2

I'm not an expert in mail server configuration and I'm not that familiar with everything that I need to do to make emails work(configuraing DNS records to work with email delivery, mainly) like a charm with no issues. Therefore I would be glad to receive some links to great videos explaining how it works, what steps I need to proceed in order to configure everything according to some common guidelines or pieces of information about what is wrong with my configuration, because I tried different things and had no luck resolving my issue.

I have my own linux server running Ubuntu 17.04 and I have postfix and dovecot set up for my company emails.

The issue is, that whenever I send emails to an gmail account, in the info, you can see the red icon (http://puu.sh/x8ses/9c1a5fef89.png) and it says "bisart.eu did not encrypt this message".

Original message:

Delivered-To: test@gmail.com
Received: by 10.12.169.5 with SMTP id y5csp2584881qva;
        Sat, 12 Aug 2017 13:07:14 -0700 (PDT)
X-Received: by 10.223.151.212 with SMTP id t20mr12538728wrb.233.1502568434417;
        Sat, 12 Aug 2017 13:07:14 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1502568434; cv=none;
        d=google.com; s=arc-20160816;
        b=izg+I4FrioYQ9iZXkCeJMpZwi8bNCUbQjzsQgGKxLXdaSnp9KcpLNNKhbPKBep5vnG
         JIoPaEX/mh1NiwI8ptQJJERxUT168OldzKgUZ7+EVL545Yk0EWBnRCNtdtSZa0yjr88O
         8fRnGzp93bn5NR/RE22Fvaw13QMvA4xVFc7m6J+BW7pOSmMwB976UoMw6s0jtUCHYkPR
         CxITyX7Wy8G2rR9Px5INQeH+PsKSOQQQAQoMl88Dcy9DOvF6yo8XR/g7tic8jExKO/BT
         Cn49sfI3Eg4S8Rs1DatWwp/lw7EViKwHEhZPVqRkxTXP0z3gKhNPdlFnABvUGdDG3Id4
         Ly+w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=content-language:content-transfer-encoding:mime-version:user-agent
         :date:message-id:subject:from:to:arc-authentication-results;
        bh=QgRLF+6w7sye7fqLzlu3qDfNO47+yGPgui7mTGt5S7Y=;
        b=bPF5SMjoQhKivKP4wLWgg9uOkDudgfg/BLWiWycB9kmKxB7Eox9jMrJGSu+1wwHYMw
         HadoG0fdXLRFUj3D+/Ur2pWxIfREALH+zHGMIErkTUAN8H6rXZoQrsdrmAFvXYqKMKdq
         hk3JyUNoIED2whYzcb1lbS8ANks7hYSXwf0gTKUuzrAoCrRPoIcwWmyXMZEhZeNKhQBW
         cGmwbCnwijOSk8iAB/aX/C6cyE4OZ+K9uXbTzbwpL9u/rF83FC54JlTOSd0jpQ3MFv6Y
         sCduxKIhz9doud9ebsuB5WqKXXy7m2DlpWbzRsCozbbiKsnT0zZ0+a2UukTu+IZ87mYW
         HZ7g==
ARC-Authentication-Results: i=1; mx.google.com;
       spf=pass (google.com: domain of dodancs@moow.info designates 185.160.111.248 as permitted sender) smtp.mailfrom=dodancs@moow.info
Return-Path: <dodancs@moow.info>
Received: from mail.moowdesign.eu (moowdesign.bisart.eu. [185.160.111.248])
        by mx.google.com with ESMTP id k16si2937045wrk.226.2017.08.12.13.07.13
        for <test@gmail.com>;
        Sat, 12 Aug 2017 13:07:13 -0700 (PDT)
Received-SPF: pass (google.com: domain of dodancs@moow.info designates 185.160.111.248 as permitted sender) client-ip=185.160.111.248;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of dodancs@moow.info designates 185.160.111.248 as permitted sender) smtp.mailfrom=dodancs@moow.info
Received: from [192.168.1.69] (unknown [84.245.121.111]) by mail.moowdesign.eu (Postfix) with ESMTPSA id 19378121987 for <test@gmail.com>; Sat, 12 Aug 2017 22:07:12 +0200 (CEST)
To: test@gmail.com
From: Dominik Dancs <dodancs@moow.info>
Subject: dsadas
Message-ID: <a5bae74f-1645-fc4e-8301-4d4bf5ababc3@moow.info>
Date: Sat, 12 Aug 2017 22:07:10 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US

The thing is, that I have multiple domains pointing to the same host and the same mail server is used (moowdesign.eu, moow.info, fenixportal.eu, etc.) and I need them all to have SSL email encryption.

Each domain points to the IP and mail.domain.tld is set as the MX DNS record (which also points to the server IP).

My ports are forwarded, so all mail traffic can pass to the server.

I use Let'sEncrypt's acme.sh (https://github.com/Neilpang/acme.sh) client to create the wildcard certificate for all domains in one certificate and then use it in dovecot and postfix.

The issue:

So, the Gmail client asks for the emails to be signed by "bisart.eu", but that domain has nothing to do with my server, except only that moowdesign.bisart.eu points to my server and it has reverse records for it. I can't sign the certificate using that domain/server tho.

What should I do? I know that this is not best left as it is, because people would see the red icon and think that it is scam email or something and most likely, all the emails would go straight to spam. I hope there is some kind of a solution.

Also, my DNS records for all domains are (respectively):

               3600 IN MX  10 mail
@              3600 IN A   185.160.111.248
moow.info.     3600 IN TXT "v=spf1 mx a ptr ip4:185.160.111.248/32 a:mail.moow.info a:moowdesign.bisart.eu ~all"
mail           3600 IN A   185.160.111.248

My main.cf (Postfix config file)

compatibility_level = 2
debug_peer_level = 2

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

queue_directory = /var/spool/postfix
command_directory = /usr/sbin
#daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix

mail_owner = postfix

default_privs = nobody

myhostname = mail.moowdesign.eu
mydomain = moowdesign.eu
myorigin = $mydomain
mydestination = localhost

append_dot_mydomain = no

unknown_local_recipient_reject_code = 550

mynetworks_style = host

relay_domains = *

alias_maps = hash:/etc/aliases

debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
         ddd $daemon_directory/$process_name $process_id & sleep 5

sendmail_path = /usr/sbin/sendmail
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq

setgid_group = vmail

inet_protocols = ipv4
inet_interfaces = all

meta_directory = /etc/postfix
shlib_directory = /usr/lib/postfix
html_directory = /usr/doc/postfix-3.1.2/html
manpage_directory = /usr/man
sample_directory = /etc/postfix
readme_directory = no

smtpd_tls_cert_file = /etc/dovecot/letsencrypt.crt
smtpd_tls_CAfile = /etc/dovecot/letsencrypt.chain
smtpd_tls_key_file = /etc/dovecot/letsencrypt.key
#smtpd_tls_cert_file = /etc/dovecot/private/mail.crt
#smtpd_tls_key_file = /etc/dovecot/private/mail.key

smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes

smtpd_recipient_restrictions =
        permit_sasl_authenticated,
        permit_mynetworks,
        reject_unauth_destination,
        reject_unknown_reverse_client_hostname,
        reject_invalid_helo_hostname,
        reject_non_fqdn_helo_hostname,
        reject_non_fqdn_sender,
        reject_non_fqdn_recipient,
        reject_unknown_sender_domain,
        reject_unknown_recipient_domain,
        reject_invalid_hostname,
        reject_rbl_client zen.spamhaus.org,
        reject_rbl_client sbl.spamhaus.org,
        reject_rbl_client barracudacentral.org

smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

virtual_mailbox_domains = mysql:/etc/postfix/mysql/virtual_domains_maps.cf
virtual_alias_maps =
   mysql:/etc/postfix/mysql/virtual_alias_maps.cf,
   mysql:/etc/postfix/mysql/virtual_alias_domain_maps.cf,
   mysql:/etc/postfix/mysql/virtual_alias_domain_catchall_maps.cf
virtual_mailbox_maps =
   mysql:/etc/postfix/mysql/virtual_mailbox_maps.cf,
   mysql:/etc/postfix/mysql/virtual_alias_domain_mailbox_maps.cf

virtual_transport = lmtp:unix:/var/spool/postfix/private/dovecot-lmtp
alias_database = hash:/etc/aliases

Log for sending an email:

Aug 13 13:03:26 production postfix/smtps/smtpd[8768]: warning: hostname 84-245-121-111.dynamic.swanmobile.sk does not resolve to address 84.245.121.111: Name or service not known
Aug 13 13:03:26 production postfix/smtps/smtpd[8768]: connect from unknown[84.245.121.111]
Aug 13 13:03:27 production postfix/smtps/smtpd[8768]: 472971201BC: client=unknown[84.245.121.111], sasl_method=PLAIN, sasl_username=dodancs@moow.info
Aug 13 13:03:27 production postfix/cleanup[8772]: 472971201BC: message-id=<220f13ed-554d-383e-116c-6ae3b0592088@moow.info>
Aug 13 13:03:27 production postfix/qmgr[29192]: 472971201BC: from=<dodancs@moow.info>, size=627, nrcpt=1 (queue active)
Aug 13 13:03:27 production postfix/smtps/smtpd[8768]: disconnect from unknown[84.245.121.111] ehlo=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=6
Aug 13 13:03:29 production postfix/smtp[8775]: 472971201BC: to=<test@gmail.com>, relay=gmail-smtp-in.l.google.com[64.233.167.27]:25, delay=1.9, delays=0.17/0/0.87/0.89, dsn=2.0.0, status=sent (250 2.0.0 OK 1502622209 y42si3780413wrd.170 - gsmtp)
Aug 13 13:03:29 production postfix/qmgr[29192]: 472971201BC: removed

Is there anything else that I need to provide information about to be able to resolve this issue?

I tried:

  • Creating a self signed certificate on bisart.eu server, then using it on my server with dovecot and postfix (did not help, still says: "bisart.eu did not encrypt this message")
  • Creating self signed certificate on my server (did not help)
  • Changing myhostname and mydomain properties in main.cf in postfix configuration
  • Adding spf record to my DNS

Thank you in advance.

1
  • Outgoing mail should be unrelated to your server certificate. Please provide Postfix log excerpts for a mail sent to Google. – Jens Erat Aug 13 '17 at 10:55
4

Encryption of outgoing traffic has not much to do with any of the above.

When sending mail, your Postfix connects to Gmail (so neither port-forwarding nor MX records are involved) and acts like a TLS client (i.e. like a web browser, not a web server); it can provide its own certificate but doesn't need to.

Additionally, Postfix has separate settings for TLS in server and client modes, under smtpd_tls_* and smtp_tls_* respectively. Do not mix up the two.

Make sure you have these settings enabled:

smtp_tls_security_level = may
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_loglevel = 1

Adjust smtp_tls_CAfile to suit your OS. The smtp_tls_loglevel setting isn't required but can become useful when reading logs.

Setting smtp_tls_cert_file and smtp_tls_key_file is not required (many mail servers either ignore the client cert, or only use it for logging purposes).

5
  • I use smtpd_tls_* . What exactly is the difference between setting SSL to smtp_ and smtpd_? I updated the post and added my main.cf. Should I try and replace my settings with your suggestion? Thank you! – dodancs Aug 13 '17 at 11:01
  • Didn't I just mention that? One is for client mode, the other is for server mode. – user1686 Aug 13 '17 at 11:07
  • I'm sorry, I see it now, so should I remove the old settings or just leave them there and add the new ones? Thank you for the patience with me. – dodancs Aug 13 '17 at 11:10
  • You need both, since you're using Postfix in both modes – as client when sending mail, and as server when receiving mail. – user1686 Aug 13 '17 at 11:11
  • Thank you! Apparently it solved my issue! I don't get the error anymore. The weir thing is, that I looked at the configuration of my old VPS and I did not use these parameters either, only those with smtpd_tls_* and it worked all right. I'm glad that your suggestion helped. Thank you once more. Have a nice day. – dodancs Aug 13 '17 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.