2017-10-14-spam-or-ham.en.md (6022B)
1 +++
2 title = "Spam or Ham"
3 draft = false
4 date = 2017-10-14
5 slug = "spam-or-ham"
6 +++
7
8 As planned, I am documenting my mail server setups. Setting up the mail server is probably documented everywhere, but I had to put in some effort make my setup secure enough to prevent it from been mistaked as spam.
9
10
11 ## Setting up the mail server {#setting-up-the-mail-server}
12
13 I really don't see how I can write anything better than [this tutorial](http://www.netarky.com/programming/arch%5Flinux/Arch%5FLinux%5Fmail%5Fserver%5Fsetup%5F1.html), so I will just document some of the steps that seemed missing from the tutorial.
14
15
16 ### Setting DNS Record {#setting-dns-record}
17
18 Before anything, I needed to setup my DNS record. I created an `A` record for my mail server address, and added a `MX` record indicating the mail will be handled by the mail server.
19
20
21 ### Creating `Maildir` {#creating-maildir}
22
23 After setting up `postfix` for the first time, I needed to setup the `Maildir` manually and giving it appropriate permissions:
24
25 ```sh
26 $ mkdir -p /home/<username>/Maildir/{cur,new,tmp}
27 $ chown <username> /home/<username>/Maildir/{,cur,new,tmp}
28 $ chmod 0755 /home/<username>/Maildir/{,cur,new,tmp}
29 ```
30
31
32 ### SSL Certificate {#ssl-certificate}
33
34 In stead of using the built-in certificate generators in `dovecot`, I choose to use the same SSL certificate for my website. I added my mail server address to the `server_name` field in `/etc/nginx/nginx.conf` and generated my certificate with `certbot`. After that, I simply changed `/etc/dovecot/conf.d/10-ssl.conf` for `dovecot` :
35
36 ```sh
37 use_ssl = yes
38 ssl_cert = </path/to/fullchain.pem
39 ssl_key = </path/to/privkey.pem
40 ```
41
42 Similarly for `postfix` I also used this certificate. Do note that `dovecot` and `postfix` should be run as `root` to have read permissions to read these certificates.
43
44
45 ### Mail Client {#mail-client}
46
47 I am using Thunderbird as my mail client and for receiving mail. I used SSL/TLS while for sending mail, I needed to set STARTTLS.
48
49
50 ## Security Measures {#security-measures}
51
52 After completing the email setup, I immediately tested the server by sending test emails, only to find them been tossed straight into spam by gmail. It seems that gmail has a new feature that shows the security check status on the email (accessible by 'View Original'). These measures include SPF, DKIM and DMARC. My avatar showed up as an octagon with a question mark, indicating the mail server failing the basic SPF check. In order to avoid this, I took a bunch of security measures to tick all the boxes from email security test sites like [intodns](https://intodns.com) and [mxtoolbox](https://mxtoolbox.com).
53
54
55 ### Sender Policy Framework (SPF) {#sender-policy-framework--spf}
56
57 An SPF TXT record documents the allowed servers to send emails on behalf of this address. In my case where only mail servers documented in the MX TXT record are used, I simply put in:
58
59 ```sh
60 v=spf1 mx -all
61 ```
62
63
64 ### DomainKeys Identified Mail (DKIM) {#domainkeys-identified-mail--dkim}
65
66 I am using `opendkim` to sign and verify that emails are indeed from my server. After installing the `opendkim` package, I followed the instruction in [Arch Wiki](https://wiki.archlinux.org/index.php/OpenDKIM). First copy example configuration file from `/etc/opendkim/opendkim.conf.sample` to `/etc/opendkim/opendkim.conf` and edit (socket selection can be arbitrary):
67
68 ```sh
69 Domain <domainname>
70 KeyFile /path/to/keys.private
71 Selector <myselector>
72 Socket inet:<dkimsocket>@localhost
73 UserID opendkim
74 Conicalization relaxed/simple
75 ```
76
77 Next, in the specified keyfile directory (the default is `/var/db/dkim/`), generate keys with:
78
79 ```sh
80 $ opendkim-genkey -r -s <myselector> -d <domainname> --bits=2048
81 ```
82
83 Along with the generated `.private` file is a `.txt` file with the necessary TXT record for DKIM. It basically posts the public key for your mail server. Note that the TXT record may need to be broke down into several strings to comply with the 255 character limit. To check if the TXT record has been properly setup, I used (requires package `dnsutils` ):
84
85 ```sh
86 $ host -t TXT <myselector>._domainkey.<domainname>
87 ```
88
89 The final step would be to start the `opendkim` service and make sure `postfix` performs the encryption upon sending email. Edit `/etc/postfix/main.cf` to be:
90
91 ```sh
92 non_smtpd_milters=inet:127.0.0.1:<dkimsocket>
93 smtpd_milters=inet:127.0.0.1:<dkimsocket>
94 ```
95
96 After reloading `postfix`, DKIM should be in effect.
97
98
99 ### Domain-based Message Authentication, Reporting and Conformance (DMARC) {#domain-based-message-authentication-reporting-and-conformance--dmarc}
100
101 Without surprise, there is a package `opendmarc` that implements DMARC and there is also an [Arch Wiki](https://wiki.archlinux.org/index.php/OpenDMARC) page for it. Do note that this would require SPF and DKIM to be setup first. After installation, I edited `/etc/opendmarc/opendmarc.conf`:
102
103 ```sh
104 Socket inet:<dmarcsocket>@localhost
105 ```
106
107 After starting the service, enable DMARC filter in `postfix` (separate with comma):
108
109 ```sh
110 non_smtpd_milters=inet:127.0.0.1:<dkimsocket>, inet:127.0.0.1:<dmarcsocket>
111 smtpd_milters=inet:127.0.0.1:<dkimsocket>, inet:127.0.0.1:<dmarcsocket>
112 ```
113
114 The final step is to add a DMARC TXT record in DNS settings as detailed on Arch Wiki page and reload `postfix`.
115
116
117 ## Ticking the Boxes {#ticking-the-boxes}
118
119 I tested my server by sending test email to `check-auth@verifier.port25.com` and everything seems to be working. Not to mention that my email no longer gets classified as spam by gmail and I can see my emails passing SPF, DKIM and DMARC checks in 'View Original'. I also get an detailed daily report from gmail due to DMARC. At this point, I am pretty comfortable about ditching all my previous gmail addresses and sticking to my own email. I am also looking into options of self-hosting calenders. Hopefully in the near future I can completely ditch Google for my essential communication needs.