Docker/docker-mailserver: Added Tips on DNS records

wiki/dns.md

@@ -25,6 +25,18 @@ name.        A      IP
 Where `name` is the domain to map the `IP` to and `A` is the constant for
 the type of the record.
 
+### AAAA record
+
+AAAA records are IPv6 address records that map hostnames to an IPv6 address.
+Its basic structure is the following.
+
+```txt
+<name>.        AAAA   <IPv6>
+```
+
+Where `<name>` is the domain to map the IPv6 address – in this case  `<IPv6>` – to and `AAAA` is the
+constant for the type of the record.
+
 ### CNAME record
 
 CNAME (canonical name) records map one domain name to another.
@@ -55,3 +67,50 @@ with the same priority, `port` is the port on that the service can be found and
 
 Note that you need to create an A if you bind a service to a `name` that doesn't
 already have one.
+
+### MX record
+
+Mail Exchange – often shortened to MX – records specify which mail server is responsible for
+receiving emails for a domain.
+Its basic structure is the following.
+
+```txt
+<name>.        MX     <priority> <target>.
+```
+
+Where `<name>` is the domain to receive mail for, `<priority>` is the preference of the mail server
+(lower values are preferred), `<target>` is the hostname of the mail server and `MX` is the constant
+for the type of the record.
+
+The target of an MX record must resolve to an A or AAAA record.
+
+### TXT record
+
+TXT – short for text – records associate arbitrary textual information with a domain.
+Its basic structure is the following.
+
+```txt
+<name>.        TXT    "<text>"
+```
+
+Where `<name>` is the domain to associate the content – in this case `<text>` with and `TXT` is the
+constant for the type of the record.
+
+TXT records are commonly used for domain verification as well as technologies such as
+[SPF](/wiki/email.md#spf-record), [DKIM](/wiki/email.md#dkim-record) and
+[DMARC](/wiki/email.md#dmarc-record).
+
+### PTR record
+
+Pointer – often shortened to PTR – records map an IP address back to a hostname.
+Its basic structure is the following.
+
+```txt
+<ip>.          PTR    <hostname>.
+```
+
+Where `<ip>` is the reverse DNS representation of an IP address, `<hostname>` is the canonical
+hostname and `PTR` is the constant for the type of the record.
+
+PTR records are part of the reverse DNS namespace and are usually managed by the
+owner of the IP address rather than the owner of the domain.

wiki/docker/mailserver_-_docker-mailserver.md

@@ -3,7 +3,7 @@
 This is a [Docker](/wiki/docker.md) container for a mailserver.
 The official container and documentation was made by
 [mailserver](https://hub.docker.com/r/mailserver/docker-mailserver).
-It contains dovecot, antispam, antivirus, ssl, etc.
+It contains dovecot, antispam, antivirus, ssl and many more features.
 
 ## Set-up
 
@@ -25,12 +25,23 @@ Create the file `rebuild.sh`.
 You then need to start the container with the `rebuild.sh` and add email
 accounts using the following command.
 
-`./setup.sh email add <user@domain> (<password>)`
-`./setup.sh alias add postmaster@<domain> <user@domain>`
+```sh
+./setup.sh email add <user@domain> (<password>)
+./setup.sh alias add postmaster@<domain> <user@domain>
+```
 
 And finally generate the DCIM keys and rebuild once again.
 
-`./setup.sh config dkim`
+```
+./setup.sh config dkim
+```
+
+In later steps the following command can be used to generate DKIM configuration for a given domain –
+which in this case is set to the placeholder `<domain>`.
+
+```sh
+docker exec mailserver setup config dkim domain '<domain>'
+```
 
 Finally, if a reverse proxy is used check the
 [traefik entry](/wiki/docker/traefik.md#setup-mailserver) or the [nginx entry](/wiki/nginx.md).
@@ -52,6 +63,19 @@ In this case add the following lines to the file `docker-compose.yml` in the
       – "traefik.http.routers.whoami.rule=Host(`<subdomain>.<domain>`)"
 ```
 
+To use the mail server multiple [DNS](/wiki/dns.md) [records](/wiki/dns.md#records) have to be
+created.
+This process is explained in the
+[corresponding section of the email wiki entry](/wiki/email.md#mail-server-records)
+
+For the [DKIM record](/wiki/email.md#dkim-record) the dkim configuration for a given domain has to be 
+retrieved.
+It can be found in the config directory under the following path.
+
+```txt
+config/opendkim/keys/<domain>/mail.txt
+```
+
 ### rebuild.sh
 
 ```sh

wiki/email.md

@@ -14,6 +14,104 @@ interfaces.
 - [Dovecot](/wiki/docker/mailserver_-_docker-mailserver.md) is a simple dockerized
   mail server that has no interface.
 
+### Mail Server Records
+
+To successfully operate a mail server several DNS records are required.
+The following records assume that the mail server is reachable via `mail.<domain>`.
+
+#### Mail A Record
+
+The mail host must resolve to the server's public IP using an [A record](#a-record).
+
+```txt
+mail.<domain>.    A      <server-ip>
+```
+
+#### MX record
+
+The MX record specifies which host is responsible for receiving mail for the domain.
+For this an [MX Record](/wiki/dns.md#mx-record) is used.
+
+```txt
+<domain>.         MX     10 mail.<domain>.
+```
+
+The target of an MX record must always resolve to an [A](/wiki/dns.md#a-record) or
+[AAAA record](/wiki/dns.md#aaaa-record).
+
+#### SPF record
+
+SPF specifies which servers are allowed to send mail on behalf of the domain using a
+[TXT record](/wiki/dns.md#txt-record).
+
+```txt
+<domain>.         TXT    "v=spf1 mx -all"
+```
+
+If mail is only sent via the configured mail server this is sufficient.
+If additional providers are used the SPF record maybe has to be extended accordingly.
+
+#### DKIM record
+
+DKIM allows receiving mail servers to verify that an email has not been altered during transport.
+
+The DKIM key is generated by the mail server and published as a
+[TXT record](/wiki/dns.md#txt-record).
+
+```txt
+mail._domainkey.<domain>.    TXT    "v=DKIM1; h=sha256; k=rsa; p=<public-key>"
+```
+
+The key has to be retrieved from the mail server.
+For example for [docker-mailserver](/wiki/docker/mailserver_-_docker-mailserver.md) the process is
+described in the
+[corresponding set-up section](/wiki/docker/mailserver_-_docker-mailserver.md#set-up).
+
+#### DMARC record
+
+DMARC defines how receiving mail servers should handle messages that fail SPF or DKIM validation.
+The DMARC records is a specific [TXT record](/wiki/dns.md#txt-record).
+
+```txt
+_dmarc.<domain>.    TXT    "v=DMARC1; p=none; rua=mailto:dmarc@<domain>; adkim=s; aspf=s"
+```
+
+After verifying that SPF and DKIM work correctly the policy can be changed to
+
+```txt
+p=quarantine
+```
+
+or
+
+```txt
+p=reject
+```
+
+#### Reverse DNS Record
+
+The server's IP address should resolve back to the mail host.
+This is done using a [PTR record](/wiki/dns.md#ptr-record).
+
+```txt
+<server-ip>    PTR    mail.<domain>.
+```
+
+The PTR record is configured at the hosting provider and not in the domain's DNS zone.
+
+It is recommended that the PTR record matches the hostname used by the mail server's HELO/EHLO
+greeting.
+
+### Administrative addresses
+
+For interoperability every mail domain should provide at least the following addresses.
+
+- `postmaster@<domain>`
+- `abuse@<domain>`
+- `dmarc@<domain>` (recommended if DMARC reports are enabled)
+
+These addresses may simply be aliases that forward to the primary mailbox.
+
 ## Client
 
 If you don't have a built-in web interface for your mail-server you need some