From 0d92318f13b5f9f10b12e9577e433abf8316b00b Mon Sep 17 00:00:00 2001 From: tiyn Date: Tue, 7 Jul 2026 01:56:27 +0200 Subject: [PATCH] Docker/docker-mailserver: Added Tips on DNS records --- wiki/dns.md | 59 +++++++++++ wiki/docker/mailserver_-_docker-mailserver.md | 32 +++++- wiki/email.md | 98 +++++++++++++++++++ 3 files changed, 185 insertions(+), 4 deletions(-) diff --git a/wiki/dns.md b/wiki/dns.md index d875793..e3cccfa 100644 --- a/wiki/dns.md +++ b/wiki/dns.md @@ -25,6 +25,18 @@ name. A IP Where `name` is the domain to map the `IP` to and `A` is the constant for the type of the record. +### AAAA record + +AAAA records are IPv6 address records that map hostnames to an IPv6 address. +Its basic structure is the following. + +```txt +. AAAA +``` + +Where `` is the domain to map the IPv6 address – in this case `` – to and `AAAA` is the +constant for the type of the record. + ### CNAME record CNAME (canonical name) records map one domain name to another. @@ -55,3 +67,50 @@ with the same priority, `port` is the port on that the service can be found and Note that you need to create an A if you bind a service to a `name` that doesn't already have one. + +### MX record + +Mail Exchange – often shortened to MX – records specify which mail server is responsible for +receiving emails for a domain. +Its basic structure is the following. + +```txt +. MX . +``` + +Where `` is the domain to receive mail for, `` is the preference of the mail server +(lower values are preferred), `` is the hostname of the mail server and `MX` is the constant +for the type of the record. + +The target of an MX record must resolve to an A or AAAA record. + +### TXT record + +TXT – short for text – records associate arbitrary textual information with a domain. +Its basic structure is the following. + +```txt +. TXT "" +``` + +Where `` is the domain to associate the content – in this case `` with and `TXT` is the +constant for the type of the record. + +TXT records are commonly used for domain verification as well as technologies such as +[SPF](/wiki/email.md#spf-record), [DKIM](/wiki/email.md#dkim-record) and +[DMARC](/wiki/email.md#dmarc-record). + +### PTR record + +Pointer – often shortened to PTR – records map an IP address back to a hostname. +Its basic structure is the following. + +```txt +. PTR . +``` + +Where `` is the reverse DNS representation of an IP address, `` is the canonical +hostname and `PTR` is the constant for the type of the record. + +PTR records are part of the reverse DNS namespace and are usually managed by the +owner of the IP address rather than the owner of the domain. diff --git a/wiki/docker/mailserver_-_docker-mailserver.md b/wiki/docker/mailserver_-_docker-mailserver.md index 1744848..36ce320 100644 --- a/wiki/docker/mailserver_-_docker-mailserver.md +++ b/wiki/docker/mailserver_-_docker-mailserver.md @@ -3,7 +3,7 @@ This is a [Docker](/wiki/docker.md) container for a mailserver. The official container and documentation was made by [mailserver](https://hub.docker.com/r/mailserver/docker-mailserver). -It contains dovecot, antispam, antivirus, ssl, etc. +It contains dovecot, antispam, antivirus, ssl and many more features. ## Set-up @@ -25,12 +25,23 @@ Create the file `rebuild.sh`. You then need to start the container with the `rebuild.sh` and add email accounts using the following command. -`./setup.sh email add ()` -`./setup.sh alias add postmaster@ ` +```sh +./setup.sh email add () +./setup.sh alias add postmaster@ +``` And finally generate the DCIM keys and rebuild once again. -`./setup.sh config dkim` +``` +./setup.sh config dkim +``` + +In later steps the following command can be used to generate DKIM configuration for a given domain – +which in this case is set to the placeholder ``. + +```sh +docker exec mailserver setup config dkim domain '' +``` Finally, if a reverse proxy is used check the [traefik entry](/wiki/docker/traefik.md#setup-mailserver) or the [nginx entry](/wiki/nginx.md). @@ -52,6 +63,19 @@ In this case add the following lines to the file `docker-compose.yml` in the – "traefik.http.routers.whoami.rule=Host(`.`)" ``` +To use the mail server multiple [DNS](/wiki/dns.md) [records](/wiki/dns.md#records) have to be +created. +This process is explained in the +[corresponding section of the email wiki entry](/wiki/email.md#mail-server-records) + +For the [DKIM record](/wiki/email.md#dkim-record) the dkim configuration for a given domain has to be +retrieved. +It can be found in the config directory under the following path. + +```txt +config/opendkim/keys//mail.txt +``` + ### rebuild.sh ```sh diff --git a/wiki/email.md b/wiki/email.md index 638aa1d..cb0ed20 100644 --- a/wiki/email.md +++ b/wiki/email.md @@ -14,6 +14,104 @@ interfaces. - [Dovecot](/wiki/docker/mailserver_-_docker-mailserver.md) is a simple dockerized mail server that has no interface. +### Mail Server Records + +To successfully operate a mail server several DNS records are required. +The following records assume that the mail server is reachable via `mail.`. + +#### Mail A Record + +The mail host must resolve to the server's public IP using an [A record](#a-record). + +```txt +mail.. A +``` + +#### MX record + +The MX record specifies which host is responsible for receiving mail for the domain. +For this an [MX Record](/wiki/dns.md#mx-record) is used. + +```txt +. MX 10 mail.. +``` + +The target of an MX record must always resolve to an [A](/wiki/dns.md#a-record) or +[AAAA record](/wiki/dns.md#aaaa-record). + +#### SPF record + +SPF specifies which servers are allowed to send mail on behalf of the domain using a +[TXT record](/wiki/dns.md#txt-record). + +```txt +. TXT "v=spf1 mx -all" +``` + +If mail is only sent via the configured mail server this is sufficient. +If additional providers are used the SPF record maybe has to be extended accordingly. + +#### DKIM record + +DKIM allows receiving mail servers to verify that an email has not been altered during transport. + +The DKIM key is generated by the mail server and published as a +[TXT record](/wiki/dns.md#txt-record). + +```txt +mail._domainkey.. TXT "v=DKIM1; h=sha256; k=rsa; p=" +``` + +The key has to be retrieved from the mail server. +For example for [docker-mailserver](/wiki/docker/mailserver_-_docker-mailserver.md) the process is +described in the +[corresponding set-up section](/wiki/docker/mailserver_-_docker-mailserver.md#set-up). + +#### DMARC record + +DMARC defines how receiving mail servers should handle messages that fail SPF or DKIM validation. +The DMARC records is a specific [TXT record](/wiki/dns.md#txt-record). + +```txt +_dmarc.. TXT "v=DMARC1; p=none; rua=mailto:dmarc@; adkim=s; aspf=s" +``` + +After verifying that SPF and DKIM work correctly the policy can be changed to + +```txt +p=quarantine +``` + +or + +```txt +p=reject +``` + +#### Reverse DNS Record + +The server's IP address should resolve back to the mail host. +This is done using a [PTR record](/wiki/dns.md#ptr-record). + +```txt + PTR mail.. +``` + +The PTR record is configured at the hosting provider and not in the domain's DNS zone. + +It is recommended that the PTR record matches the hostname used by the mail server's HELO/EHLO +greeting. + +### Administrative addresses + +For interoperability every mail domain should provide at least the following addresses. + +- `postmaster@` +- `abuse@` +- `dmarc@` (recommended if DMARC reports are enabled) + +These addresses may simply be aliases that forward to the primary mailbox. + ## Client If you don't have a built-in web interface for your mail-server you need some