Back to main index

email on

Start reading this document about why you may not want to run an email server.

I decided to use (1) MTA=Postfix (2) MDA=Dovecot and (3) IMAP server.

I have not yet decided on Spam Filter, AntiVirus and Webmail.

Here is an overview about existing MTA programs.

Add required DNS entries for the email programs.

Here is a guide on why and how to add the SPF record.

Here is a wiki page on the MX record (it will always map to an A, AAA record).

DNS records

Here is an article about email routing. Observe the last command:

dig mx

We head now further into installing the Let's Encrypt Certbot and creating a SSL certificate for the domain and subdomains.

certbot --apache

This will detect only the www and domain name, but will not show the mail. subdomain

You have to re-run with expand option to include also the

certbot --expand -d,,

Here is a page for crontab commands to list all jobs for current user or for all users.

To easily create a crontab job use this generator.

crontab -l
* * * * 1 certbot renew >/dev/null 2>&1

To check if SSL certificate is installed correctly use the SSL Server Test page.

Now it's time to install postfix and dovecot. The setup will use Maildir format (instead of mbox) and the SSL certificate that was previously generated.

My 1st installation guide explains authentication via STARTTLS on smtp port 25.

A 2nd installation guide for CentOS7 has useful parameters for Dovecot.

A 3rd installation guide exists at DigitalOcean for Debian.

Also here a 3rd guide I used for better overview on the parameters. This is for Ubuntu.

Here are my final changes for the setup.


mail_owner = postfix
myhostname =
mydomain =
myorigin = $mydomain
inet_interfaces = all
inet_protocols = all
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
virtual_alias_maps = hash:/etc/postfix/virtual
mynetworks =
relayhost =
home_mailbox = Maildir/
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/
smtpd_tls_key_file = /etc/letsencrypt/live/
local_recipient_maps = proxy:unix:passwd.byname $alias_maps
smtpd_sender_login_maps = $virtual_alias_maps
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache


# ==========================================================================                                                  
# service type  private unpriv  chroot  wakeup  maxproc command + args                                                        
#               (yes)   (yes)   (yes)   (never) (100)                                                                         
# ==========================================================================                                                  
smtp       inet  n       -       n       -       -       smtpd
  -o syslog_name=postfix/smtp
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_sasl_local_domain=$myhostname
  -o smtpd_sender_login_maps=$virtual_alias_maps
  -o smtpd_sender_restrictions=reject_sender_login_mismatch
submission inet  n       -       -       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_sasl_security_options=noanonymous
  -o smtpd_sender_login_maps=$virtual_alias_maps
  -o smtpd_sender_restrictions=reject_sender_login_mismatch
  -o smtpd_sasl_local_domain=$myhostname
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_recipient_restrictions=reject_non_fqdn_recipient,permit_sasl_authenticated,reject

Edit /etc/postfix/virtual
here replace AT with @    mihai     mihai

Here is a guide on postfix parameters. Of interest here was virtual(5) and $inet_interfaces.

However, after /etc/postfix/virtual file is edited the database must be re-generated with:

postmap /etc/postfix/virtual

Edit /etc/dovecot/dovecot.conf

protocols = imap imaps

Edit /etc/dovecot/conf.d/10-auth.conf.orig

disable_plaintext_auth = yes
auth_mechanisms = plain login

Edit /etc/dovecot/conf.d/10-mail.conf.orig

mail_location = maildir:~/Maildir

Edit /etc/dovecot/conf.d/10-master.conf.orig

unix_listener /var/spool/postfix/private/auth {
    mode = 0666
    user = postfix
    group = postfix

Edit /etc/dovecot/conf.d/10-ssl.conf.orig

ssl = yes
ssl_cert = </etc/letsencrypt/live/
ssl_key  = </etc/letsencrypt/live/
ssl_protocols = !SSLv2 !SSLv3

Edit /etc/dovecot/conf.d/20-pop3.conf.orig

pop3_uidl_format = %08Xu%08Xv

Here is a guide on how to set the reverse dns for DigitalOcean droplet.

Rename the droplet from CentOS7-512MB-FRA1-01 to

and DigitalOcean will automatically assign a PTR record for the domain.

Reverse DNS

Check if the IP has a reverse dns with:

host domain name pointer

Let's check the mail server functionality
What ports are open?


25/tcp  open   smtp
143/tcp open   imap
587/tcp open   submission
993/tcp open   imaps
Protocol Usage Plain text /
encrypted session
Encrypted session only
POP3 Incomming mail 110 995
IMAP Incomming mail 143 993
SMTP Outgoing mail 25 465
Submission Outgoing mail 587

Is AUTH PLAIN LOGIN available unencrypted?

telnet smtp
250-SIZE 10240000
250 DSN

Does MAIL FROM: work unencrypted?

telnet smtp
530 5.7.0 Must issue a STARTTLS command first

Does encrypted authentication work?

# use real login data 
echo -ne '\0user\0password' | base64

openssl s_client -connect -starttls smtp
250-SIZE 10240000
250 DSN

235 2.7.0 Authentication successful

221 2.0.0 Bye

Back to main index