Postfix

References

• Postfix Configuration Parameters.

• local_recipient_maps
• luser_relay

• ADDRESS_REWRITING_README — Postfix Address Rewriting
• LOCAL_RECIPIENT_README — Rejecting Unknown Local Recipients with Postfix

Installation

Server

TBC

SRS

See Configuration Noekeon.org.

DKIM

Install

See this excellent guide on digitalocean.com.

vi /etc/opendkim.conf
vi /etc/default/opendkim
vi /etc/postfix/main.cf
umask 022
mkdir -p /etc/opendkim/keys/noekeon.org
vi /etc/opendkim/TrustedHosts
vi /etc/opendkim/KeyTable
vi /etc/opendkim/SigningTable
cd /etc/opendkim/keys/noekeon.org
opendkim-genkey -s mail -d noekeon.org
chown opendkim:opendkim mail.private
# Make sure that all other files / directory are world readable
cat mail.txt
service postfix restart
service opendkim restart

We verify that it works correctly:

• To check domain key validity, visit http://dkimcore.org/tools/keycheck.html.
• To verify that DKIM is correctly configured, send a mail to check-auth@verifier.port25.com. You should see DKIM check:pass.

Alternatively, send a mail to a gmail account under your control, and check in email's headers that dkim=pass is present in the Authentication-Results header field.

Troubleshoot - ... not internal, ... not authenticated

... It doesn't! We get dkim=neutral.

Checking the logs, we have:

grep opendkim /var/log/mail.info
# ...
# May  6 18:21:17 ober rmilter[14579]: <323cc8a125>; msg done: queue_id: <092462225F>; message id: <>; ip: 91.134.134.85; from: <mip.opendkim@noekeon.org>; rcpt: <check-auth@verifier.port25.com> ...
# May  6 18:21:17 ober opendkim[24890]: 092462225F: prime.immie.org [91.134.134.85] not internal
# May  6 18:21:17 ober opendkim[24890]: 092462225F: not authenticated
# ...

Same issue is found in GitHub issue report. Opendkim thinks that user is not authenticated. This is because postfix does not forward macro {auth_type} to opendkim milter. We edit /etc/postfix/main.cf:

--- a/postfix/main.cf
+++ b/postfix/main.cf
@@ -159,7 +159,7 @@ smtpd_milters = inet:127.0.0.1:9900, inet:127.0.0.1:12301
 non_smtpd_milters = inet:127.0.0.1:12301
 milter_default_action = accept
 milter_protocol = 6
-milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
+milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen} {auth_type}

Then restart the service:

service opendkim status

Now it works!

DMARC

See dmarc.org. DMARC is suggested by GMail Bulk Senders Guidelines.

Aliases

Add static aliases in default configuration

• Edit /etc/aliases
• Then run newaliases:

newaliases

Uses regexp (dynamic) aliases

Edit file /etc/postfix/main.cf as follows [1]:

alias_maps = regexp:/etc/postfix/aliases-regexp

Then create /etc/postfix/aliases-regexp as follows:

/^tom\..*@domain.com$/     tom@other.com
/^phil\..*@domain.com$/    phil@other.com

Troubleshooting

Debugging aliases

Use postmap:

postmap -q mip@prime.immie.org hash:/etc/aliases regexp:/etc/aliases-regexp
postmap -q mip hash:/etc/aliases regexp:/etc/aliases-regexp

Handling deferred mail / message queue

Reference:

• Inspecting Postfix’s email queue

View the queue

mailq                        # ... or ...
postqueue -p

View a message

postcat -vq XXXXXXXXXX       # Replace XXXXXXXXXX with message ID

Process the queue now

postqueue -f                 # ... or ...
postfix flush

Delete the queue

postsuper -d ALL
postsuper -d ALL deferred    # Delete only deferred messages