busythomas's questions

What is the following rate limit bucket means in /etc/rspamd/local.d/ratelimit.conf?

bucket = [{
         burst = 10; 
         rate = "30 / 1min";
         }]

Does it mean like the following?

The bucket capacity is 10 email. And when there are 30 emails sent from an authenticated sender in 1 minute, then the rest 20 emails sent previously and the new emails would be soft rejected.

Additional questions:

• But, how much is the duration of the soft reject?
• What is the soft reject units in seconds or minutes or hours and where can I find them??

Kindly help, thank you!

I was able to setup a Single DKIM Key for multiple domains with OPENDKIM by using their KeyTables and SigningTable. But since the company started to use RSPAMD, I could not use OPENDKIM along with RSPAMD anymore, and required to use DKIM Signing Module by RSPAMD.

It's a long story, but I ended up in this situation where I need to setup a Single DKIM Key for other company brands domains. Usually, I would do this in OPENDKIM:

*@maincorp.com mail._domainkey.maincorp.com
*@brand1.com mail._domainkey.maincorp.com
*@brand2.com mail._domainkey.maincorp.com

But, how to do it in RSPAMD DKIM Signing? I have tried several ways without succeed by browsing and using RSPAMD docs. Is it possible to use a single DKIM Key for multiple domains DKIM Signing in RSPAMD just like in OPENDKIM?

Please note that, so far from my tryouts:

On a 1-to-1 scheme, that is DKIM Signing with different DKIM Keys for different domains were working so far. But I need 1-to-N scheme, 1 DKIM Key for Multiple Domains.

For notes:

1. I understood, that I could simply add a CNAME Record pointing to the maincorp.com _domainkey for every brands domain names. But, every brand domain names is registered in another country domain registrar which I do not have an immediate access to it (it would be a quite long bureaucracy), therefore this is unlikely.
2. I was using Opendkim and Spamassassin, and got this matter appointed at no. 1 working well, but now that Spamassassin replaced with RSPAMD and Opendkim is not being used anymore.

Thank you,

Thomas

For your reference here is my DKIM Signing config in local.d/dkim_signing.conf:

My local.d/dkim_signing.conf:

enabled = true;

If false, messages with empty envelope from are not signed
allow_envfrom_empty = true;

# If true, envelope/header domain mismatch is ignored
allow_hdrfrom_mismatch = false;

# If true, multiple from headers are allowed (but only first is used)
allow_hdrfrom_multiple = false;

# If true, username does not need to contain matching domain
allow_username_mismatch = true;

# If false, messages from authenticated users are not selected for signing
auth_only = true;

# Default path to key, can include '$domain' and '$selector' variables
#path = "/etc/opendkim/userkeys/$domain/$selector.private";
path = "/etc/opendkim/keys/mailcorp.com/mail.private";

# Default selector to use
#selector = "default";
selector = "mail";

# If false, messages from local networks are not selected for signing
sign_local = true;

# Map file of IP addresses/subnets to consider for signing
# sign_networks = "/some/file"; # or url
# Symbol to add when message is signed
symbol = "DKIM_SIGNED";

# Whether to fallback to global config
try_fallback = false;
selector_map = "/etc/rspamd/dkim_selectors.map";
path_map = "/etc/rspamd/dkim_paths.map";

# Domain to use for DKIM signing: can be "header" (MIME From), "envelope" (SMTP From) or "auth" (SMTP username)
use_domain = "header";

# Domain to use for DKIM signing when sender is in sign_networks ("header"/"envelope"/"auth")
use_domain_sign_networks = "header";

# Domain to use for DKIM signing when sender is a local IP ("header"/"envelope"/"auth")
use_domain_sign_local = "header";

# Whether to normalise domains to eSLD
use_esld = false;

# Whether to get keys from Redis
# Not using redis, keys coming from files in /etc/opendkim
use_redis = false;

# Hash for DKIM keys in Redis
key_prefix = "DKIM_KEYS";

My /etc/rspamd/dkim_selectors.map:

maincorp.com mail
brand1.com mail
brand2.com mail

And my /etc/rspamd/dkim_paths.map:

maincorp.com /etc/opendkim/keys/mancorp.com/mail.private
brand1.com /etc/opendkim/keys/mancorp.com/mail.private
brand2.com /etc/opendkim/keys/mancorp.com/mail.private

Using the configuration above at local.d/dkim_signing.conf resulting as in the following results:

• When an email is sent from @mailcorp.com, it has no problem and DKIM will be signed. Why? because at DNS mailcorp.com it has _domainkey.
• But, when an email is sent from @brand1.com and @brand2.com DKIM will not be signed, unless I added CNAME record in brand1.com and brand2.com, which I did not want to from the first time.

What is needed to be done (THE MAIN GOAL), which is not yet ACHIEVED using the configuration above is and I need your help:

The goal is to be able for brand1.com and brand2.com got signed by an existing single DKIM Key which was already implemented in TXT Record in maincorp.com, without the need to add either CNAME or TXT Record _domainkey in each brand1.com and brand2.com DNS Panel.

As for maincorp.com it is already working because it has TXT Record of the mail._domainkey.maincorp.com in the DNS Panel. But not working for brand1.com and brand2.com.

Please help...

UPDATE April 9th, 2019:

I found out that this feature I needed is unfortunately not yet supported by RSPAMD yet, at least at the time of this being questioned. Well, hopefully they would then enable it.

So, for now, I would just have to add CNAME record to brand1.com and brand2.com so DKIM would be valid and signed :(.

Thank you so much for the patience and help! Have a great day!

I am trying to update the old email address which was being used to recieve expiry notification from the amazing Letsencrypt. However, I did not find a way to do it amazingly :O.

What I did try however: I deleted the old certificate in the hope that certbot would have asked me regarding the new email but the fact it didn't (poor me)

I deleted the old certificate using this command

certbot delete

then I chose the domain which I would like to delete.

Then I regenerate a new letsencrypt certificate which was a success no errors found and the website was still online without any further certificate issue (prost to that!):

sudo certbot certonly --nginx -d thecompany.com

But then however, CERTBOT did not ask me for a new email address! (omg!)

And now I don't know what to do, feels like banging my head to the wall won't help, so, I let my fingers dance on my keyboard and asked this question to the nicest folks at here :).

Many thanks!

I would appreciate and thankful if anybody could suggest me regarding the following issue I am dealing with for the last 7 days.

Current Condition:

1 working mail server (collocation) that host for 5 domain names (no, we are not a hosting company, but it is a subsidiary company domain names), which has 3 IP Addresses.

• OS: Centos 7
• MTA: A single instance of Postfix version 2.10.1 with Virtual Mailbox / User

The current mail server runs well with Virtual User / Mailbox with 5 domains mentioned previously with a working very well postfix rate limiting that kept us away from getting marked as spam by gsuite accounts or yahoo business emails or Microsoft 365 users.

But there are these new exciting requirements :)

The New Requirement from Management:

• 4 domains need to send with the current main IP address e.g: 1.2.3.4.5.11
• 1 domain need to be applied to another additional IP address at e.g: 1.2.3.4.5.22 when sending message.
• Rate limiting must be applied as well, for example:

gmail.com polite: yahoo.com polite: hotmail.com turtle: live.fr turtle: orange.fr turtle:

What I have done successfully until now:

• Applied rate limiting using transport_maps in main.cf file
• Switch IP Address for that intended 1 domain to send using different IP Address (1.2.3.4.5.22) by enabling sender_dependent_default_transport_maps in main.cf file. This probe had a positive and expected result: the IP changed to the additional IP as intended when sending with that 1 domain, and default IP were used as usual for other domains. All has a valid SPF and DKIM validation (tested it by sending the email to a free gmail account of my own).

The Issues that I am trying to figure out by asking your suggestion:

I cannot do both at the same time because when I use sender_dependent_default_transport_maps along with the transport_maps, it appears that Postfix ignores transport_maps, therefore the rate limiting does not work.

My Questions are:

• Is it possible to get sender_dependent_default_transport_maps to work together with transport_maps in main.cf?

• If it is possible, then how to get it working?

Please do not misjudged me that I have not been doing or searching anything previously. The fact that I have been searching and trying this and that on the net but still haven't succeeded on making the two work together, and so I am seeking for help here (hopefully!).

Thank you very much!

My main.cf basically has no relayhost, no relay_domains, what I am trying to ask is on this line here:

transport_maps = hash:/etc/postfix/transport

and

sender_dependent_default_transport_maps = hash:/etc/postfix/sender_dependent_transport_maps

I cannot get them both working together, but I can get each one of them to work separately when one of them is commented. I am not aware and unsure if this is postfix behavior, because usually with postfix anything is possible :)...there is always a way (I have good faith in postfix)