Should the certificate used for postfix also contain all the domains used or just the hostname

Question

My mails keep ending up in the junk folders of gmail and microsoft. The mail server uses postfix and dovecot and has the following setup when it comes to ssl

server.domain1.ext - Hostname used by postfix and dovecot

The server handles mail for the following domains, server.domain1.ext support.domain1.ext domain2.ext domain3.ext

Should I also include the other domains than server.domain1.ext in the certificate used by the mail server or is just the hostname enough.

The mail server has dkim and spf properly set up and scores 10/10 at mail-tester.com

What step can I take to make sure my mails end up in the mailboxes of the recipients?

Answer 1

If you want to use TLS with SMTP, you only need to make sure the hostname of the server, as referenced by the MX records of the domains, is in the certificate.

Examples:

mtak@gen1:~$ dig -t mx mtak.nl +short
10 dc4.mtak.nl.

This mailserver needs a certificate that has``dc4.mtak.nl` as SAN/CN.

---

mtak@gen1:~$ dig -t mx gallische-dorp.net +short
10 dc4.mtak.nl.

For this setup, the system also only needs to has a certificate that has dc4.mtak.nl as SAN/CN.

---

mtak@gen1:~$ dig -t mx pd1tak.nl +short
10 mail.pd1tak.nl

For this setup, the system should have a certificate that has mail.pd1tak.nl as SAN/CN.

Answer 2

In addition to @mtak answer tackling the question of TLS, to answer the question about deliverability -

Unfortunately there is no 1 thing you can do, and no silver bullet. In addition to the steps you have taken, you might want to look at -

1. Ensure your reverse DNS matches your forward DNS. This is important to a lot of SMTP servers.
2. Ensure your IP is not in any blacklists - it may be in blacklists through no fault of your own - for example prior users of the IP, or its listed as part of a block of dynamic IPs even if it isn't one.
3. Start off slow and build up a reputation - Larger mail servers track the ham/spam ratio, and volumes of email. Building this reputation takes time. (Google Senderbase for more information on one such system)
4. Make sure Google knows about the domain name, and wait. A lot of spam is sent from newly registered domains - and thus they are more likely to be classified as spam.