There is a newer issue of thie ISPmail guide available if you are using Debian Jessie!
If you want to run a mail server on your Debian server at home then you are probably on a dynamic IP address (one that changes once a day) from your internet provider. The problem with dynamic IP addresses is that they are blacklisted by most mail servers on the internet. You cannot send email directly to other mail servers and need to send your email through a server that is not blacklisted. In this case you just need two things:
- You need to send out emails through your ISPs mail relay. If they don’t offer such a service you can still try to find a commercial SMTP relay elsewhere on the internet.
- Your ISP must not block SMTP (TCP port 25) connections to your IP address. If they do you cannot be sent emails from other mail servers.
Without these prerequisites I suggest you get an inexpensive VPS (virtual private server) and run the mail server from there.
Sending out email through your ISP is not that hard. Your ISP very likely offers an SMTP server that you can use with a username and a password. If you use their SMTP server from your mail client or from your mail server is technically no difference. So if you can send emails from your mail client then you are set. In your /etc/postfix/main.cf you will have to set:
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
relayhost = [name.of.your.isp.relay.server]
(In case you wonder: configuration statements like smtp_* stand for outgoing SMTP while smtpd_* statements are for incoming SMTP connections. So these settings apply to outgoing SMTP connections.)
This sets “name.of.your.isp.relay.server” as the hostname of your ISP’s relay server. Of course you need to set the right name here. The brackets means that no DNS lookup for MX records is done. The “relayhost” is the name of the server that Postfix will send all outgoing emails to. Without a “relayhost” Postfix would use DNS lookups to determine which mail server is responsible for a certain domain. The sasl_passwd file is where the username and password will be set that you have to use for authenticating at your ISP’s relay server. The file looks like this.
[name.of.your.isp.relay.server] herbert.ludkins:Ialenuv2
Pretty easy. You name the relay server exactly as in “relayhost”, insert a space and then write the username, a colon and the password. Afterwords you need to compile this file as you want to use is as a “hash”:
postmap /etc/postfix/sasl_passwd
This will give you an sasl_passwd.db file that Postfix can use.
You can also read about these settings in the Postfix documentation on SMTP authentication.
I was having problems relaying emails to my ISPs mail relay. I had to add the following line to my /etc/postfix/main.cf
smtp_sasl_mechanism_filter = plain, login
No more authentication 535 error.
Your tutorial is simply great.
Regards,
I’ve tried this but i still get the error:
550 Authentication required. Please use SMTP AUTH
with an relay from domainfactory
While testing I saw, that there is no auth-worker in my mail.log. Is the auth-worker important for this step?
Herzlichen Dank für die Arbeit. Soweit hat alles geklappt. Allerdings kann ich nicht über das Relay senden.
Folgende Fehlermeldung wird gelogged:
Dec 31 13:36:45 postfix/qmgr[15205]: 49C83480817: from=<###@###>, size=7937, nrcpt=1 (queue active)
Dec 31 13:36:45 postfix/smtp[15215]: warning: SASL authentication failure: No worthy mechs found
Dec 31 13:36:45 postfix/smtp[15215]: 49C83480817: to=<###@###>, relay=mail.selfhost.de[82.98.82.25]:25, delay=329, delays=328/0.13/0.3/0, dsn=4.7.0, status=deferred (SASL authentication failed; cannot authenticate to server mail.selfhost.de[82.98.82.25]: no mechanism available)
Das steht in der main.cf# Relay Server nutzen wegen dynamscher IP
mynetworks_style = host><------># Nur locale Anwendungen zulässig
#mynetworks_style = subnet<----># Auch Clients im Subnet zulässig
#
relayhost = [mail.selfhost.de]
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/relay_password
smtp_sasl_security_options = noanonymous
#
# Folgen 3 Zeilen muessen sein weil (wenn)das Zertifikat
# nicht akzeptiert wird.
#
smtp_use_tls = yes
smtp_enforce_tls = yes
smtp_tls_enforce_peername = no
Bin um Hilfe sehr verlegen, da mein alter Lenny Server gecrasht ist.
Gruß
hawe
Ja, das hatte ich auch am Anfang. Ich weiß aber nicht mehr, woran es genau lag. Ideen:
Danke, das hat mich auf den richtigen weg geführt
–> apt-get install libsasl2-2 libsasl2-modules sasl2-bin
–> in /etc/defaults/saslauthd den Start eingeschaltet
–> den User postfix zur Gruppe sasl hinzugefügt
–> service saslauthd start ausgeführt
Der Tag ist gerettet.
Danke und allen eine gutes und erfolgreiches 2015
hawe
Perfekt – dann haben wir das Jahr gerettet. 🙂
Möge Silvester bald vorbei sein…
Dear Christoph,
thank you so much for providing this great tutorial. It helps a lot to break the complex mail server setup procedure into small, manageable and understandable steps, thus avoiding potential (security-relevant) pitfalls. Having read the tutorial twice, I think I can get a glimpse of the big picture. So this must be great work 🙂
Probably I am missing something, but is there a way to fetch incoming e-mails from an ISP and leave copies of incoming mails on the ISP’s server, either unlimited or for a period of, say, 7 days?
If yes, which options would require being set? Would these options require being set within the postfix or dovecot config files, respectively?
Thanks a lot in advance to anybody offering help and contributing comments in these matters,
Christian
Hi Christian… thanks for the kind words. Glad to hear the tutorial has helped you.
Concerning your question about fetching mails from an ISP. Have you heard of the "fetchmail" utility? You can use it to fetch emails from another ISP using POP3 or IMAP and re-inject the email to your mail server. Sometimes I use it when I need to migrate mail servers. However fetchmail is pretty inefficient and not really a long-term solution. In fact my current employer used it for more than 200 users for a while and it was horrible.
So if you dare explaining a little more why you think you need something like fetchmail – perhaps we can recommend better ways to get the emails to their destination.
Cheers
…Christoph
Dear Christoph,
thanks for the unexpectedly quick reply. It took me quite some minutes to specify my expectations precisely:
I am planning to setup a mail server in an SOHO-like environment. There is a handful of users to be served, between five and ten. Since users have to occasionally switch computers, e-mails would have to be available from one central point and should not be stored on local hard drives.
Additionally, it would be helpful, that copies of e-mails are stored on and can be downloaded via the ISP’s mail server from other places as well (road warrior, homes etc …). So, there is office(mails accessible via internal mail server) and road + homes (internal mail server not available or available only via VPN; mails via ISP’s server)
SOHO means to live with limitations and certain compromises. There’s no dedicated administrator working with us. I have to take care for basic administration by myself. Knowing my capabilities and my time frame available for administration, I am not confident in my capabilities in running and reliably maintaining a fully internet exposed mail server (which, admittedly, would be the optimal method). With respect to security related questions, I feel my skills would not suffice to achieve this task appropriately. Whether “managed” servers are helpful in this respect, is a matter of long discussions …
So, I feel, the second best solution is to run a somewhat protected, internal only mail server behind a firewall, accessible only within a private IP address range (e.g. 10.x.x.x/8), fetching mails from the ISP’s server (e.g. via POP3, while leaving a copy on the ISP’s mail server) and distributing mails internally via IMAP.
In this scenario, copies of incoming e-mails can be fetched by external computers as well. It is an easily foreseeable disadvantage, that all replies to mails send by any external computer will not get fetched into the internal mail server’s IMAP send-folders. I think, we have to and we can live with that.
Further complicating issues: There’s at least two different domains for two different companies to be taken care of. E-mails have to be sent and received from the correct domain. But I think, this should be easily configurable, probably a close look at the documentation will help.
Performance will probably not be much of an issue with five to ten users. I am just a little bit concerned how to connect fetchmail instead of postfix to the database. It is this kind of interplay, which is delicate to understand for anyone without firm knowledge in these matters.
By the way, our current approach is the “e-mail server for the poor” solution: We are pointing Thunderbird / favourite e-mail clients to a profile folder hosted on a network drive (server).
Advantages: Mails for several users and several domains are easily fetched, stored within different e-mail accounts, and replies are sent from the correct domain.
Disadvantage: While seemingly simple to setup and running stably for most of the time, one can see easily, that this simple solution is error-prone and meant to spell trouble.
Unfortunately, in many SOHO environments those simple, pragmatic solutions are fixing problems temporarily but not optimally.
I do truly believe that many SOHO users face similar constraints and are looking for a similar, adequate solution. For many of those, appropriate hints would surely be highly useful. I cant’t believe I am the only person with interest in this scenario; I think, this is a pretty commonplace application scheme. If there is a good solution, I’d be happy to help you getting a good solution published, although I am not exactly sure how I can be of any help.
Best,
Christian
Provides online privacy and increase protection from fraudsters.
We provide you with an ever changing random IP that allows you to be truly anonymous and a unique double layer encryptions protocol that provides you the best security available. No longer fear a public WIFI, the government, fraudsters, trackers or censorship. See more “https://www.packetexpress.net/rotating-ip-vpn/’’
“smtp_tls_security_level = encrypt” helped me with this error “535 insufficient security or privacy level”
Hi there,
I am using outlook currently. If my domain and IP is blacklisted (old), will my mails still get into recipient’s junk folder if I use a different outgoing SMTP server (new, clean domain and IP).
Reason being, I want to continue using my old email address but trying to conceal it by using the new domain and IP I have.
I am not sure if this will work, or will the old domain and IP still get detected and mark my mail as spam? Is there any settings for this?
Martin,
not a single answer possible, as each ISP handles this differently. E.g. I’ve started from scratch, new vServer, new IPv4 etc.,…. Even with this situation my IP was blacklisted as “not known before”, e.g. for (German) Deutsche Telekom (t-online.de), Microsoft Hotmail/Outlook, and AOL. But for each of them after contacting their “POSTMASTER” I was able to sent emails latest after 24 hours. Procedure is different, T-Online was an email, AOL and Microsoft a webbased “registration”. Funny for Microsoft is that I’ll immediately would get informed if spam activity will be recognized by them for my IP(s).
In /var/log/mail.err I have the same error repeated over and over:
fatal: specify a password table via the `smtp_sasl_password_maps’ configuration parameter
I found that in the wheezy tutorial you included this but can’t figure out why you didn’t in the new tutorial. The only problem I’m having trouble with is sending mail with attachments. The mail client says its sent, but then it never arrives.
Thanks for you help. This was an amazing tutorial
Hi,
Not sure if it’s applicable for me.
I run a web server + E-mail server from awhile, with fix IPO address at home. But I moved and server follow me.
Now, I use a new operator that is not providing fixed IP.
After some couple of weeks, I saw some issues ..
gmail report outgoing mail as spam.
Worst is that error: Diagnostic-Code: smtp; 501 HELO missing ptr entry
My server host 3 domains with multiple users, means multiple e-mail users.
“Will the workaround for sending mail works ?
You need to send out emails through your ISPs mail relay. If they don’t offer such a service you can still try to find a commercial SMTP relay elsewhere on the internet.”
I am running this on Ubuntu server, postfix, Cyrrus-imap
Best regards
Hep
Setting up a mail server with a dynamic IP is going to be an uphill battle. I would suggest you find another provider that offers fixed IP service.
If that is not possible, consider using a Virtual Private Server (VPS) rather than your home server.