Monday, September 23, 2019

Ubuntu 18.04 email using postfix, dovecot, and opendkim

Most of these steps were taken from and modified for my purposes.  If you want more insight visit her website.

The following assumes you have already set up your webserver with apache2 and/or nginx, and secured the website with a Let's Encrypt certificate.



You can change your host name.  If you're using  this server as your mail server you might want to use a FQDN like  I used my domain name without the domain suffix.
$ sudo hostnamectl set-hostname your-domain
To verify changes relog-in and run the following
hostname -f


If you're using a mail server, set DNS records like the following:
Name: @; Type: MX; Content: Type: A; Content: your-ip
Install and configure postfix
$ sudo apt update
$ sudo apt install postfix -y
You will be prompted to answer some questions.
Type:  Internet Site 
System mail name:
Configure postfix.  Review the postfix main config file.
$ sudo nano /etc/postfix/
Review the following and edit as needed
myhostname =
mydomain =
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $mydomain, localhost.$mydomain, localhost;
relayhost =
mynetworks = [::ffff:]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
home_mailbox = Maildir/
Open the postfix master config file.
$ sudo nano /etc/postfix/
Add the submission section to the end of the file
submission     inet     n    -    y    -    -    smtpd
 -o syslog_name=postfix/submission
 -o smtpd_tls_security_level=encrypt
 -o smtpd_tls_wrappermode=no
 -o smtpd_sasl_auth_enable=yes
 -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
 -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
 -o smtpd_sasl_type=dovecot
 -o smtpd_sasl_path=private/auth
More edits to the postfix main config file.
$ sudo nano /etc/postfix/
Add the following to the end of the file
smtpd_tls_protocols = !SSLv2, !SSLv3 !TLSv1
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

Restart postfix service.
$ sudo systemctl restart postfix

Install and configure dovecot

$ sudo apt install dovecot-core dovecot-imapd
Edit the main dovecot config file.
$ sudo nano /etc/dovecot/dovecot.conf
Add the following to enable imap
protocols = imap
Configure authentication.
$ sudo nano /etc/dovecot/conf.d/10-auth.conf
Uncomment this line to disable plaintext authentication when there’s no SSL/TLS encryption.
disable_plaintext_auth = yes
Configure TLS.
$ sudo nano /etc/dovecot/conf.d/10-ssl.conf
Edit file to require SSL
ssl = required
Provide your SSL certificate addresses.
ssl_cert = </etc/letsencrypt/live/
ssl_key = </etc/letsencrypt/live/
SASL Authentication Between Postfix and Dovecot
$ sudo nano /etc/dovecot/conf.d/10-master.conf
Change service auth section.
service auth {
    unix_listener /var/spool/postfix/private/auth {
      mode = 0660
      user = postfix
      group = postfix
Auto create folders
$ sudo nano /etc/dovecot/conf.d/15-mailboxes.conf
Add auto = create to folders as you see fit. Example:
mailbox Trash {
    auto = create
    special_use = \Trash
Tell Dovecot to use Maildir.
$ sudo nano /etc/dovecot/conf.d/10-mail.conf 
Replace /etc/dovecot/conf.d/10-mail.conf with the following:
Restart services.
$ sudo systemctl restart dovecot
$ sudo systemctl restart postfix

Sender Policy Framework - SPF

Add a DNS record for SPF.
Name: @; Type: TXT; Content: v=spf1 mx ~all
There are several SPF tags and mechanisms.
You can invoke SPF checking for incoming email
sudo apt install postfix-policyd-spf-python
$ sudo nano /etc/postfix/
Add to the end of file.
policyd-spf  unix  -       n       n       -       0       spawn
    user=policyd-spf argv=/usr/bin/policyd-spf
Save, then open the main config file.
$ sudo nano /etc/postfix/
Add to the end of file
policyd-spf_time_limit = 3600
smtpd_recipient_restrictions =
   check_policy_service unix:private/policyd-spf
Save file then restart postfix service
$ sudo systemctl restart postfix


Install opendkim.
$ sudo apt install opendkim opendkim-tools
Add postfix to opendkim user group.
$ sudo gpasswd -a postfix opendkim
$ sudo nano /etc/opendkim.conf
Uncomment the following lines. Replace simple with relaxed/simple.
Canonicalization   relaxed/simple
Mode               sv
SubDomains         no
Add the following after Subdomains no.
AutoRestart         yes
AutoRestartRate     10/1M
Background          yes
DNSTimeout          5
SignatureAlgorithm  rsa-sha256
Add the following to the end of file. Ubuntu may already include the first section for UserID.
#OpenDKIM user
# Remember to add user postfix to group opendkim
UserID             opendkim

# Map domains in From addresses to keys used to sign messages
KeyTable           refile:/etc/opendkim/key.table
SigningTable       refile:/etc/opendkim/signing.table

# Hosts to ignore when verifying signatures
ExternalIgnoreList  /etc/opendkim/trusted.hosts

# A set of internal hosts whose mail should be signed
InternalHosts       /etc/opendkim/trusted.hosts
Save and close file.

Create Signing Table, Key Table and Trusted Hosts Files

Create directory structure.
$ sudo mkdir /etc/opendkim
$ sudo mkdir /etc/opendkim/keys
Change ownership and permissions.
$ sudo chown -R opendkim:opendkim /etc/opendkim
$ sudo chmod go-rw /etc/opendkim/keys
Create signing table.
$ sudo nano /etc/opendkim/signing.table
Add the following line.
Save and close.  Create key table.
$ sudo nano /etc/opendkim/key.table
Add the following line.
Save and close.  Create trusted hosts file
$ sudo nano /etc/opendkim/trusted.hosts
Add the following lines.

Create file structure.
$ sudo mkdir /etc/opendkim/keys/
Generate keys.
$ sudo opendkim-genkey -b 2048 -d -D /etc/opendkim/keys/ -s default -v
Change ownership of private key.
$ sudo chown opendkim:opendkim /etc/opendkim/keys/
Add Public Key in DNS Records. Get the key
$ sudo cat /etc/opendkim/keys/
The string after the p is the key. Add DNS record and add key string after the p:
Name:; Type: TXT; Content: v=DKIM1; k=rsa; p=KEYSTRINGHERE
$ sudo opendkim-testkey -d -s default -vvv
If the setup is good the response should be key OK .

Connect opendkim to postfix

Create directory structure.
$ sudo mkdir /var/spool/postfix/opendkim
$ sudo chown opendkim:postfix /var/spool/postfix/opendkim
Open conf file.
$ sudo nano /etc/opendkim.conf
Find this line.
Socket                  local:/var/run/opendkim/opendkim.sock
Replace with this.
Socket                local:/var/spool/postfix/opendkim/opendkim.sock
Save and close file. Open postfix main config file.
$ sudo nano /etc/postfix/
Add the following after smtpd_recipient_restriction.
# Milter configuration
milter_default_action = accept
milter_protocol = 6
smtpd_milters = local:/opendkim/opendkim.sock
non_smtpd_milters = $smtpd_milters
Save and close the file then restart opendkim and postfix.
$ sudo systemctl restart opendkim
$ sudo systemctl restart postfix
Check your spf and dkim set up by sending an email to the following.
$ [email protected]
You should get a response indicating is your setup has passed the checks


Set up a DMARC record in your DNS table similar to the following.
Name:; Type: TXT; Content: v=DMARC1; p=none; pct=100; fo=1; rua=mailto:[email protected]
The parameters are as follows:
v - DMARC version
p - policy (what to do with email that doesn't pass the dmarc test.
pct - The percentage of email the policy should be applied
fo - report preferences:     0 (default): generate reports if all underlying authentication mechanisms fail to produce a DMARC pass result
     1:  generate reports if any mechanisms fail.
     d:  generate report if DKIM signature failed to verify
     s: generate report if SPF failed
rua - the email address dmarc reports should be sent to
Check your dmarc set-up as follows
dig txt +short

Set up aliases

Open alias file
$ sudo nano /etc/aliases
Edit file as needed.
# See man 5 aliases for format postmaster: root abuse: root webmaster: root
admin: root root: account you want root email directed to


If you choose Thunderbird for email note the first time you open the Thunderbird program you need to change the default where Thunderbird looks for your inbound mail.  To do this, Enable the menu (right click at the top click box for menu bar or enter alt or F10).  Go to Edit>>Preferences>>Advanced. Find the section near the bottom where it says Message Store Type for new accounts click the down arrow and select File per message (maildir) .  Close the menu then proceed with adding new accounts.>