSL for incoming email\r\n\u2611 Require SSL for outgoing mail\r\n<\/pre>\n<p>Note that <strong>imap.example.com<\/strong> and <strong>smtp.example.com<\/strong> are the same server. In the earlier section on setting up DNS records I mentioned that we added an A record that pointed *.example.com to a single IP address. If you did not do this, please point it to the actual server name. If you are using a self-signed SSL certificate, this will still work, but you will have to click through some warnings in Mail, and you&#8217;ll have to have your mail servers referenced in your machine&#8217;s host file. If you&#8217;re using Linux, add them to <strong>\/etc\/hosts<\/strong>, and if you&#8217;re using Windows, add them to <strong>C:\\Windows\\SYSTEM32\\drivers\\etc\\hosts<\/strong><br \/>\n.<\/p>\n<p>You&#8217;ll have to give yourself permission to edit the file under Windows first, then add an entry like this, substituting the machine&#8217;s IP on your local home network.<\/p>\n<pre>192.168.0.128  imap.example.lcl  smtp.example.lcl<\/pre>\n<p>If everything is set up correctly on a public facing server with DNS records, you should be able to email from the account to outside addresses, receive email. And even on a home server you should at least be able to email other users on the same server, and see the messages both from Mail and the command line mail utility, and see deleted messages disappearing in both. If not, read on to the next section.<\/p>\n<h3 id=\"Troubleshooting\">Troubleshooting<\/h3>\n<p>I must have hit every branch on the tree on the way down to getting this working, and without the following tools, I never would have been able to figure out what I was doing wrong:<\/p>\n<h4 id=\"log-files\">log files<\/h4>\n<p>This is the first and most important tool. It told me Gmail was rejecting my mails and how to fix that.<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sudo tail \/var\/log\/mail.err\r\nsudo tail \/var\/log\/mail.log<\/pre>\n<h4 id=\"nmap\">nmap<\/h4>\n<p>This can tell you whether your ports are open in the firewall, and if they&#8217;re available but &#8220;closed,&#8221; they likely are missing a backend service. I found out I didn&#8217;t have the dovecot-imapd and dovecot-pop3d packages installed this way because I had port 465 and 587 open in iptables but closed in nmap.<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">nmap localhost<\/pre>\n<h4 id=\"sslscan\">sslscan<\/h4>\n<p>This can tell you what ciphers your server accepts on a specific port. SSLv3 ciphers on down are no longer considered secure enough, so you should only be seeing TLS ciphers.<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">sslscan localhost:465<\/pre>\n<h4 id=\"dig\">dig<\/h4>\n<p>This can be run from a faraway server to see if MX or other types of records have propagated yet.<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">dig MX example.com +short<\/pre>\n<p>Should return the DNS entry to route mail to a particular server.<\/p>\n<h4 id=\"openssl\">openssl<\/h4>\n<p>The most complex command here, openssl will tell you if something is running on a port at all, if it has auth_mechanisms of plain or login or anything else, and if a user can be authenticated on a particular port using a username and password. One example is<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">openssl s_client -crlf -connect localhost:465<\/pre>\n<p>Then type in<\/p>\n<pre class=\"brush: bash; light: true; title: ; notranslate\" title=\"\">EHLO localhost<\/pre>\n<p>And you should see, among other things<\/p>\n<pre>250-AUTH PLAIN LOGIN\r\n250-AUTH=PLAIN LOGIN<\/pre>\n<p>If you don&#8217;t, there is a problem upstream. Type QUIT to exit.<\/p>\n<hr \/>\n<h3 id=\"References\">References<\/h3>\n<p>Networking Setup<\/p>\n<ul>\n<li><a href=\"https:\/\/mediatemple.net\/community\/products\/dv\/204404314\/how-can-i-create-an-spf-record-for-my-domain\">https:\/\/mediatemple.net\/community\/products\/dv\/204404314\/how-can-i-create-an-spf-record-for-my-domain<\/a><\/li>\n<li><a href=\"https:\/\/www.kitterman.com\/spf\/validate.html\">https:\/\/www.kitterman.com\/spf\/validate.html<\/a><\/li>\n<\/ul>\n<p>Application Setup<\/p>\n<ul>\n<li><a href=\"https:\/\/help.ubuntu.com\/lts\/serverguide\/postfix.html.en\">https:\/\/help.ubuntu.com\/lts\/serverguide\/postfix.html.en<\/a><\/li>\n<li><a href=\"https:\/\/help.ubuntu.com\/community\/PostfixBasicSetupHowto\">https:\/\/help.ubuntu.com\/community\/PostfixBasicSetupHowto<\/a><\/li>\n<li><a href=\"https:\/\/www.tecmint.com\/install-postfix-mail-server-with-webmail-in-debian\/\">https:\/\/www.tecmint.com\/install-postfix-mail-server-with-webmail-in-debian\/<\/a><\/li>\n<li><a href=\"https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-set-up-a-postfix-e-mail-server-with-dovecot\">https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-set-up-a-postfix-e-mail-server-with-dovecot<\/a><\/li>\n<li><a href=\"https:\/\/mailutils.org\/manual\/html_node\/mailbox-statement.html\">https:\/\/mailutils.org\/manual\/html_node\/mailbox-statement.html<\/a><\/li>\n<\/ul>\n<p>Troubleshooting<\/p>\n<ul>\n<li><a href=\"https:\/\/superuser.com\/questions\/1119892\/no-mail-message-after-logging-into-vps-even-though-i-uninstalled-mailutils-a\/1119920\">https:\/\/superuser.com\/questions\/1119892\/no-mail-message-after-logging-into-vps-even-though-i-uninstalled-mailutils-a\/1119920<\/a><\/li>\n<li><a href=\"https:\/\/talk.plesk.com\/threads\/solved-postfix-mail-for-domain-com-loops-back-to-myself.329459\/\">https:\/\/talk.plesk.com\/threads\/solved-postfix-mail-for-domain-com-loops-back-to-myself.329459\/<\/a><\/li>\n<li><a href=\"https:\/\/superuser.com\/questions\/109213\/how-do-i-list-the-ssl-tls-cipher-suites-a-particular-website-offers\">https:\/\/superuser.com\/questions\/109213\/how-do-i-list-the-ssl-tls-cipher-suites-a-particular-website-offers<\/a><\/li>\n<li><a href=\"https:\/\/serverfault.com\/questions\/670348\/how-to-force-a-own-set-of-ciphers-in-postfix-2-11\">https:\/\/serverfault.com\/questions\/670348\/how-to-force-a-own-set-of-ciphers-in-postfix-2-11<\/a><\/li>\n<li><a href=\"https:\/\/wiki.zimbra.com\/wiki\/Simple_Troubleshooting_For_SMTP_Via_Telnet_And_Openssl\">https:\/\/wiki.zimbra.com\/wiki\/Simple_Troubleshooting_For_SMTP_Via_Telnet_And_Openssl<\/a><\/li>\n<li><a href=\"https:\/\/www.saotn.org\/test-smtp-authentication-starttls\/\">https:\/\/www.saotn.org\/test-smtp-authentication-starttls\/<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/nodemailer\/nodemailer\/issues\/165\">https:\/\/github.com\/nodemailer\/nodemailer\/issues\/165<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>In this post I will tell you how to set up your own mail server using Postfix and Dovecot.\u00a0 Postfix functions as a Mail Delivery Agent (MDA), so any apps you have running on the server can send out emails, and Dovecot functions as a Mail Transfer Agent (MTA), which lets you hook up a &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/www.stauber.org\/index.php\/2018\/12\/03\/setting-up-your-own-mail-server-postfix-dovecot-mailutils\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Setting Up Your Own Mail Server (Postfix, Dovecot, Mailutils)&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-11","post","type-post","status-publish","format-standard","hentry","category-computing"],"_links":{"self":[{"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/posts\/11","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/comments?post=11"}],"version-history":[{"count":46,"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/posts\/11\/revisions"}],"predecessor-version":[{"id":88,"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/posts\/11\/revisions\/88"}],"wp:attachment":[{"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/media?parent=11"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/categories?post=11"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/tags?post=11"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}