sangstar's questions

In my DNS records, I have 5 MX records with my hostname being the main domain name of my site example.com. These 5 records are aspmx.google.com, alt1.aspmx.google.com, alt2.aspmx.google.com, alt3.aspmx.google.com, alt4.aspmx.google.com all with hostname example.com. I additionally have A records for two extant mail subdomains, mail.example.com and mail1.example.com (I ought to add some MX records for these).. I wish to make another mail subdomain, let's call it othermail.example.com using this guide. In the iRedMail setup, it states that when setting up "first mail domain name" that my mail domain can't be the same as server hostname, so I set it as example.com instead of othermail.example.com.

In doing so, have I just caused an issue with my other mail servers? When I add an MX record for othermail.example.com, with my hostname set to "@", according to my Digital Ocean, it states:

where the hostname is example.com and the second blacked out bit is othermail.example.com. This makes me worry that this means that the other MX records I set for example.com are now null and void, as the "mail is handled by" othermail.example.com. Can these mail subdomains all coexist together? Have I nullified any other MX records?

Postfix's documentation defines smtpd_reject_unlisted_recipient (default: yes) as

Request that the Postfix SMTP server rejects mail for unknown recipient addresses, even when no explicit reject_unlisted_recipient access restriction is specified. This prevents the Postfix queue from filling up with undeliverable MAILER-DAEMON messages.

An address is always considered "known" when it matches a virtual(5) alias or a canonical(5) mapping.

The recipient domain matches $mydestination, $inet_interfaces or $proxy_interfaces, but the recipient is not listed in $local_recipient_maps, and $local_recipient_maps is not null. The recipient domain matches $virtual_alias_domains but the recipient is not listed in $virtual_alias_maps. The recipient domain matches $virtual_mailbox_domains but the recipient is not listed in $virtual_mailbox_maps, and $virtual_mailbox_maps is not null. The recipient domain matches $relay_domains but the recipient is not listed in $relay_recipient_maps, and $relay_recipient_maps is not null. This feature is available in Postfix 2.1 and later.

and smptd_reject_unlisted_sender (default: no) as

Request that the Postfix SMTP server rejects mail from unknown sender addresses, even when no explicit reject_unlisted_sender access restriction is specified. This can slow down an explosion of forged mail from worms or viruses.

An address is always considered "known" when it matches a virtual(5) alias or a canonical(5) mapping.

The sender domain matches $mydestination, $inet_interfaces or $proxy_interfaces, but the sender is not listed in $local_recipient_maps, and $local_recipient_maps is not null. The sender domain matches $virtual_alias_domains but the sender is not listed in $virtual_alias_maps. The sender domain matches $virtual_mailbox_domains but the sender is not listed in $virtual_mailbox_maps, and $virtual_mailbox_maps is not null. The sender domain matches $relay_domains but the sender is not listed in $relay_recipient_maps, and $relay_recipient_maps is not null. This feature is available in Postfix 2.1 and later.

I find the concept of an unlisted sender or recipient confusing. My mail server, which was spun up with iRedMail, set both to yes. They both seem to share the same criteria, so it leads me to believe that Postfix acknowledges something as "verified" if it is considered "known", which follows its given definitions of what is considered "known". However, my mail server works fine, yet I can't imagine that if I sent an email from my gmail account to my mail server, that it would pass the critieria as being "known" and would reject it. I've looked at my domains, forwardings and mailbox tables iRedMail sets up, and my domain is the only one listed for domains, my forwardings only show the users on my domain including the postmaster, and I'm honestly not sure what to make of mailbox but I don't think it's key to understanding this. I also have no /etc/postfix/virtual folder and no /etc/postfix/canonical folder, so how can my email be considered listed and therefore not rejected?

Regardless, I think I can rest assured that my gmail account wouldn't be listed as "known", so why is not an unlisted sender and therefore can't send mail to my MDA?

I’m trying to set up an email server. I can’t seem to get port 25 to open for me. I literally just did:

ufw disable

ufw reset

ufw default deny incoming

ufw default allow outgoing

sudo ufw allow 22/tcp

sudo ufw allow 25

sudo ufw enable

And then sudo ufw status verbose…

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere                  
25                         ALLOW IN    Anywhere                  
22/tcp (v6)                ALLOW IN    Anywhere (v6)             
25 (v6)                    ALLOW IN    Anywhere (v6)   

However, one cursory glance of sudo netstat -tulpn | grep LISTEN and..

tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      512/systemd-resolve 
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      664/sshd: /usr/sbin 
tcp6       0      0 :::22                   :::*                    LISTEN      664/sshd: /usr/sbin 

and telnet [my server IP] 25:

telnet: Unable to connect to remote host: Connection refused

What gives? How can I open up my ports?

UPDATE

At the advice of the users here, I decided to install Postfix now and check again if the ports are now being acknowledged..

sudo netstat -tulpn | grep LISTEN
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      512/systemd-resolve 
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      664/sshd: /usr/sbin 
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      43246/master        
tcp6       0      0 :::22                   :::*                    LISTEN      664/sshd: /usr/sbin 
tcp6       0      0 :::25                   :::*                    LISTEN      43246/master     

and

telnet [my server IP] 25
Trying [my server IP]...
Connected to [my server IP]
Escape character is '^]'.
220 ubuntu-s-1vcpu-1gb-lon1-01 ESMTP Postfix (Ubuntu)

It seems it's connected, but does that mean the port is open?

I am getting this titular error message when following this guide in the Postfix admin section of the tutorial from Apache2's error logs and trying navigate to the website https://mailadmin.example.com/setup.php (also just replaced my website name with example.com) as I'm given a 403 Forbidden.

AH00112: Warning: DocumentRoot [/data/www/mailadmin.example.com/html/public] does not exist
AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1f configured -- resuming normal operations
AH01630: client denied by server configuration: /data

Here is my virtual host configuration at sudo nano /etc/apache2/sites-available/mailadmin.example.com-le-ssl.conf :

<IfModule mod_ssl.c>
<VirtualHost *:443>
        ServerName mailadmin.example.com
        ServerAlias mailadmin.example.com
        ServerAdmin [email protected]

        DocumentRoot /data/www/mailadmin.example.com/html/public
        <Directory /data/www/mailadmin.example.com/html/public>
                Options -Indexes +FollowSymLinks
                DirectoryIndex index.php
                AllowOverride All
                Require all granted
        </Directory>

        RewriteEngine on
# Some rewrite rules in this file were disabled on your HTTPS site,
# because they have the potential to create redirection loops.

#       RewriteCond %{SERVER_NAME} =mailadmin.example.com
#       RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
</VirtualHost>
</IfModule>

I'm unaware what this /data means, and I can't find a folder of the sort. I don't see why I'm getting a 403 Forbidden.

Following this guide, specifically going to figure 4, what should I put in the dialogue box? My mail subdomain is mail.example.com, but the advice from the dialogue box says that if a mail address on the localhost is [email protected], then the correct thing to enter would be example.com I would want a user to have an address like [email protected], so that makes me feel like I should enter example.com. So which is it -- mail.example.com or example.com? Would entering mail.example.com imply that an email user would be [email protected]? Is this all that's going on here?

I am currently trying to set up an email server, and recently stumbled over getting a SSL certificate from Let's Encrypt in this question and realizing it isn't necessary if I don't have a web server, and from the accepted answerer's advice can instead use sudo certbot certonly --standalone -d mail.example.com if I don't have one. I ran into a second problem, and was encouraged by the answerer to create a separate question for it as it is a separate issue.

I tried sudo certbot certonly --standalone -d mail.example.com putting in my own mail subdomain and have seemed to have opened another can of worms:

   Detail: No valid IP addresses found for mail.[my domain name]

This is a bit confusing. Perhaps I have set my MX record wrong? I will list out my DNS records (I've blacked out my droplet's IP address and domain name as I have no clue if it is safe or not to share these things over the internet. If they are necessary to include and it's safe I have no problem unredacting this):

My droplet's DNS records

Here, the redacted bits in the 'Value' column all hide by droplet's IP address and the redacted bits in hostname hide my domain url. It seems to me I have the sufficient records needed to make a connection. I have an A-record pointing domain name to droplet IP address, and I have an MX record that points my mail subdomain to my droplet IP address. Unless I'm mistaken (which I suppose I must be), this should be enough for a mail server.

I'm trying to create a mail server, but I'm not able to connect to my DO droplet's domain, which I need to do to get a Let's Encrypt SSL certificate. It refuses conection. letsdebug.net says:

[My domain name] has an A (IPv4) record ([my droplet's IP address)) but a request to this address over port 80 did not succeed. Your web server must have at least one working IPv4 or IPv6 address.

71ms: Experienced error: dial tcp [my droplet's IP]:80: connect: connection refused

So, I decided to try running sudo netstat -nlp which outputted the following:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:33060         0.0.0.0:*               LISTEN      2882/mysqld         
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      2882/mysqld         
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      493/systemd-resolve 
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      768/sshd: /usr/sbin 
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      146987/master       
tcp6       0      0 :::22                   :::*                    LISTEN      768/sshd: /usr/sbin 
tcp6       0      0 :::25                   :::*                    LISTEN      146987/master       
udp        0      0 127.0.0.53:53           0.0.0.0:*                           493/systemd-resolve 
raw6       0      0 :::58                   :::*                    7           490/systemd-network 
raw6       0      0 :::58                   :::*                    7           490/systemd-network 

And there is clearly nothing listening on port 80. How do I get something to listen to it? Do I need to install Nginx or something - namely set up a webserver? Why would I need to do that? Does this mean I need a web server built to install a mail server? I'm a complete novice when it comes to this stuff.

I am being told that it is only required for a Let's Encrypt certificate. In this tutorial, dovecot.pem is used for both the cert and key file. Will this suffice instead if I'm using Dovecot?

Update: no IP address found for my subdomain

On Michael Hampton's advice, I tried sudo certbot certonly --standalone -d mail.example.com putting in my own mail subdomain and have seemed to have opened another can of worms:

   Detail: No valid IP addresses found for [my mail subdomain]

This is a bit confusing. Perhaps I have set my MX record wrong? I will list out my DNS records (I've blacked out my droplet's IP address and domain name as I have no clue if it is safe or not to share these things over the internet. If they are necessary to include and it's safe I have no problem unredacting this):

My droplet's DNS records

Here, the redacted bits in the 'Value' column all hide by droplet's IP address and the redacted bits in hostname hide my domain url.

I'm currently trying to understand the process of creating a mail server by following this guide, among others.

I currently have a website of the form example.tk by way of a Digital Ocean droplet on Ubuntu 20.04 and am attempting to have my mail server operate on mail.example.tk.

We are going to introduce the email address and passwords associated for each domain. Make sure you change all the info with your specific information.

INSERT INTO `servermail`.`virtual_users`
(`id`, `domain_id`, `password` , `email`)
VALUES
('1', '1', ENCRYPT('firstpassword', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16))), '[email protected]'),
('2', '1', ENCRYPT('secondpassword', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16))), '[email protected]');

I haven't the slightest clue of what to put for '[email protected]' and '[email protected]'. I have a domain for my website, and the mail subdomain I want to use, but I have no clue which email addresses to put here. I am a complete beginner, and the only email address I have access to is my personal email address. Am I meant to make up email addresses or something? My example.tk website has no email addresses associated with it.

I'm currently trying to understand the process of creating a mail server by following this guide, among others. There are some parts I'm confused about. I will go through one by one.

Before I start, I will say I currently have a website of the form example.tk by way of a Digital Ocean droplet on Ubuntu 20.04 and am attempting to have my mail server operate on mail.example.tk.

1.

We are going to introduce the email address and passwords associated for each domain. Make sure you change all the info with your specific information.

INSERT INTO `servermail`.`virtual_users`
(`id`, `domain_id`, `password` , `email`)
VALUES
('1', '1', ENCRYPT('firstpassword', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16))), '[email protected]'),
('2', '1', ENCRYPT('secondpassword', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16))), '[email protected]');

I haven't the slightest clue of what to put for '[email protected]' and '[email protected]'. I have a domain for my website, and the mail subdomain I want to use, but I have no clue which email addresses to put here. I am a complete beginner, and the only email address I have access to is my personal email address. Am I meant to make up email addresses or something? My example.tk website has no email addresses associated with it.

2.

First we need to comment the TLS Parameters and append other parameters. In this tutorial, we are using the Free SSL certificates and the paths that are suggested in the tutorial (link), but you could modify depending your personal configurations.

# TLS parameters
#smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
#smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
#smtpd_use_tls=yes
#smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
#smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache 
smtpd_tls_cert_file=/etc/ssl/certs/dovecot.pem
smtpd_tls_key_file=/etc/ssl/private/dovecot.pem
smtpd_use_tls=yes
smtpd_tls_auth_only = yes

To my knowledge, the first two uncommented lines deal with getting the RSA algorithm to use TLS encryption, which we're apparently getting from Dovecot; so hopefully it is safe to assume Dovecot handles TLS encryption for Postfix? According to the configuration files for smptd_use_tls and smptd_tls_auth_only, the former is defined as

Opportunistic TLS: announce STARTTLS support to remote SMTP clients, but do not require that clients use TLS encryption.

and the latter as

When TLS encryption is optional in the Postfix SMTP server, do not announce or accept SASL authentication over unencrypted connections.

This is a bit confusing to follow if the two are enabled. We look to be using RSA algorithms from the first two lines, but we are not requiring that the client use them (as declared by smptd_use_tls=yes), unless I misunderstand. Regardless of this, it is clear from the smptd_use_tls description, if enabled, TLS encryption is optional, and if TLS encryption is optional, "do not announce or accept SASL authentication over unencrypted connections." So, it seems we are affectively denying SASL authentication over unencrypted connections. Is this therefore requiring client do in fact need to use a RSA key to get authenticated?

I think I may be confusing several things, notably what RSA certificates have to do precisely with TLS encryption, as I just believe RSA keys are a kind of TLS encryption, as well as what exactly an 'unencrypted connection is' and whether that is connected to RSA keys or not at all.