4.5 KiB
Email is a method of exchanging electronic messages.
Setup
Email usually consists of a server and a client.
Server
If you want to host your own mail-server there are solutions with and without interfaces.
- Dovecot is a simple dockerized mail server that has no interface.
Mail Server Records
To successfully operate a mail server several DNS records are required.
The following records assume that the mail server is reachable via mail.<domain>.
Mail A Record
The mail host must resolve to the server's public IP using an A record.
mail.<domain>. A <server-ip>
MX record
The MX record specifies which host is responsible for receiving mail for the domain. For this an MX Record is used.
<domain>. MX 10 mail.<domain>.
The target of an MX record must always resolve to an A or AAAA record.
SPF record
SPF specifies which servers are allowed to send mail on behalf of the domain using a TXT record.
<domain>. TXT "v=spf1 mx -all"
If mail is only sent via the configured mail server this is sufficient. If additional providers are used the SPF record maybe has to be extended accordingly.
DKIM record
DKIM allows receiving mail servers to verify that an email has not been altered during transport.
The DKIM key is generated by the mail server and published as a TXT record.
mail._domainkey.<domain>. TXT "v=DKIM1; h=sha256; k=rsa; p=<public-key>"
The key has to be retrieved from the mail server. For example for docker-mailserver the process is described in the corresponding set-up section.
DMARC record
DMARC defines how receiving mail servers should handle messages that fail SPF or DKIM validation. The DMARC records is a specific TXT record.
_dmarc.<domain>. TXT "v=DMARC1; p=none; rua=mailto:dmarc@<domain>; adkim=s; aspf=s"
After verifying that SPF and DKIM work correctly the policy can be changed to
p=quarantine
or
p=reject
Reverse DNS Record
The server's IP address should resolve back to the mail host. This is done using a PTR record. Please note that PTR records can not be set as easily as normal DNS records as explained in the corresponding section of the DNS entry.
<server-ip> PTR mail.<domain>.
The PTR record is configured at the hosting provider and not in the domain's DNS zone.
It is recommended that the PTR record matches the hostname used by the mail server's HELO/EHLO greeting.
Administrative addresses
For interoperability every mail domain should provide at least the following addresses.
postmaster@<domain>abuse@<domain>dmarc@<domain>(recommended if DMARC reports are enabled)
These addresses may simply be aliases that forward to the primary mailbox.
Client
If you don't have a built-in web interface for your mail-server you need some software to access your mails. And even if you have it can be useful to keep your mails synced locally on your pc.
- Neomutt is a terminal-based mail client for linux, that has a simple interface.
- Thunderbird is a free and open-source mail client which is cross-platform. It also features, contact, todo and calendar management.
- FairEmail is a free and open-source mail client for Android.
Usage
This section addresses the usage of various Email related topics.
End-to-End Encryption
Besides transport encryption (TLS), emails can also be protected using end-to-end encryption. The two most common standards are OpenPGP and S/MIME. OpenPGP allows emails to be digitally signed and encrypted. Unlike TLS, which only protects the transport between mail servers and clients, OpenPGP protects the message itself.
The generation, management and export of OpenPGP keys is described in the GPG entry. The configuration of specific mail clients is described in the corresponding client entries such as Thunderbird.