Configuring Postfix Mail Server for Multiple Domains: SPF, DKIM, and DMARC
Email deliverability is a critical aspect of running a successful online business. Properly configuring your Postfix mail server to send and receive emails for multiple domains can significantly improve your email deliverability rates. This article will cover the key concepts and steps required to configure SPF, DKIM, and DMARC for your Postfix mail server.
Setting up Postfix for Multiple Domains
Before diving into the specifics of SPF, DKIM, and DMARC, it's essential to ensure that your Postfix mail server is properly configured to handle multiple domains. This involves creating separate virtual mailbox maps and transport maps for each domain, as well as configuring the appropriate Postfix parameters.
# /etc/postfix/main.cf
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
relay_domains = domain1.com, domain2.com
virtual_mailbox_domains = hash:/etc/postfix/vmail_domains
virtual_mailbox_maps = hash:/etc/postfix/vmail_mailbox
transport_maps = hash:/etc/postfix/transport
Configuring SPF
Sender Policy Framework (SPF) is a simple email validation system designed to detect email spoofing. By adding an SPF record to your domain's DNS settings, you can specify which IP addresses are authorized to send emails on behalf of your domain. This helps prevent spammers from sending emails that appear to come from your domain, improving your email deliverability rates.
# /etc/postfix/main.cf
smtp_sender_dependent_authentication = yes
sender_dependent_relayhost_maps = hash:/etc/postfix/sender_relay
# /etc/postfix/sender_relay
domain1.com smtp:[192.168.1.10]:587
domain2.com smtp:[192.168.1.11]:587
# /etc/postfix/sasl_passwd
[192.168.1.10]:587 user1:password1
[192.168.1.11]:587 user2:password2
# /etc/postfix/sasl_passwd.db
[192.168.1.10]:587:SCRAM-SHA-256:user1:password1:$5$user1$salt
[192.168.1.11]:587:SCRAM-SHA-256:user2:password2:$5$user2$salt
Configuring DKIM
DomainKeys Identified Mail (DKIM) is a more advanced email validation system that uses public-key cryptography to verify the authenticity of email messages. By adding a DKIM signature to your emails, you can prove that they were sent by an authorized sender and have not been tampered with during transmission. This helps prevent phishing attacks and improves your email deliverability rates.
# /etc/opendkim.conf
Domain example.com
KeyFile /etc/opendkim/keys/example.com/mail.private
Selector mail
ExternalIgnoreList refile:/etc/opendkim/TrustedHosts
InternalHosts refile:/etc/opendkim/TrustedHosts
# /etc/postfix/main.cf
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891
Configuring DMARC
Domain-based Message Authentication, Reporting, and Conformance (DMARC) is a framework for email authentication, policy enforcement, and reporting. By adding a DMARC record to your domain's DNS settings, you can specify how your domain should handle emails that fail SPF or DKIM validation. This helps prevent phishing attacks and improves your email deliverability rates.
# /etc/postfix/main.cf
smtp_dmarc_align_override_domain_ok = yes
smtp_dmarc_align_override_host_ok = yes
smtp_dmarc_milter = dmarc-milter
# /etc/default/dmarc-milter
SOCKET=local:/var/run/dmarc-milter/dmarc-milter.sock
Setting up Reverse DNS
Reverse DNS (rDNS) is a system for mapping IP addresses to domain names. By setting up rDNS for your mail server's IP address, you can improve your email deliverability rates and prevent your emails from being flagged as spam. This involves creating a PTR record in your domain's DNS settings that points to your mail server's IP address.
- Configuring SPF, DKIM, and DMARC for your Postfix mail server can significantly improve your email deliverability rates.
- Setting up Postfix for multiple domains involves creating separate virtual mailbox maps and transport maps for each domain.
- Configuring SPF involves adding an SPF record to your domain's DNS settings that specifies which IP addresses are authorized to send emails on behalf of your domain.
- Configuring DKIM involves adding a DKIM signature to your emails using public-key cryptography to verify their authenticity.
- Configuring DMARC involves adding a DMARC record to your domain's DNS settings that specifies how your domain should handle emails that fail SPF or DKIM validation.
- Setting up rDNS involves creating a PTR record in your domain's DNS settings that points to your mail server's IP address.