How to Set Up Postfix with DKIM, SPF, and DMARC on Ubuntu 24.04

#linux #sysadmin #ubuntu #security

If you've ever sent an email from your own server and watched it land in someone's spam folder, the cause is almost always the same: nothing on the receiving end can verify the mail actually came from you.

On a Bare Metal Server, the reputation of your outbound IP is entirely yours. A new IP sending unauthenticated mail looks exactly like spam. SPF, DKIM, and DMARC are how you build trust deliberately.

Prerequisites

Ubuntu 24.04 LTS with Postfix installed.
A clean reverse DNS (PTR) record pointing your server's IP back to your mail hostname.

Step 1: Set Up SPF

SPF is a DNS TXT record that authorizes your MX servers. Add a TXT record at your domain's root:

yourdomain.com.   IN TXT   "v=spf1 mx ~all"


Step 2 & 3: Install OpenDKIM and Generate Keys
Postfix has no DKIM signing built in; it requires a milter.

Bash
sudo apt update
sudo apt install -y opendkim opendkim-tools
sudo mkdir -p /etc/opendkim/keys/yourdomain.com
sudo opendkim-genkey -b 2048 -d yourdomain.com -D /etc/opendkim/keys/yourdomain.com -s mail -v
sudo chown -R opendkim:opendkim /etc/opendkim/keys
Step 4: Configure OpenDKIM
Edit /etc/opendkim.conf to set the domain, selector (mail), and keyfile. You must also create the socket directory so Postfix's chroot can reach it:

Bash
sudo mkdir -p /var/spool/postfix/opendkim
sudo chown opendkim:postfix /var/spool/postfix/opendkim
sudo chmod 750 /var/spool/postfix/opendkim
sudo usermod -a -G opendkim postfix
Step 5: Connect OpenDKIM to Postfix
Append to /etc/postfix/main.cf:

Ini, TOML
milter_protocol = 6
milter_default_action = accept
smtpd_milters = local:opendkim/opendkim.sock
non_smtpd_milters = $smtpd_milters
Restart services:

Bash
sudo systemctl restart opendkim
sudo systemctl restart postfix
Step 7: Publish a DMARC Record
Start with a monitoring policy (p=none):

Plaintext
_dmarc.yourdomain.com.   IN TXT   "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=100"
For the complete DNS setup and testing commands, read the full tutorial here: https://www.eservers.uk/tutorials/howto/setup-postfix-dkim-spf-dmarc-ubuntu-24-04/


---

### 12. Hashnode (Technical Focus - Commercial Content Removed)

markdown

Infrastructure Engineering: Authenticating Postfix with SPF, DKIM, and DMARC

When provisioning a new mail server, mailbox providers like Gmail and Outlook do not inherently trust your outbound IP address. Without cryptographic verification, your outbound mail will be flagged as suspicious and routed directly to the spam folder.

To establish sender reputation and guarantee deliverability, you must implement three distinct DNS and cryptographic checks: SPF, DKIM, and DMARC. This guide details their implementation on a Postfix server running Ubuntu 24.04 LTS.

The Authentication Trinity

SPF (Sender Policy Framework): A DNS record specifying which IP addresses are authorized to send mail on behalf of your domain.
DKIM (DomainKeys Identified Mail): Cryptographically signs each outgoing message utilizing a private key.
DMARC: The policy layer instructing receiving servers how to handle messages that fail SPF or DKIM checks.

Prerequisite: You must have a valid Reverse DNS (PTR) record configured for your server's IP address pointing to your mail hostname. DKIM and SPF cannot compensate for a missing PTR record.

Step 1: SPF Implementation

Add a TXT record to your domain's root zone:


text
yourdomain.com.   IN TXT   "v=spf1 mx ~all"
Note: Use ~all (softfail) during initial testing to monitor failures without dropping legitimate mail. Transition to -all (hardfail) once verified.

Step 2: OpenDKIM Installation and Key Generation
Postfix requires a milter to handle DKIM signing. Install OpenDKIM:

Bash
sudo apt update
sudo apt install -y opendkim opendkim-tools
Generate a 2048-bit key (1024-bit is deprecated):

Bash
sudo mkdir -p /etc/opendkim/keys/yourdomain.com
sudo opendkim-genkey -b 2048 -d yourdomain.com -D /etc/opendkim/keys/yourdomain.com -s mail -v
sudo chown -R opendkim:opendkim /etc/opendkim/keys
Step 3: Milter Configuration
Edit /etc/opendkim.conf to declare your domain and keys:

Ini, TOML
Syslog              yes
Mode                sv
Canonicalization    relaxed/simple
Domain              yourdomain.com
Selector            mail
KeyFile             /etc/opendkim/keys/[yourdomain.com/mail.private](https://yourdomain.com/mail.private)
Socket              local:/var/spool/postfix/opendkim/opendkim.sock
Because Postfix runs in a chroot environment, the socket must be accessible:

Bash
sudo mkdir -p /var/spool/postfix/opendkim
sudo chown opendkim:postfix /var/spool/postfix/opendkim
sudo chmod 750 /var/spool/postfix/opendkim
sudo usermod -a -G opendkim postfix
Step 4: Postfix Integration
Append the milter configuration to /etc/postfix/main.cf:

Ini, TOML
milter_protocol = 6
milter_default_action = accept
smtpd_milters = local:opendkim/opendkim.sock
non_smtpd_milters = $smtpd_milters
Restart the services:

Bash
sudo systemctl restart opendkim
sudo systemctl restart postfix
Step 5: Publishing DNS Records
Print your public key (cat /etc/opendkim/keys/yourdomain.com/mail.txt) and add it as a TXT record at mail._domainkey.yourdomain.com.

Finally, publish your DMARC monitoring policy:

Plaintext
_dmarc.yourdomain.com.   IN TXT   "v=DMARC1; p=none; rua=mailto:reports@yourdomain.com; pct=100"
After analyzing the aggregate reports sent to your email, tighten the policy from p=none to p=quarantine, and eventually p=reject.

DEV Community