Mail server

Mail server setup

I have decided to set up my mail server based on postfix and dovecot. However, for future setups, exim was recommended to me; apparently would've saved me a bunch of pain.

Online tutorials

My pride initially dictated me to try and figure everything out on my own, and that actually went okay for a while. However, at some point even I had to admit that it's actually more reasonable to just find a good online tutorial and Here's the one I ended up using for my dovecot setup, it's pretty good: Build Your Own Email Server on Ubuntu

Relevant DNS entries

There are some DNS entries that aren't strictly necessary for sending/receiving emails they're still highly relevant; unless you enjoy having your emails go straight to the junk folder instead of the inbox. Most of them are pretty straight forward to set yourself; just create a bunch of TXT type DNS entries via your domain registrar's website. The syntax is a bit obscure, but the logic for creating the most relevant DNS entries is pretty simple:

Hint: Find the actual entries for SPF, DMARC, and DKIM on the very useful MxToolbox! Note: The DKIM record is only one part of the DKIM setup; you also need to tell postfix to verify and sign DKIM, e.g. by setting OpenDKIM as a milter.

Reverse lookup entry

The only entry that you likely cannot create yourself is the PTR entry for reverse DNS lookups. To have that one set, you'll need to contact your ISP (not registrar) to associate your static public IP address with your domain name.

DNSSEC

Let's not talk about DNSSEC. I've looked very briefly at it, and decided to not do it. I don't give myself enough treats to actually go through that pain.

What makes it so hard?

As stated above, getting a basic local mail setup running that's not an open relay is actually pretty straight-forward. As soon as you want to allow non-local mail clients to connect to the server (via POP3, IMAP, SMTP) however, you need to use something like dovecot with LMTP, and the difficulty gets cranked up significantly. You'll need to deal with...

All the moving parts

First off, the full-fledged mail server setup consists of so. many. moving parts. There are mail (1), sendmail (1), procmail (1), local (8), postconf (5), and a few more. While their man pages go into great detail about each tool individually, they don't really give you an overview of the bigger picture. It's surprisingly hard to figure out the tools' interactions, and the implications of swapping out the individual parts.

The configuration...

The similars

There are a trillion different configuration options, and half of them differ in name by only one letter, making them very easy to get mixed up; e.g. smtp_tls_protocols vs. smtpd_tls_protocols. Even the configuration files are named very similarly: main.cf and master.cf! It took me much longer than I'd like to admit to realize I was just editing the wrong file... I just kept wondering wondering why none of my changes seemed to have any effect, and also why the online examples looked so different from my config file, even though the config options were basically the same... Also, wtf is that master.cf syntax?!

Obscure precedences

Half of the options also override each other via a sort of precedence system, and it's absolutely non-trivial to find out which settings do that and how... You better be very patient and methodical about reading the docs. An example here is the mail_spool_directory which does nothing if you've changed the home_mailbox or the mailbox_command. As part of setting up dovecot, I just set mailbox_transport = lmtp:unix:private/dovecot-lmtp and don't want to invest any more energy into checking out any of the other options.

Sane defaults? Not here!

Also, if you're a fan of sensible defaults, then you should better go elsewhere. There are (almost) no sensible presets for grouped configs.

So many protocols and ports

For receiving emails, we have two protocols; the older POP3 and the more modern IMAP alternative. Sending emails looks a bit simpler on the surface, since here we only have SMTP. Unfortunately however, we have three different choices how to use this protocol: simply as plain-text (bad idea), encrypted via TLS (SMTPS; good idea), or a bit of both via StartTLS. It certainly does not help that both basic options have different standard ports (SMTP including StartTLS on 587, SMTPS on 465). But there's also a distinction to be made between SMTP for clients to send emails (ports 465 and 587), as opposed to SMTP from servers to route emails around (port 25). Futher, IANA decided to revoke its assignment of port 465 for SMTPS and give this port away to another protocol... But about every mail client in existence still assumes that as the standard port for SMTPS and gets mildly confused if you claim something different.

Ports overview

If that port jungle made your head spin, here's a condensed overview (see also Wikipedia):