hkdigital/postfix repository overview

⁠About

The image generated by this project can be used to run postfix, opendkim and fail2ban.

The folder /docker-compose-example contains an example using docker-compose.

⁠Usage

⁠Just try it out (using docker-compose)

See also the folder /docker-compose-example.

Below an example of using the image in a docker-compose file. This example will setup a container that listens to port 25.

version: "3.9"

services:

  postfix:
    #
    # @see https://hub.docker.com/r/hkdigital/postfix
    #
    image: hkdigital/postfix

    restart: always

    environment:
      MAIL_DOMAIN: mailer.example.com
      SMTP_USER: [email protected]
      SMTP_PASSWORD: 12345

    ports:
      #
      # When mapping ports in the HOST:CONTAINER format,
      # you may experience erroneous results when using a container port
      # lower than 60, because YAML parses numbers in the format xx:yy
      # as a base-60 value. For this reason, we recommend always explicitly
      # specifying your port mappings as strings.
      #
      # @see https://docs.docker.com/compose/compose-file/compose-file-v3/#ports
      #
      - "25:25"
                
    volumes:
      - ./volumes/postfix/domainkeys:/etc/opendkim/domainkeys

⁠Test the mail server (telnet example)

You can use telnet to test the server and to see how it actually works.

However, just using a mail client is easier...

# Convert your username (email) to base64 (use quotes to prevent issues)
$ echo -en "[email protected]" | base64
YXV0aEBtYWlsZXIuZXhhbXBsZS5jb20=

# Convert your password to Base 64 (use quotes to prevent issues)
$ echo -en "12345" | base64
MTIzNDU=

telnet localhost 25

AUTH LOGIN
# 334 ..
# encoded username =>
YXV0aEBtYWlsZXIuZXhhbXBsZS5jb20=
# 334 ..
# encoded password =>
MTIzNDU=
# 235 2.7.0 Authentication successful

MAIL FROM: [email protected]
RCPT TO: [email protected]
DATA
from: 'John Doe'<[email protected]>
to: 'John Doe'<[email protected]>
subject: test
Hello!
.
# 250 2.0.0 Ok: queued as ...
QUIT

⁠Setup production mail server

⁠Setup a DNS TXT record

For a production mail server, you probably want to setup an SPF record for your domain at your DNS provider.

mailer.yyy.zzz  MX  <ip-or-domainname> 10
mailer.yyy.zzz  TXT "v=spf1 mx ~all"    

This will tell receivers that receive mails from your server should be send from the ip or domain name that is specified in the MX record and that mails from other IP's or domains should be ignored.

Note SPF records MUST be published as a DNS TXT⁠

⁠DKIM

⁠Generate DKIM signature using online service

You can use an online service, e.g. https://tools.socketlabs.com/dkim/generator⁠ to test.

Specify the domain name to mail from. The default (name of the) key selector used in this container is mail.

More info about DKIM Create a DKIM record⁠.

⁠DKIM generation using OpenSSL

Because a private key will be generated, it's safer to generate the DKIM keys offline using e.g. openssl.

⁠Generate private key using OpenSSL

openssl genrsa -out mail.private 2048

⁠Create the DNS record

Choose the DKIM selector: mail

This implies that the DNS TXT record mail._domainkey.example.com should contain the public base 64 encoded DKIM key.

Generate the contents of the record:

echo -n "v=DKIM1; k=rsa; p=" > mail.txt && 
openssl rsa -in mail.private -pubout -outform der 2>/dev/null | openssl base64 -A >> mail.txt &&
echo "" >> mail.txt

@see How to create a DKIM record with OpenSSL⁠

⁠Place the private key in a container volume

• Mount the volume /etc/opendkim/domainkeys from the container.
• Place the private key there in a file called mail.private.
• Place the public key there in a file called mail.txt.

⁠Setup a DNS DKIM record

After generating the signarure add the public part to your DNS.

mail._domainkey.mailer.yyy.zzz "v=DKIM1; k=rsa; p=MIGfMA..."

This record will give receivers the posibility to check if the message was signed by your mailserver.

⁠Inspect your DNS DKIM record

Use an inspector like this one⁠ to check if the DKIM record is valid.

⁠Double check your mail server configuration

• Look at "smtpd_relay_restrictions"
• ...

⁠Build locally

If you just want to use the image to create a container, there is no need to build the image locally. You can use the image from docker-hub.

Building the image locally is usually done for development of the image itself.

⁠Get a working copy from the repository

Clone the latest commit from github into a local working directory.

git clone --depth 1 \
  [email protected]:hkdigital/docker-image--postfix.git \
  hkdigital-postfix

⁠Build the docker image

./build-latest-image.sh
docker image ls
# Shows hkdigital-postfix