I'm not an expert in mail server configuration and I'm not that familiar with everything that I need to do to make emails work(configuraing DNS records to work with email delivery, mainly) like a charm with no issues. Therefore I would be glad to receive some links to great videos explaining how it works, what steps I need to proceed in order to configure everything according to some common guidelines or pieces of information about what is wrong with my configuration, because I tried different things and had no luck resolving my issue.
I have my own linux server running Ubuntu 17.04 and I have postfix and dovecot set up for my company emails.
The issue is, that whenever I send emails to an gmail account, in the info, you can see the red icon (http://puu.sh/x8ses/9c1a5fef89.png) and it says "bisart.eu did not encrypt this message".
Delivered-To: email@example.com Received: by 10.12.169.5 with SMTP id y5csp2584881qva; Sat, 12 Aug 2017 13:07:14 -0700 (PDT) X-Received: by 10.223.151.212 with SMTP id t20mr12538728wrb.233.1502568434417; Sat, 12 Aug 2017 13:07:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1502568434; cv=none; d=google.com; s=arc-20160816; b=izg+I4FrioYQ9iZXkCeJMpZwi8bNCUbQjzsQgGKxLXdaSnp9KcpLNNKhbPKBep5vnG JIoPaEX/mh1NiwI8ptQJJERxUT168OldzKgUZ7+EVL545Yk0EWBnRCNtdtSZa0yjr88O 8fRnGzp93bn5NR/RE22Fvaw13QMvA4xVFc7m6J+BW7pOSmMwB976UoMw6s0jtUCHYkPR CxITyX7Wy8G2rR9Px5INQeH+PsKSOQQQAQoMl88Dcy9DOvF6yo8XR/g7tic8jExKO/BT Cn49sfI3Eg4S8Rs1DatWwp/lw7EViKwHEhZPVqRkxTXP0z3gKhNPdlFnABvUGdDG3Id4 Ly+w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-language:content-transfer-encoding:mime-version:user-agent :date:message-id:subject:from:to:arc-authentication-results; bh=QgRLF+6w7sye7fqLzlu3qDfNO47+yGPgui7mTGt5S7Y=; b=bPF5SMjoQhKivKP4wLWgg9uOkDudgfg/BLWiWycB9kmKxB7Eox9jMrJGSu+1wwHYMw HadoG0fdXLRFUj3D+/Ur2pWxIfREALH+zHGMIErkTUAN8H6rXZoQrsdrmAFvXYqKMKdq hk3JyUNoIED2whYzcb1lbS8ANks7hYSXwf0gTKUuzrAoCrRPoIcwWmyXMZEhZeNKhQBW cGmwbCnwijOSk8iAB/aX/C6cyE4OZ+K9uXbTzbwpL9u/rF83FC54JlTOSd0jpQ3MFv6Y sCduxKIhz9doud9ebsuB5WqKXXy7m2DlpWbzRsCozbbiKsnT0zZ0+a2UukTu+IZ87mYW HZ7g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of firstname.lastname@example.org designates 188.8.131.52 as permitted sender) email@example.com Return-Path: <firstname.lastname@example.org> Received: from mail.moowdesign.eu (moowdesign.bisart.eu. [184.108.40.206]) by mx.google.com with ESMTP id k16si2937045wrk.226.2017.08.12.13.07.13 for <email@example.com>; Sat, 12 Aug 2017 13:07:13 -0700 (PDT) Received-SPF: pass (google.com: domain of firstname.lastname@example.org designates 220.127.116.11 as permitted sender) client-ip=18.104.22.168; Authentication-Results: mx.google.com; spf=pass (google.com: domain of email@example.com designates 22.214.171.124 as permitted sender) firstname.lastname@example.org Received: from [192.168.1.69] (unknown [126.96.36.199]) by mail.moowdesign.eu (Postfix) with ESMTPSA id 19378121987 for <email@example.com>; Sat, 12 Aug 2017 22:07:12 +0200 (CEST) To: firstname.lastname@example.org From: Dominik Dancs <email@example.com> Subject: dsadas Message-ID: <firstname.lastname@example.org> Date: Sat, 12 Aug 2017 22:07:10 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US
The thing is, that I have multiple domains pointing to the same host and the same mail server is used (moowdesign.eu, moow.info, fenixportal.eu, etc.) and I need them all to have SSL email encryption.
Each domain points to the IP and mail.domain.tld is set as the MX DNS record (which also points to the server IP).
My ports are forwarded, so all mail traffic can pass to the server.
I use Let'sEncrypt's acme.sh (https://github.com/Neilpang/acme.sh) client to create the wildcard certificate for all domains in one certificate and then use it in dovecot and postfix.
So, the Gmail client asks for the emails to be signed by "bisart.eu", but that domain has nothing to do with my server, except only that moowdesign.bisart.eu points to my server and it has reverse records for it. I can't sign the certificate using that domain/server tho.
What should I do? I know that this is not best left as it is, because people would see the red icon and think that it is scam email or something and most likely, all the emails would go straight to spam. I hope there is some kind of a solution.
Also, my DNS records for all domains are (respectively):
3600 IN MX 10 mail @ 3600 IN A 188.8.131.52 moow.info. 3600 IN TXT "v=spf1 mx a ptr ip4:184.108.40.206/32 a:mail.moow.info a:moowdesign.bisart.eu ~all" mail 3600 IN A 220.127.116.11
My main.cf (Postfix config file)
compatibility_level = 2 debug_peer_level = 2 smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu) biff = no queue_directory = /var/spool/postfix command_directory = /usr/sbin #daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix mail_owner = postfix default_privs = nobody myhostname = mail.moowdesign.eu mydomain = moowdesign.eu myorigin = $mydomain mydestination = localhost append_dot_mydomain = no unknown_local_recipient_reject_code = 550 mynetworks_style = host relay_domains = * alias_maps = hash:/etc/aliases debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5 sendmail_path = /usr/sbin/sendmail newaliases_path = /usr/bin/newaliases mailq_path = /usr/bin/mailq setgid_group = vmail inet_protocols = ipv4 inet_interfaces = all meta_directory = /etc/postfix shlib_directory = /usr/lib/postfix html_directory = /usr/doc/postfix-3.1.2/html manpage_directory = /usr/man sample_directory = /etc/postfix readme_directory = no smtpd_tls_cert_file = /etc/dovecot/letsencrypt.crt smtpd_tls_CAfile = /etc/dovecot/letsencrypt.chain smtpd_tls_key_file = /etc/dovecot/letsencrypt.key #smtpd_tls_cert_file = /etc/dovecot/private/mail.crt #smtpd_tls_key_file = /etc/dovecot/private/mail.key smtpd_use_tls = yes smtpd_tls_auth_only = yes smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_unknown_reverse_client_hostname, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_invalid_hostname, reject_rbl_client zen.spamhaus.org, reject_rbl_client sbl.spamhaus.org, reject_rbl_client barracudacentral.org smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination virtual_mailbox_domains = mysql:/etc/postfix/mysql/virtual_domains_maps.cf virtual_alias_maps = mysql:/etc/postfix/mysql/virtual_alias_maps.cf, mysql:/etc/postfix/mysql/virtual_alias_domain_maps.cf, mysql:/etc/postfix/mysql/virtual_alias_domain_catchall_maps.cf virtual_mailbox_maps = mysql:/etc/postfix/mysql/virtual_mailbox_maps.cf, mysql:/etc/postfix/mysql/virtual_alias_domain_mailbox_maps.cf virtual_transport = lmtp:unix:/var/spool/postfix/private/dovecot-lmtp alias_database = hash:/etc/aliases
Log for sending an email:
Aug 13 13:03:26 production postfix/smtps/smtpd: warning: hostname 84-245-121-111.dynamic.swanmobile.sk does not resolve to address 18.104.22.168: Name or service not known Aug 13 13:03:26 production postfix/smtps/smtpd: connect from unknown[22.214.171.124] Aug 13 13:03:27 production postfix/smtps/smtpd: 472971201BC: client=unknown[126.96.36.199], sasl_method=PLAIN, email@example.com Aug 13 13:03:27 production postfix/cleanup: 472971201BC: message-id=<firstname.lastname@example.org> Aug 13 13:03:27 production postfix/qmgr: 472971201BC: from=<email@example.com>, size=627, nrcpt=1 (queue active) Aug 13 13:03:27 production postfix/smtps/smtpd: disconnect from unknown[188.8.131.52] ehlo=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=6 Aug 13 13:03:29 production postfix/smtp: 472971201BC: to=<firstname.lastname@example.org>, relay=gmail-smtp-in.l.google.com[184.108.40.206]:25, delay=1.9, delays=0.17/0/0.87/0.89, dsn=2.0.0, status=sent (250 2.0.0 OK 1502622209 y42si3780413wrd.170 - gsmtp) Aug 13 13:03:29 production postfix/qmgr: 472971201BC: removed
Is there anything else that I need to provide information about to be able to resolve this issue?
- Creating a self signed certificate on bisart.eu server, then using it on my server with dovecot and postfix (did not help, still says: "bisart.eu did not encrypt this message")
- Creating self signed certificate on my server (did not help)
- Changing myhostname and mydomain properties in main.cf in postfix configuration
- Adding spf record to my DNS
Thank you in advance.