Configuring a Postfix mail server to handle multiple domains securely requires implementing SPF, DKIM, and DMARC records alongside proper reverse DNS. This setup ensures email deliverability by verifying sender identity and preventing spoofing. The process involves adjusting Postfix main configurations, integrating OpenDKIM for signing, and defining domain-specific policies in DNS zones.
Understanding the Authentication Triad
Before modifying server files, it is essential to understand how these protocols work together. Sender Policy Framework (SPF) allows you to specify which IP addresses are authorized to send email on behalf of your domain. DomainKeys Identified Mail (DKIM) adds a digital signature to emails, allowing the receiver to verify that the email was indeed authorized by the owner of that domain. Domain-based Message Authentication, Reporting, and Conformance (DMARC) ties SPF and DKIM together, providing instructions to receiving servers on what to do if an email fails authentication checks. Without reverse DNS (PTR records) pointing back to your hostname, even valid SPF and DKIM records may be ignored by strict receivers.
Installing and Configuring OpenDKIM
OpenDKIM is the standard milter for generating DKIM signatures. Install the package using your distribution’s package manager. After installation, you must configure the daemon to listen on a local socket. Create a directory structure for your keys, such as
/etc/opendkim/keys, and generate a selector-specific key pair for each domain or use a common selector. The configuration file
/etc/opendkim.conf should define the signing table, key table, and socket location. Ensure the
Socket directive points to
local:/var/run/opendkim/opendkim.sock. This socket will be used by Postfix to communicate with the milter.
Integrating OpenDKIM with Postfix
Postfix must be instructed to use the OpenDKIM milter. In
/etc/postfix/main.cf, add the following directives. These lines tell Postfix to connect to the local socket defined earlier. It is critical to set the correct protocol version and action on failure.
milter_default_action = accept
milter_protocol = 2
smtpd_milters = local:/var/run/opendkim/opendkim.sock
non_smtpd_milters = $smtpd_milters
The
milter_protocol = 2 setting specifies the SMTP milter protocol version, which is required for modern compatibility. The
milter_default_action = accept ensures that if the milter service is temporarily unavailable, mail is still accepted rather than bounced, preventing delivery failures during maintenance. Do not use
reject for the default action unless you have high availability configured, as this can cause significant bounce rates. For further details on routing logic, see
Correctly Using Postfix Virtual Aliases for Email Routing.
Domain-Specific Configuration
For multiple domains, you need a mapping strategy. Create a
KeyTable file that maps selectors to private key paths. For example:
default._domainkey.example.com example.com:default:/etc/opendkim/keys/example.com/default.private. Similarly, create a
SigningTable to map sending addresses to selectors. A common approach is to use a wildcard entry like
*@example.com default._domainkey.example.com to sign all outgoing mail from that domain. Restart both services after changes:
systemctl restart opendkim and
systemctl reload postfix. If you encounter issues with external recipients, check
Fixing Debian Postfix, Dovecot, and SpamAssassin: External Emails Not Accepted But Outgoing Mails Sent for related troubleshooting steps.
DNS Record Setup
On your DNS provider, add the necessary TXT records. For SPF, add a record containing
v=spf1 mx ip4:YOUR_SERVER_IP ~all. Adjust the mechanism based on whether you use additional relays. For DKIM, add a TXT record named
default._domainkey containing the public key generated by OpenDKIM. For DMARC, add a TXT record at
_dmarc with content like
v=DMARC1; p=none; rua=mailto:[email protected]. Start with
p=none to monitor results before enforcing rejection. Ensure your PTR record matches your HELO/EHLO hostname.
Verifying the Configuration
Use tools like
opendkim-testkey to verify your DKIM keys locally. Send test emails to services like Mail-Tester.com to validate the full chain. Check Postfix logs for any milter errors. Ensure that the
non_smtpd_milters directive is present so that queue processing also signs messages.
Frequently Asked Questions
Why are my emails still failing DKIM checks?
Check if the header tags are being stripped by intermediate servers or if the key size is too small. Ensure the public key in DNS exactly matches the one in the private key file without extra whitespace.
Can I use different selectors for different domains?
Yes, OpenDKIM supports multiple selectors. You simply need to update the KeyTable and SigningTable entries to map each domain’s address to its specific selector and key path.
What happens if OpenDKIM crashes while Postfix is running?
With
milter_default_action = accept, Postfix will continue to accept mail but will not sign it. This prevents service outages but may reduce deliverability until the milter is restored.
Do I need DMARC if I have SPF and DKIM?
DMARC is crucial for policy enforcement. While SPF and DKIM provide verification, DMARC tells receiving servers how to handle failed authentications and provides reporting data to help you monitor abuse.
How do I troubleshoot Postfix milter connection errors?
Verify that the socket permissions allow the Postfix user to access it. Check that OpenDKIM is listening on the correct socket path and that no firewall rules block local inter-process communication.