SPF + DKIM for postfix

SPF allows administrators to specify which hosts are allowed to send email from a given domain by creating a specific DNS SPF record in the public DNS.

Mailserver installation and amavis mail filerings can be followed from the links below ..

postfix-dovecot
amavisd-clamav-spamassassin

For giving SPF support without recompling postfix follow the below steps ..

cpan Mail::SPF Sys::Hostname::Long

Now download the spf perl version,

wget https://launchpad.net/postfix-policyd-spf-perl/trunk/release2.010/+download/postfix-policyd-spf-perl-2.010.tar.gz

tar -zxvf postfix-policyd-spf-perl-2.010.tar.gz

cd postfix-policyd-spf-perl-2.010

mkdir /usr/lib/postfix

vim /etc/postfix/master.cf

policy    unix  -       n       n       -       -       spawn
        user=nobody argv=/usr/bin/perl /usr/lib/postfix/policyd-spf-perl

vim /etc/postfix/main.cf

Add  smtpd_recipient_restrictions = check_policy_service unix:private/policy -->  after permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

It should look like this,

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, check_policy_service unix:private/policy

/etc/init.d/postfix restart

Now the mailserver will check for spf records of the receipients domains.

For giving SPF record for our doamin =>

 @ IN  TXT  "v=spf1 mx ip4:<relay-server-ip> ~all"

~all for soft fail
-all for hard fail


Install opendkim

DKIM (Domain Keys Identified Mail) is an authentication framework which stores public-keys in DNS and digitally signs emails on a domain basis. DKIM uses public-key cryptography to allow the sender to electronically sign legitimate emails in a way that can be verified by recipients.

For dkim filtering I am using current stable opendkim project. So download the package from,

wget http://jaist.dl.sourceforge.net/project/opendkim/opendkim-2.8.4.tar.gz

Opendkim needs milter support which can be gained from sendmails milter or libmilter-worker

I prefer the second, so download libmilter-worker from the link below ..

wget http://j-chkmail.ensmp.fr/download/libmilter/libmilter-workers-8.14.3-1.tgz

tar -xvf libmilter-workers-8.14.3-1.tgz
cd libmilter-workers-8.14.3-1/libmilter/
./Build
./Build install

This will install libmilter in the default location.

Now,
tar -zxvf opendkim-2.8.4.tar.gz

cd opendkim-2.8.4
./configure --with-openssl=/usr/local/ssl/ --sysconfdir=/etc --prefix=/usr/local --localstatedir=/var
make
make install

Create users,
useradd -r -g -s /sbin/nologin opendkim
useradd -r -s /sbin/nologin opendkim

mkdir -p /etc/opendkim/keys
chown -R opendkim:opendkim /etc/opendkim
chmod -R go-wrx /etc/opendkim/keys

My domain = test.com, so

mkdir /etc/opendkim/keys/test.com
opendkim-genkey -D /etc/opendkim/keys/test.com/ -d test.com -s mail (selector)
chown -R opendkim:opendkim /etc/opendkim/keys/test.com/

Public key can be seen here

cat /etc/opendkim/keys/test.com/mail.txt

mail._domainkey IN      TXT     ( "v=DKIM1; k=rsa; "
          "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDFoGAkuk2jz1U1IOnAoiWkUj+aliy/sSWGxLkygyIyXgRY2ck0Fc/5tSXe2SuCxYmKw5hM+zNYKZofcH52yJZyizbFKjBgPA2e8xUgbUQ4F090+Psc1JRYaRmFheZunfJLINDrSXB/7LARES2TE0nsSa6IRqAO66oZydJfF89fEwIDAQAB" )  ; ----- DKIM key mail for test.com

Create Configuration file,

vim /etc/opendkim.conf

AutoRestart             Yes
AutoRestartRate         10/1h
Canonicalization        relaxed/simple
ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts           refile:/etc/opendkim/TrustedHosts
KeyTable                refile:/etc/opendkim/KeyTable
LogWhy                  Yes
Mode                    sv
PidFile                 /var/run/opendkim/opendkim.pid
SignatureAlgorithm      rsa-sha256
SigningTable            refile:/etc/opendkim/SigningTable
Socket                  inet:8891@localhost
Syslog                  Yes
SyslogSuccess           Yes
TemporaryDirectory      /tmp/dkim
UMask                   022
UserID                  opendkim:opendkim


vim /etc/opendkim/KeyTable
mail._domainkey.test.com test.com:mail:/etc/opendkim/keys/test.com/mail.private



vim /etc/opendkim/SigningTable
*@test.com mail._domainkey.test.com


vim /etc/opendkim/TrustedHosts
127.0.0.1

vim /etc/postfix/main.cf
smtpd_milters           = inet:localhost:8891 inet:localhost:8893
non_smtpd_milters       = inet:localhost:8891
milter_default_action   = accept
milter_protocol         = 2

Add no_milters at the end in master.cf

127.0.0.1:10025 inet n  -       -       -       -       smtpd
        -o content_filter=
        -o local_recipient_maps=
        -o relay_recipient_maps=
        -o smtpd_restriction_classes=
        -o smtpd_client_restrictions=
        -o smtpd_helo_restrictions=
        -o smtpd_sender_restrictions=
        -o smtpd_recipient_restrictions=permit_mynetworks,reject
        -o mynetworks=127.0.0.0/8
        -o strict_rfc821_envelopes=yes
        -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks,no_milters

/etc/init.d/postfix restart

mkdir /tmp/dkim
chmod 777 /tmp/dkim/

mkdir /var/run/opendkim
chown -R opendkim:opendkim /var/run/opendkim/

For starting
opendkim -x /etc/opendkim.conf

DNS should look like this,

mail._domainkey IN      TXT     "k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCdqZERg4wPfLQeq47IbPo7T6Kz05eBj4M5REp1HO909MglmuhvabmkJwh4WmCvpmZS3MxHCVJoTc76tp0LUxpcjsfednMYmPw0ssjR3ZGWyavPnyry7M9BEseiVNV8ikFvnQIw9CleH37uMBDnCWiJLS5Rb24Eaf5t29bxkOPd2QIDAQAB"

Mail Headers with SPF and dkim fields,

Received-SPF: pass
Authentication-Results: mail.test.com; dkim=pass
           reason="1024-bit key/testing"
           header.d=example.com header.i=@example.com header.b=a/HvJOhX;
       dkim-adsp=pass

DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=example.com; s=mail;
    t=1381310853; bh=uhRZAhRRVMve5wehh2h0SB2Hh0cvFsPGztXvFITwvTg=;
    h=To:From:Subject:Date:Message-ID:MIME-Version:Content-Type; b=a/Hv
    JOhXK38Vbw/R7WA36G6loOzBm4Eovze1eknSfnNPz8ntLtDKJ6s5srdQKuVXSRUClDh
    xkzAH2pb27qSMoOD+UO57iRJs9LnlxDZcp6nT9fek8E/fbqtNZNduUROFEuznKRsa1m
    pIw26ZTBwj3RVKmFvbI6eaSN76s5PkBak=