Set Up Postfix Send-Only SMTP Server on CentOS 8

 Use Case

You have a site/web application that necessities to send conditional messages to clients, (for example, secret key reset email). Doubtlessly, there's no requirement for clients to answer to these messages, or on the other hand in the event that they answer, the answer messages will be shipped off your devoted mail server. For this situation, you can set up a send-just SMTP server on the web server utilizing Postfix, which is a well known SMTP server programming.

Requirements

To send messages from your server, port 25 (outbound) should be open. Numerous ISPs and facilitating organizations, for example, DigitalOcean block port 25 to control spam. I suggest utilizing ScalaHosting, in light of the fact that it doesn't hinder port 25 (outbound). When you have a ScalaHosting server, introduce CentOS 8 on it, and adhere to the directions underneath.

Setting up Postfix send-just SMTP server for quite some time isn't troublesome really. To start with, we want to design it for one space, then, at that point, set it up for quite a long time.

Stage 1: Set Hostname and PTR Record

Of course, Postfix utilizes your server's hostname to recognize itself when speaking with other SMTP Servers. Some SMTP servers will dismiss your email if your hostname isn't legitimate. You should set a full-qualified doman name (FQDN) like beneath.

sudo hostnamectl set-hostname mta1.yourdomain.com

To check the hostname of your server, run command

hostname -f

You want to log out and log back in to see hostname change at the order brief. This hostname ought to have a DNS A record highlighting the IP address of your server.

Additionally, you want to establish a PTR standard (otherwise known as, pointer record), which maps an IP address to a FQDN. It's the partner to the A record. Numerous SMTP server will dismiss your email on the off chance that your server's IP address doesn't have PTR record.

Since you get IP address from your facilitating supplier or ISP, not from your area enlistment center, so you should establish PTR standard for your IP in the control board of your facilitating supplier, or ask your ISP. For instance, in ScalaHosting, you can establish PTR standard by opening a help ticket or utilize the live visit on their site. In spite of the fact that you can establish PTR standard to any hostname, for best practice, you should utilize the FQDN you recently set.

To check whether your PTR record is set appropriately, run the accompanying order. Supplant 12.34.56.78 with your own IP address.

host 12.34.56.78

Note that assuming your server utilizes IPv6 address, it's likewise really smart to add AAAA record for your FQDN and set PTR standard for your IPv6 address.

Step 2: Install Postfix on CentOS 8

Run the following commands to install Postfix from the default CentOS 8 repository.

sudo dnf update sudo dnf install postfix -y

Once it’s installed, start Postfix SMTP server.

sudo systemctl start postfix

And enable auto-start at boot time.

sudo systemctl enable postfix

Step 3: Configure Postfix

Setting the Postfix hostname

Of course, Postfix SMTP server utilizes the OS's hostname to distinguish itself when speaking with other SMTP server. Nonetheless, the OS hostname may change, so it's a decent practice to set the hostname straightforwardly in Postfix setup record with the accompanying order.

sudo postconf -e "myhostname = mta1.yourdomain.com"

Setting $mydomain Parameter

The $mydomain boundary indicates the local internet domain name. The default is to utilize $myhostname short the principal part. You can show the current worth of $mydomain with:

postconf mydomain

It should be your apex domain name, like

itinfs.com

If it’s not displaying your apex domain name, then set the $mydomain parameter with:

sudo postconf -e "mydomain = yourdomain.com"

Setting $myorigin Parameter

The $myorigin boundary indicates the default domain name that is annexed to source and beneficiary tends to that have no @domain part. The default is to utilize the worth of $myhostname, as should be visible with:

postconf myorigin

Output:

myorigin = $myhostname

You can change its value to yourdomain.com.

sudo postconf -e "myorigin = yourdomain.com"

Restarting Postfix

At last, we want to restart Postfix for the progressions to produce results.

sudo systemctl restart postfix

Step 4: Install and Configure OpenDKIM on CentOS 8

DKIM represents DomainKeys Identified Mail. You can introduce OpenDKIM on your server and use it to add marks to messages sent from your space, with your private key. Getting SMTP servers check the mark by utilizing the relating public key, which is distributed by you in the DNS. Adding DKIM mark is an unquestionable requirement on the off chance that you need your messages to get into the beneficiary's inbox.

Introduce OpenDKIM from the EPEL (Extra Packages for Enterprise Linux) store.

sudo dnf install epel-release

sudo dnf install opendkim perl-Getopt-Long

Edit OpenDKIM main configuration file.

sudo nano /etc/opendkim.conf

Find the following line.

Mode     v

Naturally, OpenDKIM runs in confirmation mode (v), which will check the DKIM sign of incomming email messages. We want to sign active messages, so change this line to the accompanying to empower signing mode.

Mode           sv

Track down the accompanying line and comment it out, in light of the fact that we will involve separate keys for every domain name.

KeyFile   /etc/opendkim/keys/default.private

Next, find the following 4 lines and uncomment them.

# KeyTable            /etc/opendkim/KeyTable

# SigningTable        refile:/etc/opendkim/SigningTable

# ExternalIgnoreList  refile:/etc/opendkim/TrustedHosts

# InternalHosts       refile:/etc/opendkim/TrustedHosts

Save and close the file.

Create Signing Table, Key Table and Trusted Hosts File

Edit the signing table file.

sudo nano /etc/opendkim/SigningTable

Add the accompanying line toward the finish of this file. This lets OpenDKIM know that assuming a shipper on your server is utilizing a @your-domain.com address, then, at that point, it ought to be endorsed with the private key recognized by mta1._domainkey.your-domain.com.

*@your-domain.com mta1._domainkey.your-domain.com

mta1 is the DKIM selector. An domain name may have various DKIM keys. The DKIM selector permits you to pick a specific DKIM key. You can involve whatever name for the DKIM selector. I believe it's advantageous to utilize the furthest left piece of the hostname as the DKIM selector. Save and close the file. Then, at that point, edit the key table file.

sudo nano /etc/opendkim/KeyTable

Add the following line, which specifies the location of the DKIM private key.

mta1._domainkey.your-domain.com     your-domain.com:mta1:/etc/opendkim/keys/your-domain.com/mta1.private

Save and close the file. Next, edit the trusted hosts file.

sudo nano /etc/opendkim/TrustedHosts

127.0.0.0.1 and ::1 are included in this file by default. Presently add the accompanying line. This lets OpenDKIM know that assuming an email is coming from your own domain name, then, at that point, OpenDKIM ought not perform DKIM check on the email.

*.your-domain.com

Save and close the file.

Generate Private/Public Keypair

Since DKIM is utilized to sign outgoing messages and check incoming messages, you really want to create a private key to sign outgoing messages and a public key for getting SMTP servers to confirm the DKIM mark of your email. Public key will be distributed in DNS.

Make a separate folder for the domain.

sudo mkdir /etc/opendkim/keys/your-domain.com

Generate keys using opendkim-genkey tool.

sudo opendkim-genkey -b 2048 -d your-domain.com -D /etc/opendkim/keys/your-domain.com -s mta1 -v

The above command will create 2048 bits keys. -d (domain) specifies the domain. -D (directory) specifies the directory where the keys will be stored. I use mta1 as the DKIM selector. Once the command is executed, the private key will be written to mta1.private file and the public key will be written to mta1.txt file.


By default, only root can read and write to the key files. Make opendkim as the owner of the private key.

sudo chown opendkim:opendkim /etc/opendkim/keys/ -R

Distribute Your Public Key in DNS Records

Display the public key

sudo cat /etc/opendkim/keys/your-domain.com/mta1.txt

The string after the p parameter is the public key.


In you DNS director, make a TXT record, enter mta1._domainkey in the name field. Then, at that point, return to the terminal window, copy everything in the parentheses and paste it into the value field of the DNS record. You need to delete all double quotes and line breaks in the value field. Assuming you don't erase them, then, at that point, key test in the subsequent stage will probably fail.


Test DKIM Key
Enter the following command on your CentOS 8 server to test your key.

sudo opendkim-testkey -d your-domain.com -s mta1 -vvv

If everything is OK, you will see the key OK message.

opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: checking key 'mta1._domainkey.linuxbabe.com'
opendkim-testkey: key OK

Assuming that you see "Key not secure", don't freeze. This is on the grounds that DNSSEC isn't empowered on your domain name. DNSSEC is a security standard for secure DNS query. Most domain names haven't empowered DNSSEC. You can keep on after this aide.

Now we can start the opendkim service.

sudo systemctl start opendkim

And enable auto-start at boot time.

sudo systemctl enable opendkim

OpenDKIM listens on 127.0.0.1:8891.

Step 5: Connect Postfix to OpenDKIM

Edit Postfix main configuration file.

sudo nano /etc/postfix/main.cf

Add the accompanying lines toward the finish of this file, so Postfix will actually want to call OpenDKIM through the milter protocol. Note that you should utilize 127.0.0.1 as the address. Try not to utilize localhost.

# Milter configuration

milter_default_action = accept

milter_protocol = 6

smtpd_milters = inet:127.0.0.1:8891

non_smtpd_milters = $smtpd_milters

Save and close the file. Then add postfix user to opendkim group.

sudo gpasswd -a postfix opendkim

Restart postfix service.

sudo systemctl restart postfix

Stage 6: Create SPF DNS Record

SPF (Sender Policy Framework) record indicates which hosts or IP addresses are permitted to send messages for a domain. In your DNS manager, make another TXT record like beneath. Use your own IPv4 address and IPv6 address of your server.

TXT  @   v=spf1 mx ip4:12.34.56.78 ip6:2600:3c01::f03c:93d8:f2c6:78ad ~all

Stage 7: Set the From Address, From Name and Return-Path

You can set custom From address, From name and Return-Path in your site/web application. We should involve WordPress for instance. You can add the accompanying lines in your WordPress theme’s functions.php record to supersede the default From address, From name and return-way. Supplant the red text as important.

// Function to change From email address

function wpb_sender_email( $original_email_address ) {

    return 'notifications@linuxbabe.com';

}

// Function to change sender name

function wpb_sender_name( $original_email_from ) {

    return 'LinuxBabe';

}

// Set return-path the same as From address

function fix_my_email_return_path( $phpmailer ) {

    $phpmailer->Sender = $phpmailer->From;

}

// Hooking up our functions to WordPress filters

add_filter( 'wp_mail_from', 'wpb_sender_email' );

add_filter( 'wp_mail_from_name', 'wpb_sender_name' );

add_action( 'phpmailer_init', 'fix_my_email_return_path' );

Save the file and you are done.

Stage 8: Enable TLS Encryption for Outgoing Emails

As a matter of course, Postfix doesn't utilize TLS encryption when sending outgoing messages. To empower TLS encryption, open /etc/postfix/main.cf file and add the accompanying two lines toward the finish of this file.

smtp_tls_security_level = may

smtp_tls_loglevel = 1

The principal line empowers TLS encryption for the Postfix SMTP customer. The subsequent line will log the TLS connection in /var/log/maillog record, so you can check in the event that TLS encryption is working. Save and close the file. Restart Postfix for the progressions to produce results.

sudo systemctl restart postfix

Since Postfix doesn't get incoming messages, there's no compelling reason to arrange a valid TLS certificate for the Postfix SMTP daemon.

Stage 9: Testing Sender Score

Presently go to https://www.mail-tester.com. You will see an interesting email address. Send an email from your site on the Postfix SMTP server to this email and afterward really look at your score. As may be obvious, I got an ideal score. In the experimental outcome, you should check on the off chance that your PTR record, SPF and DKIM record is substantial.
You can likewise open the /var/log/maillog file to check assuming TLS encryption is utilized. For instance, the accompanying line shows the connection with mail-tester.com is encrypted.

Anonymous TLS connection established to mail-tester.com[94.23.206.89]:25: TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)


Configure Postfix Send-only SMTP Server For Multiple Domains

As a matter of course, Postfix permits you to utilize any domain name in the From header and return way address to send outgoing messages. Assuming that your server has different sites, you simply need to make SPF DNS record for your different domains, which is exceptionally simple to do, and design OpenDKIM for your different domains.

To design OpenDKIM for different domains, you want to add other domains in the signing table, key table and trusted hosts file like underneath.

Signing table:

*@example.com       mta1._domainkey.example.com

*@example.net       mta1._domainkey.example.net

Key table:

mta1._domainkey.example.com     example.com:mta1:/etc/opendkim/keys/example.com/mta1.private

mta1._domainkey.example.net     example.net:mta1:/etc/opendkim/keys/example.net/mta1.private

Trusted hosts:

127.0.0.1

localhost

*.example.com

*.example.net

Then, at that point, create the DKIM Private/Public keypair by following similar strides as referenced above for different spaces and add the DKIM public key in DNS. Restart OpenDKIM and you are finished. Remember to test your source score.

Investigating
Assuming your message isn't marked and DKIM check failed, you might need to check postfix log (/var/log/maillog) to see what's going on in your setup.

Sending Emails From Another Server
There are two methods for permitting different servers to send messages through your send-only Postfix SMTP server.
  • Utilize port 25 without SMTP validation: This strategy requires the other server doesn't block port 25 (outbound).
  • Utilize port 587 with SMTP authentication: If the other server blocks port 25 (outbound), you can utilize port 587.

Port 25 without SMTP Authentication
As a matter of course, Postfix on CentOS 8 listens on localhost as it were. You want to design Postfix to listens on 0.0.0.0, so different servers can connect with the send-only Postfix SMTP server.

sudo postconf "inet_interfaces = all"

Then, at that point, you want to add the IP address of the other server to the Postfix mynetworks parameter. Replace 12.34.56.78 with the genuine IP address.

sudo postconf "$(postconf mynetworks) 12.34.56.78"

Restart Postfix for the progressions to produce results.

sudo systemctl restart postfix

Run the following commands to open port 25 (inbound).

sudo firewall-cmd --permanent --add-port=25/tcp
sudo systemctl reload firewalld

Presently you can design SMTP client to utilize mta1.yourdomain.com and port 25 to send messages. You don't have to determine username/secret key in the SMTP client.

Port 587 with SMTP Authentication
Open port 587 and 80 in firewall.

sudo firewall-cmd --permanent --add-service={smtp-submission,http}
sudo systemctl reload firewalld

As a matter of course, Postfix on CentOS 8 listens on localhost as it were. You want to design Postfix to listens on 0.0.0.0, so different servers can connect with the send-only Postfix SMTP server.

sudo postconf "inet_interfaces = all"

Then, at that point, you really want to empower the accommodation service of Postfix so the email customer can submit messages to Postfix SMTP server. Edit the master.cf file.

sudo nano /etc/postfix/master.cf

In submission area, uncomment or add the accompanying lines. If it's not too much trouble, permit no less than one whitespace (tab or spacebar) before each - o. In postfix designs, a first whitespace character implies that this line is continuation of the past line. (As a matter of course the submission area is remarked out. You can duplicate the accompanying lines and paste them into the file, so you don't need to physically uncomment or add new text.)

submission     inet     n    -    y    -    -    smtpd
 -o syslog_name=postfix/submission
 -o smtpd_tls_security_level=encrypt
 -o smtpd_tls_wrappermode=no
 -o smtpd_tls_loglevel=1
 -o smtpd_sasl_auth_enable=yes
 -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
 -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
 -o smtpd_sasl_type=dovecot
 -o smtpd_sasl_path=private/auth

The above design empowers the accommodation daemon of Postfix and requires TLS encryption on SMTP authentication. Plain text authentication will be dismissed. Save and close the file. To empower SMTP confirmation, we really want to install Dovecot on CentOS 8/RHEL 8 server.

sudo dnf install dovecot

Start Dovecot and enable auto-start at boot time.

sudo systemctl start dovecot
sudo systemctl enable dovecot

Edit the authentication config file.

sudo nano /etc/dovecot/conf.d/10-auth.conf

Uncomment the following line.

disable_plaintext_auth = yes

It will disable plaintext authentication when there's no SSL/TLS encryption. Furthermore to utilize full email address (username@your-domain.com) to login, add the accompanying line in the record.

auth_username_format = %n

In any case, you can login with username just (without @your-domain.com). Then, track down the accompanying line

auth_mechanisms = plain

This line just empowers the PLAIN authentication mechanism. LOGIN is another authentication mechanism you likely need to add to support older email clients.

auth_mechanisms = plain login

Save and close the file. Then edit the following file.

sudo nano /etc/dovecot/conf.d/10-master.conf

Change service auth section to the following so that Postfix can find the Dovecot authentication server.

service auth {
    unix_listener /var/spool/postfix/private/auth {
      mode = 0660
      user = postfix
      group = postfix
    }
}



Save and close the file. Restart Dovecot for the progressions to produce results.

sudo systemctl restart dovecot

Next, we need to obtain a valid TLS certificate. We can easily obtain a free TLS certificate from Let’s Encrypt. Issue the following commands to install Let’s Encrypt client (certbot) on CentOS 8/RHEL 8 from the EPEL repository.

sudo dnf install certbot

Then, at that point, utilize the independent module to acquire TLS certificate (accepting that there's no web server running on the Postfix SMTP server).

sudo certbot certonly --standalone --agree-tos --email you@example.com -d mta1.yourdomain.com

Sooner or later, you should see the accompanying lines which implies the certificate is effectively gotten. You can likewise see the directory under which your cert is stored.



Then, we want to run the accompanying two commands to determine the path of TLS certificate and private key in Postfix setup record. Your Let's Encrypt certificate and private key are put away under /etc/letsencrypt/live/mta1.your-domain.com/ directory.

sudo postconf "smtpd_tls_cert_file = /etc/letsencrypt/live/mta1.your-domain.com/fullchain.pem"
sudo postconf "smtpd_tls_key_file = /etc/letsencrypt/live/mta1.your-domain.com/privkey.pem"

Restart Postfix for the changes to take effect.

sudo systemctl restart postfix

Presently you can arrange SMTP clients to utilize mta1.yourdomain.com and port 587 to send messages. Use TLS encryption type and plain as authentication mode. You need to make email account on the SMTP server. That is exceptionally basic. Utilize the adduser order to add a client.

sudo adduser user1

Then set a password for this user.
sudo passwd user1
The email address will be user1@yourdomain.com.

Eliminating Sensitive Information from Email Headers
Of course, Postfix SMTP server will add a Received: email header, recording the IP address of the client, which can leak the IP address of your site (If it's behind CDN). You can tell Postfix to overlook it. Create a header check file.

sudo nano /etc/postfix/smtp_header_checks

Put the following lines into the file.
/^Received:/            IGNORE
Save and close the file. Then edit the Postfix main configuration file.
sudo nano /etc/postfix/main.cf
Add the following line at the end of the file.
smtp_header_checks = regexp:/etc/postfix/smtp_header_checks
Save and close the file. Then run the following command to rebuild hash table.
sudo postmap /etc/postfix/smtp_header_checks
Reload Postfix for the change to take effect.
sudo systemctl reload postfix
Now Postfix won’t include that sensitive information in email headers.

Auto-Renew TLS Certificate
You can create Cron job to automatically renew TLS certificate. Simply open root user’s crontab file.

sudo crontab -e
Then add the following line.
@daily certbot renew --quiet
Save and close the file.

Should Issue a STARTTLS Command First
Assuming you see the accompanying mistake via the mail log (/var/log/maillog), it's probabaly on the grounds that the TLS declaration isn't determined accurately in /etc/postfix/main.cf file.

Must issue a STARTTLS command first (in reply to MAIL FROM command)

No comments

Powered by Blogger.