Postfix
Postfix is a very popular open source Mail Transfer Agent (MTA) (SMTP).
Steps for Ubuntu 14.04 LTS
/etc/postfix/main.cf
mydomain=bitarus.mooo.com myhostname = mail.bitarus.mooo.com smtpd_recipient_restrictions=permit_sasl_authenticated , reject_unauth_destination relay_domains= smtpd_sasl_auth_enable=yes smtpd_sasl_security_options=noanonymous smtpd_sasl_local_domain=$myhostname broken_sasl_auth_clients=yes smtpd_relay_restrictions=permit_sasl_authenticated home_mailbox=Mailbox mail_spool_directory=/var/mail
User mail spool
SASL
/etc/default/saslauthd
START=yes
PWDIR="/var/spool/postfix/var/run/saslauthd"
PARAMS="-m ${PWDIR}"
PIDFILE="${PWDIR}/saslauthd.pid"
DESC="SASL Authentication Daemon"
NAME="saslauthd"
MECHANISMS="shadow"
THREADS=5
OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd"
Debian systemctl - enable service
Test starttls
1 openssl s_client -connect 127.0.0.1:25 -starttls smtp
Remove CRAM-MD5 authentication mechanism
In python 2.7 the CRAM-MD5 is a preferred authentication method for login in smtplib. The current postfix advertises CRAM-MD5 but does not accept it if smtplib tries to authenticate with it. So CRAM-MD5 authentication mechanism was removed.
AWS restrictions to send outbound emails - port 25
AWS blocks outbound traffic on port 25 (SMTP) of all EC2 instances and Lambda functions by default. If you want to send outbound traffic on port 25, you can request for this restriction to be remove
On all instances, Amazon EC2 restricts traffic on port 25 by default. You can request that this restriction be removed. For more information, see How do I remove the restriction on port 25 from my EC2 instance? in the AWS Knowledge Center.
DKIM (Domain Keys Identified Mail) + SPF
DKIM is an Internet Standard that enables a person or organisation to associate a domain name with an email message. This, in effect, serves as a method of claiming responsibility for a message. At its core, DKIM is powered by asymmetric cryptography. The sender’s Mail Transfer Agent (MTA) signs every outgoing message with a private key. The recipient retrieves the public key from the sender’s DNS records and verifies if the message body and some of the header fields were not altered since the message signing took place.
/etc/opendkim.conf
# create file with the following lines AutoRestart Yes AutoRestartRate 10/1h UMask 002 Syslog yes SyslogSuccess Yes LogWhy Yes Canonicalization relaxed/simple ExternalIgnoreList refile:/etc/opendkim/TrustedHosts InternalHosts refile:/etc/opendkim/TrustedHosts KeyTable refile:/etc/opendkim/KeyTable SigningTable refile:/etc/opendkim/SigningTable Mode sv PidFile /var/run/opendkim/opendkim.pid SignatureAlgorithm rsa-sha256 UserID opendkim:opendkim Socket inet:12301@localhost ####
1 nano /etc/default/opendkim
/etc/default/opendkim
SOCKET="inet:12301@localhost"
1 vi /etc/postfix/main.cf
/etc/postfix/main.cf
milter_protocol = 2 milter_default_action = accept smtpd_milters = inet:localhost:12301 non_smtpd_milters = inet:localhost:12301
/etc/opendkim/TrustedHosts
127.0.0.1 localhost x.x.x.x/24 *.bitarus.mooo.com
1 nano /etc/opendkim/KeyTable
/etc/opendkim/KeyTable
mail._domainkey.bitarus.mooo.com bitarus.mooo.com:mail:/etc/opendkim/keys/bitarus.mooo.com/mail.private
1 nano /etc/opendkim/SigningTable
/etc/opendkim/SigningTable
*@bitarus.mooo.com mail._domainkey.bitarus.mooo.com
1 cd /etc/opendkim/keys
2 mkdir bitarus.mooo.com
3 cd bitarus.mooo.com
4 opendkim-genkey -s mail -d bitarus.mooo.com
5 chown opendkim:opendkim mail.private
6
7 cat mail.txt
8 mail._domainkey IN TXT ( "v=DKIM1; k=rsa; "
9 "p=xxxxxx" ) ; ----- DKIM key mail for bitarus.mooo.com
10
11 nano /etc/bind/bitarus.mooo.com.hosts
/etc/bind/bitarus.mooo.com.hosts
mail._domainkey IN TXT "v=DKIM1; k=rsa; p=xxxxx" bitarus.mooo.com. IN TXT "v=spf1 a mx ip4:54.68.9.58 include:_spf.google.com ~all"
Outlook
# multiple includes are allowed in the DNS TXT record include:spf.protection.outlook.com