DNS: Added Note to PTR Records

wiki/dns.md

@@ -25,6 +25,18 @@ name.        A      IP
 Where `name` is the domain to map the `IP` to and `A` is the constant for
 the type of the record.
 
+### AAAA record
+
+AAAA records are IPv6 address records that map hostnames to an IPv6 address.
+Its basic structure is the following.
+
+```txt
+<name>.        AAAA   <IPv6>
+```
+
+Where `<name>` is the domain to map the IPv6 address – in this case  `<IPv6>` – to and `AAAA` is the
+constant for the type of the record.
+
 ### CNAME record
 
 CNAME (canonical name) records map one domain name to another.
@@ -55,3 +67,52 @@ with the same priority, `port` is the port on that the service can be found and
 
 Note that you need to create an A if you bind a service to a `name` that doesn't
 already have one.
+
+### MX record
+
+Mail Exchange – often shortened to MX – records specify which mail server is responsible for
+receiving emails for a domain.
+Its basic structure is the following.
+
+```txt
+<name>.        MX     <priority> <target>.
+```
+
+Where `<name>` is the domain to receive mail for, `<priority>` is the preference of the mail server
+(lower values are preferred), `<target>` is the hostname of the mail server and `MX` is the constant
+for the type of the record.
+
+The target of an MX record must resolve to an A or AAAA record.
+
+### TXT record
+
+TXT – short for text – records associate arbitrary textual information with a domain.
+Its basic structure is the following.
+
+```txt
+<name>.        TXT    "<text>"
+```
+
+Where `<name>` is the domain to associate the content – in this case `<text>` with and `TXT` is the
+constant for the type of the record.
+
+TXT records are commonly used for domain verification as well as technologies such as
+[SPF](/wiki/email.md#spf-record), [DKIM](/wiki/email.md#dkim-record) and
+[DMARC](/wiki/email.md#dmarc-record).
+
+### PTR record
+
+Pointer – often shortened to PTR – records map an IP address back to a hostname.
+Its basic structure is the following.
+
+```txt
+<ip>.          PTR    <hostname>.
+```
+
+Where `<ip>` is the reverse DNS representation of an IP address, `<hostname>` is the canonical
+hostname and `PTR` is the constant for the type of the record.
+
+PTR records are part of the reverse DNS namespace and are usually managed by the owner of the IP
+address rather than the owner of the domain.
+Therefor, they usually have to be set on the domain management website or (if accessible) directly
+in the DNS server.

wiki/docker/mailserver_-_docker-mailserver.md

@@ -1,12 +1,16 @@
 # mailserver – docker-mailserver
 
-This is a [Docker](/wiki/docker.md) container for a mailserver.
+This is a [Docker](/wiki/docker.md) container for a docker-mailserver.
 The official container and documentation was made by
 [mailserver](https://hub.docker.com/r/mailserver/docker-mailserver).
-It contains dovecot, antispam, antivirus, ssl, etc.
+It contains dovecot, antispam, antivirus, ssl and many more features.
 
 ## Set-up
 
+This section addresses the set-up of the docker-mailserver [Docker](/wiki/docker.md) container.
+
+### Download
+
 The configuration is done automatically using scripts by mailserver.
 First you need to download the essential setup files.
 
@@ -18,40 +22,138 @@ wget https://raw.githubusercontent.com/docker-mailserver/docker-mailserver/v9.0.
 chmod a+x ./setup.sh
 ```
 
-After that you need to edit the `.env` and the `mailserver.env<>` files to
-configure the mailserver.
+After that you need to edit the `docker-compose.yml` and the `mailserver.env` files to configure the
+mailserver.
+
+### Initial configuration
 
 Create the file `rebuild.sh`.
-You then need to start the container with the `rebuild.sh` and add email
-accounts using the following command.
+You then need to start the container using `rebuild.sh`.
 
-`./setup.sh email add <user@domain> (<password>)`
-`./setup.sh alias add postmaster@<domain> <user@domain>`
+After the container is running create the desired mail accounts where `<user@domain>` is the desired
+[email](/wiki/email.md) account consisting of its parts and `<password>` is the password.
+It is recommended to create a postmaster account aswell.
+It can be either created as a secondary account or just linked to the first account as shown in the
+following lines.
 
-And finally generate the DCIM keys and rebuild once again.
+```sh
+./setup.sh email add <user@domain.tld> (<password>)
+./setup.sh alias add postmaster@<domain> <user@domain.tld>
+```
 
-`./setup.sh config dkim`
+Then generate the DKIM keys.
 
-Finally, if a reverse proxy is used check the
-[traefik entry](/wiki/docker/traefik.md#setup-mailserver) or the [nginx entry](/wiki/nginx.md).
+```sh
+./setup.sh config dkim
+```
 
-Afterward you're ready to go by once again running the `rebuild.sh` file.
+Finally rebuild the container once again.
+
+The required DNS configuration is explained in the
+[corresponding section of the email wiki entry](/wiki/email.md#mail-server-records).
+This needs to be set up for the [email](/wiki/email.md) to work properly with most other providers.
+
+For the DKIM record the generated configuration has to be retrieved from the following file.
+
+```txt
+config/opendkim/keys/<domain>/mail.txt
+```
+
+Afterward run the `rebuild.sh` file again.
+
+### Reverse proxy
 
 If setting up this mailserver with [Traefik](/wiki/traefik.md) as a reverse proxy some additional
 steps should be taken.
-No http or https is needed.
-But a certificate for the mailserver is needed regardless.
-In this case add the following lines to the file `docker-compose.yml` in the
-`services:` section and adapt them.
+
+Although SMTP, IMAP and POP3 do not pass through [Traefik](/wiki/traefik.md), a TLS certificate is
+still required.
+A simple way to automatically obtain and renew such a certificate is to expose a temporary HTTP
+service.
+In this case a simple [Traefik](/wiki/traefik.md) `whoami` container is used.
+
+For a single mail domain the following service is sufficient.
+In this case add the following lines to the file `docker-compose.yml` in the `services:` section and
+adapt them according to your needs.
 
 ```yml
-  whoami:
+whoami:
   image: docker.io/traefik/whoami:latest
+  networks:
+    - proxy
   labels:
-      – "traefik.enable=true"
-      – "traefik.http.routers.whoami.rule=Host(`<subdomain>.<domain>`)"
+    - "traefik.enable=true"
+    - "traefik.http.routers.whoami.rule=Host(`mail.<domain>`)"
+    - "traefik.http.routers.whoami.tls=true"
+    - "traefik.http.routers.whoami.tls.certresolver=letsencrypt"
 ```
 
+The mailserver itself does not use this service.
+It merely causes [Traefik](/wiki/traefik.md) to request and automatically renew the TLS certificate.
+
+### Optional: Multiple Mail Domains
+
+Multiple independent mail domains can share a single mailserver instance.
+In this setup only one TLS certificate is used, containing all mail hostnames as Subject Alternative
+Names (SANs).
+
+For two domains the configuration could look as follows.
+
+```yml
+whoami:
+  image: docker.io/traefik/whoami:latest
+  networks:
+    - proxy
+  labels:
+    - "traefik.enable=true"
+    - "traefik.http.routers.whoami.rule=Host(`mail.example.com`) || Host(`mail.example.org`)"
+    - "traefik.http.routers.whoami.tls=true"
+    - "traefik.http.routers.whoami.tls.certresolver=letsencrypt"
+    - "traefik.http.routers.whoami.tls.domains[0].main=mail.example.com"
+    - "traefik.http.routers.whoami.tls.domains[0].sans=mail.example.org"
+```
+
+For three domains simply extend both the router rule and the SAN list.
+
+```yml
+- "traefik.http.routers.whoami.rule=Host(`mail.example.com`) || Host(`mail.example.org`) || Host(`mail.example.net`)"
+- "traefik.http.routers.whoami.tls.domains[0].main=mail.example.com"
+- "traefik.http.routers.whoami.tls.domains[0].sans=mail.example.org,mail.example.net"
+```
+
+[Traefik](/wiki/traefik.md) will then obtain a single certificate with the following names and keep
+it updated in the future.
+
+- `mail.example.com` as the Common Name (CN)
+- `mail.example.org` as a Subject Alternative Name (SAN)
+- `mail.example.net` as a Subject Alternative Name (SAN)
+
+This single certificate is used by the mailserver for all configured mail domains.
+
+For every additional domain  a DKIM key has to be generated.
+
+```sh
+docker exec mailserver setup config dkim domain '<domain>'
+```
+
+The required DNS records described in the
+[corresponding section of the Email entry](/wiki/email.md#mail-server-records) also have to be
+created as previously shown in [the previous section](#initial-configuration).
+
+After that mail addresses for the additional domains can simply be created and used.
+No further setup is needed and [emails](/wiki/email.md) using the new domains can simply be created.
+
+```sh
+./setup.sh email add <user@domain.tld> (<password>)
+```
+
+### Optional: Client Setup
+
+After setting up the [Email](/wiki/email.md) server, some [Client](/wiki/email.md#client)
+configurations may be taken.
+Especially recommended is the set-up of
+[end-to-end encryption](/wiki/email.md#end-to-end-encryption).
+
 ### rebuild.sh
 
 ```sh

wiki/email.md

@@ -14,6 +14,106 @@ interfaces.
 - [Dovecot](/wiki/docker/mailserver_-_docker-mailserver.md) is a simple dockerized
   mail server that has no interface.
 
+### Mail Server Records
+
+To successfully operate a mail server several DNS records are required.
+The following records assume that the mail server is reachable via `mail.<domain>`.
+
+#### Mail A Record
+
+The mail host must resolve to the server's public IP using an [A record](#a-record).
+
+```txt
+mail.<domain>.    A      <server-ip>
+```
+
+#### MX record
+
+The MX record specifies which host is responsible for receiving mail for the domain.
+For this an [MX Record](/wiki/dns.md#mx-record) is used.
+
+```txt
+<domain>.         MX     10 mail.<domain>.
+```
+
+The target of an MX record must always resolve to an [A](/wiki/dns.md#a-record) or
+[AAAA record](/wiki/dns.md#aaaa-record).
+
+#### SPF record
+
+SPF specifies which servers are allowed to send mail on behalf of the domain using a
+[TXT record](/wiki/dns.md#txt-record).
+
+```txt
+<domain>.         TXT    "v=spf1 mx -all"
+```
+
+If mail is only sent via the configured mail server this is sufficient.
+If additional providers are used the SPF record maybe has to be extended accordingly.
+
+#### DKIM record
+
+DKIM allows receiving mail servers to verify that an email has not been altered during transport.
+
+The DKIM key is generated by the mail server and published as a
+[TXT record](/wiki/dns.md#txt-record).
+
+```txt
+mail._domainkey.<domain>.    TXT    "v=DKIM1; h=sha256; k=rsa; p=<public-key>"
+```
+
+The key has to be retrieved from the mail server.
+For example for [docker-mailserver](/wiki/docker/mailserver_-_docker-mailserver.md) the process is
+described in the
+[corresponding set-up section](/wiki/docker/mailserver_-_docker-mailserver.md#set-up).
+
+#### DMARC record
+
+DMARC defines how receiving mail servers should handle messages that fail SPF or DKIM validation.
+The DMARC records is a specific [TXT record](/wiki/dns.md#txt-record).
+
+```txt
+_dmarc.<domain>.    TXT    "v=DMARC1; p=none; rua=mailto:dmarc@<domain>; adkim=s; aspf=s"
+```
+
+After verifying that SPF and DKIM work correctly the policy can be changed to
+
+```txt
+p=quarantine
+```
+
+or
+
+```txt
+p=reject
+```
+
+#### Reverse DNS Record
+
+The server's IP address should resolve back to the mail host.
+This is done using a [PTR record](/wiki/dns.md#ptr-record).
+Please note that PTR records can not be set as easily as normal DNS records as explained in 
+[the corresponding section of the DNS entry](/wiki/dns.md#ptr-record).
+
+```txt
+<server-ip>    PTR    mail.<domain>.
+```
+
+The PTR record is configured at the hosting provider and not in the domain's DNS zone.
+
+It is recommended that the PTR record matches the hostname used by the mail server's HELO/EHLO
+greeting.
+
+### Administrative addresses
+
+For interoperability every mail domain should provide at least the following addresses.
+
+- `postmaster@<domain>`
+- `abuse@<domain>`
+- `dmarc@<domain>` (recommended if DMARC reports are enabled)
+
+These addresses may simply be aliases that forward to the primary mailbox.
+
 ## Client
 
 If you don't have a built-in web interface for your mail-server you need some
@@ -27,3 +127,20 @@ And even if you have it can be useful to keep your mails synced locally on your
   It also features, contact, todo and calendar management.
 - [FairEmail](/wiki/android/fairemail.md) is a free and open-source mail client for
   [Android](/wiki/android.md).
+
+## Usage
+
+This section addresses the usage of various Email related topics.
+
+## End-to-End Encryption
+
+Besides transport encryption (TLS), emails can also be protected using end-to-end encryption.
+The two most common standards are [OpenPGP](/wiki/openpgp.md) and S/MIME.
+OpenPGP allows emails to be digitally signed and encrypted.
+Unlike TLS, which only protects the transport between mail servers and clients, OpenPGP protects the
+message itself.
+
+The generation, management and export of OpenPGP keys is described in the
+[GPG entry](/wiki/linux/gpg.md).
+The configuration of specific mail clients is described in the corresponding client entries such as
+[Thunderbird](/wiki/thunderbird.md#use-openpgp-for-encryption-decryption-and-signing).

wiki/linux/gpg.md

@@ -12,7 +12,11 @@ Sometimes it is also called `gnupg2`.
 
 ## Usage
 
-This section addresses the usage of the Open GPG.
+This section describes the management of OpenPGP keys using [Gnu Privacy Guard](https://gnupg.org/).
+
+The generated keys can subsequently be used by various applications such as
+[email clients](/wiki/email.md#client), [Git](/wiki/git_%28general%29.md), file encryption tools or
+[package](/wiki/linux/package_manager.md) signing tools.
 
 ### List or Find a Key
 

wiki/openpgp.md

@@ -1,24 +1,46 @@
 # OpenPGP
 
-[OpenPGP](https://www.openpgp.org/) is the most widely used encryption standard proposed in from
-[RFC 4880](https://datatracker.ietf.org/doc/html/rfc4880).
+[OpenPGP](https://www.openpgp.org/) is the most widely used open standard for end-to-end encryption
+and digital signatures.
+It is standardized by [RFC 4880](https://datatracker.ietf.org/doc/html/rfc4880).
+
+## Concepts
+
+OpenPGP uses asymmetric cryptography.
+
+Every user owns a key pair consisting of two keys.
+The first is the public key, which can safely be shared with everyone.
+The second is the private key, which must never leave the owner's control.
+
+The public key is used by others to encrypt messages or verify digital signatures.
+The private key is used to decrypt received messages and to create signatures.
+
+Unlike transport encryption (TLS), OpenPGP protects the content of an email itself.
 
 ## Setup
 
 There are different implementations of OpenPGP.
-Many [Linux](/wiki/linux.md) [package managers](/wiki/linux/package_manager.md) 
-package the implementation called [Gnu Privacy Guard](/wiki/linux/gpg.md) in the `gnupg` or
-sometimes also `gpg` or `gpg2` package.
+Many [Linux](/wiki/linux.md) [package managers](/wiki/linux/package_manager.md) package the
+implementation called [Gnu Privacy Guard](/wiki/linux/gpg.md) in the `gnupg`, `gpg` or `gpg2`
+package.
 
 ## Usage
 
-This section addresses the usage of OpenPGP.
-All topics regarding generation, export or editing keys are described in the specific implementation
-of the OpenPGP standard – for example [PGP](/wiki/linux/gpg.md).
+OpenPGP is commonly used to encrypt or sign files and email.
+
+The management of keys is implementation specific and is described in the corresponding
+implementation.
+For the most common implementation see the [GPG entry](/wiki/linux/gpg.md).
+
+Mail clients such as
+[Thunderbird](/wiki/thunderbird.md#use-openpgp-for-encryption-decryption-and-signing) can directly
+use existing OpenPGP keys.
 
 ### Publishing PGP Keys
 
-It sometimes can be useful to publicly publish your public key.
-This is mostly done to verify mail addresses.
-For this the public key is usually added be added on [keys.openpgp.org](https://keys.openpgp.org).
-Select `upload` or `manage` on the website and follow instructions to set this up.
+It sometimes can be useful to publicly publish a public key.
+This allows other users to easily obtain the key for encrypted communication.
+
+One commonly used public key server is [keys.openpgp.org](https://keys.openpgp.org).
+
+Select `Upload` or `Manage` on the website and follow the instructions.

wiki/thunderbird.md

@@ -23,17 +23,19 @@ select `Edit`.
 Navigate to `End-To-End Encryption` and set the settings according to your wishes.
 For example the OpenPGP key may have to be selected and default settings for signing could be set.
 
-### Use PGP Key for Encryption, Decryption and Signing
+### End-To-End Encryption Using PGP Key
 
 Thunderbird can use [OpenPGP](/wiki/openpgp.md) to sign, encrypt or decrypt mails.
+This is especially important for [End-to-End encryption](/wiki/email.md#end-to-end-encryption).
 
-Firstly a key needs to be generated.
-This is explained in the sections on [key generation](/wiki/linux/gpg.md#generating-a-key-pair),
+Firstly a key needs to be generated and then exported.
+This is explained in the sections of [GPG](/wiki/linux/gpg.md) on
+[key generation](/wiki/linux/gpg.md#generating-a-key-pair),
 [key management](/wiki/linux/gpg.md#managing-multiple-users-and-e-mails-of-an-existing-secret-key)
 and [key export](/wiki/linux/gpg.md#backing-up-and-exporting-keys) in the
 [GPG entry](/wiki/linux/gpg.md).
 Other [OpenPGP](/wiki/openpgp.md) implementations can also be used but [GPG](/wiki/linux/gpg.md) is
-the most used one.
+by far the most used one.
 
 To add a key to an existing mail account on Thunderbird, navigate to the `Account Settings` under
 `Edit` and then select the mail to add the PGP key to and `End-to-End Encryption`.