Big picture

There is a newer issue of thie ISPmail guide available if you are using Debian Jessie!

Software your mail server will use

The configuration described here uses these software components (the versions are Debian Wheezy’s default versions):

  • Debian (Release 7.0 – Code name “wheezy”)
  • Postfix (2.9.6) for receiving incoming emails from the internet and for forwarding your users’ sent emails
  • Dovecot (2.0) to store emails on your hard disk and allow users to access their emails using POP3 and IMAP
  • Roundcube (0.7.2) as a beautiful webmail interface so users can read their emails using a web browser and manage their email rules
  • MySQL (5.5.31) as the database backend storing information about domains, user accounts and email forwardings

The wonderous ways of an email

Let us start with an overview of how receiving and sending email works.

Big Picture

The green circles show what will happen when you receive an email.

  1. A remote mail server requests a TCP connection on port 25 to your mail server. Your firewall lets that connection through and the Postfix “smtpd” process will accept it.
  2. Postfix starts speaking SMTP (the “simple mail transfer protocol”) and gathers information who the alleged sender and the intended recipient addresses are. While the connection is still active Postfix does a couple of checks and may decide to reject the email.
  3. Postfix will also check real-time black lists (RBLs) via DNS to see if the sending IP address should be distrusted. For example it will reject senders running on a dynamic IP address because that almost always means the email is coming from yet another infected Windows workstation or hacked server and is likely spam.
  4. Postfix asks Dovecot whether the recipient email address belongs to an actually known user.
  5. Dovecot checks the MySQL database and looks for an entry for the email address in question.
  6. If the user exists then Postfix will accept the email and forward it to Dovecot.
  7. Dovecot stores the received email in a file in the /var/vmail directory.
  8. The user fetches new email using the POP3 or IMAP protocols from Dovecot.

Now let’s assume the user replies to the email and wants to send the reply. This is depicted by the blue circles.

  • (A) The user’s mail client establishes an SMTP connection to Postfix. It sends a username and password to authenticate.
  • (B) Postfix asks Dovecot whether the username and password are correct. This prevents accepting unauthorized email from untrusted parties.
  • (C) Dovecot searches for the account information of the sending user in the MySQL database. It tells Postfix whether the authentication was successful.
  • (D) Postfix needs to find out which server on the internet the email needs to be sent to. It asks a DNS (domain name service) server for an MX (mail exchanger) record of the receiving domain. If successful it will get the name of the server back and will know where to send the email.
  • (E) Postfix connects to the responsible server of the receiving user, establishes an SMTP connection and sends the email.

That much for a general overview.

7 thoughts on “Big picture

  • 2013-11-20 at 16:42
    Permalink

    Why was Spam Assassin removed from the tutorial? Do you not recommend using it any longer?

    Reply
    • 2013-11-20 at 16:44
      Permalink

      I actually planned to remove it because I am personally very disappointed with telling ham from spam at a global (mail relay) level. But I got convinced to maintain the section about AMaViSd in this tutorial. So in fact it's still there.

      Reply
    • 2013-11-20 at 18:05
      Permalink

      For those who want to continue using Spamassassin with AMaVis

      apt-get install spamassassin spamc

      Edit /etc/default/spamassassin to enable spamd daemon at boot

      ENABLED=1

      Run command “sa-update” and restart spamassassin service (spamd) to automate SpamAssassin rule updates

      # sa-update && service spamassassin restart

      sa-update should be run from cron daily to get the latest SpamAssassin rules which are generated every day and for enable this set “CRON=1” in /etc/default/spamassassin

      CRON=1

      You can check that the spamd daemon is listening to inputs on loopback address:
      # netstat -ntpl | grep spamd

      tcp 0 0 127.0.0.1:783 0.0.0.0:* LISTEN 2459/spamd.pid

      If you want to change settings then put them into the /etc/amavis/conf.d/50-user file. Above my configuration:

      use strict;
      $sa_tag_level_deflt = -9999;
      $final_spam_destiny = D_PASS;
      $X_HEADER_LINE = “by $myproduct_name using ClamAV at $mydomain”;
      $mailfrom_notify_admin = “postmaster\@$mydomain”;
      # Disable Virus quarantine
      $virus_quarantine_to = undef;
      # Disable Spam quarantine
      $spam_quarantine_to = ”;
      # Disable Banned quarantine
      $banned_quarantine_to = undef;
      # Disable Bad Header quarantine
      $bad_header_quarantine_to = undef;
      #———— Do not modify anything below this line ————-
      1; # ensure a defined return

      Restart Spamassassin and AMaViS:
      # service spamassassin restart
      # service amavis restart

      and now test to send John spam email:

      # sendmail john@example.org < /usr/share/doc/spamassassin/examples/sample-spam.txt in your /var/log/mail.log will now contain a line being written by AMaViS: amavis[2759]: (02759-01) Passed SPAM {RelayedTaggedInbound}, <.........> -> , …

      This shows that the email was accepted “Passed” but flagged as spam “***SPAM***”

      Reply
  • 2014-02-01 at 22:42
    Permalink

    What would you recommend to have a CalDAV calendar that is accessible from Android, Thunderbird AND Roundcube?

    Does such an option exist? I’ve Googles like crazy and not finding something that can be shared with ALL of Android/Thunderbir/Roundcube.

    So far I have looked at Baikal, Owncloud (don’t want to use this if I can) and Radicale.

    Reply
  • 2015-04-20 at 12:16
    Permalink

    In the picture, number (4,5 and 6) in particular, why Postfix asks Dovecot whether the recipient email address belongs to an actually known user, I understand it should ask the database server directly, and if the authentication goes well it will pass the message locally to the dovecot and it’s ready for the user to retrieve.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close