Setup your own email server (MTA) on the cheap - part 6

You’ve now got an MTA using PostFix and it works beautifully – and in my case it has been for a month now. If you’re paying attention there are a couple of things you may have noticed.

  1. When you go to “Show Original” in Gmail it shows that SPF on incoming messages has failed.
  2. After a while Gmail’s SMTP server will respond that they’re throttling you because of the quantity of suspicious mail you send.

Gmail doesn’t actually have an issue with the quantity of mail, it has an issue with the quantity of messages that are failing DKIM or, in our case, SPF.  Fortunately, some people smarter than me have already thought of this issue and built postsrsd. Here’s what I did to set this up:

1. Install postsrsd, of course:
sudo apt-get install postsrsd

2. Update postfix to use postsrsd:
sudo postconf -e "sender_canonical_maps = tcp:127.0.0.1:10001"
sudo postconf -e "sender_canonical_classes = envelope_sender"
sudo postconf -e "recipient_canonical_maps = tcp:127.0.0.1:10002"
sudo postconf -e "recipient_canonical_classes = envelope_recipient"
3. Update postsrs configuration. Open /etc/default/postsrsd in your favourite editor and edit these lines:
Uncomment the SRS_EXCLUDE_DOMAINS line and add your local domains. this stops emails your send from being rewritten
 SRS_EXCLUDE_DOMAINS=domain.com,.domain.com
Edit the SRS_DOMAIN line and set it to your default domain
 SRS_DOMAIN=domain.com 
4. Finally, reload everything and you should be on your way
sudo service postsrsd restart
sudo service postfix restart

That’s it, messages will now be passed to postsrsd and forwarded messages will have their “envelope_sender” updated to show it coming from your domain. This means Gmail’s SPF checks can now pass.

Big thanks to these sources:
https://www.mind-it.info/2014/02/22/forward-postfix-spf-srs/

Comments

Post a Comment

Popular posts from this blog

Using Homebridge and Broadlink RM Mini to automate

Image
In this post, I'll be documenting how I configured a Broadlink RM Mini to work with HomeKit using the Homebridge server I built in my last post . The Broadlink RM Mini is a small IR Blaster that sits on the coffee table and sends IR signals when requested. They're cheap, and they work: In hindsight, for a little more you can also get the RM Pro which (I found out later) includes a thermometer. I added a DS18D20 thermometer to my Raspberry Pi to get around this mess up. To start with, you'll need to unpack your RM Mini and get it setup on your network. To do this, you'll need to download their "e-Control" app and follow through the setup. There's a good summary of these steps here: https://spectrum.co.ae/blogs/technology/how-to-configure-broadlink-devices, you can just stop before step 5 if you don't plan to use the e-Control application. Now we need to add homebridge-broadlink-rm to our Raspberry Pi. Connect to the pi console, SSH or local...
Read more

Using HomeBridge on a Raspberry Pi to control devices from HomeKit

Image
If you’ve got a selection of devices that you’d like to control using iOS HomeKit, setting up homebridge might be a good solution. In short, it’s a platform which acts as a “bridge” between your devices and “HomeKit”. There are MANY plugins available for it: https://www.npmjs.com/search?q=homebridge. Here’s how I use it: I have a Broadlink RM Mini that controls my AC, TV, Radio and a digital photo frame using homebridge-broadlink-rm: https://www.npmjs.com/package/homebridge-broadlink-rm  I have it enable/disable an indoor camera using MotionEye using homebridge-script2: https://www.npmjs.com/package/homebridge-script2  With all those plugins, the options are almost endless if the device is connected to the network. To do this I use a Raspberry Pi 2. To get started, you’ll need to have raspbian installed and running. To do this, there are various guides available, including this official one: https://projects.raspberrypi.org/en/projects/raspberry-pi-getting-started. ...
Read more

LetsEncrypt and AWS ELB Load Balancers

Image
This is something that I've struggled to find good information on. You've setup your IIS Web Servers in AWS, get them working nicely behind an ELB Load Balancer, now you want to apply a free LetsEncrypt SSL Certificate. This guide will take you through that process. Here's he basic run down: Design your Infrastructure to allow for a Central Validation Server Setup and IAM identity with access to manage your certificates Setup an initial certificate Apply the new certificate to a new ELB Re-generate the LetsEncrypt Certificate with a script to automatically update the ELB Certificate Design your Infrastructure to allow for a Central Validation Server One concept discussed in LetsEncrypt's Integration Guide  is a Central Validation Server. To abbreviate this considerably, this is setting up one of the servers to manage the certificates. Fortunately ELB2 presents the certificate to clients and it doesn't matter which certificate is presented by the server....
Read more