IRedMail Mail Server. Almalinux 8. Installation and configuration
Links
https://www.linuxbabe.com/mail-server/centos-7-iredmail-email-server
https://www.linuxbabe.com/mail-server/install-postfixadmin-iredmail-ubuntu
https://blog.airmeno.ru/?p=625
Description
iRedMail Mail Server
Installation
DNS records
Add resource records to dns server, which serving your domains (in mikrotik, for example, but it can be any dns-record manager of the registrar, which provides you your new domain)
Domain for administration (Web admin panel (iRedAdmin)) (it's not your domain for mail, just for management)
/ip dns static
add address=45.67.59.224 name=domain123.ru ttl=1m
add address=45.67.59.224 name=mail.domain123.ru ttl=1m
add mx-exchange=mail.domain123.ru mx-preference=10 name=domain123.ru ttl=1m type=MX
Mail domain (which will be your first mail domain)
/ip dns static
add address=45.67.59.224 name=don661.ru ttl=1m
add address=45.67.59.224 name=mail.don661.ru ttl=1m
add mx-exchange=mail.don661.ru mx-preference=10 name=don661.ru ttl=1m type=MX
iRedMail Mail Server
Utils install
dnf install -y epel-release wget tmux bind-utils tar bzip2
yum config-manager --set-enabled powertools
dnf -y update
Set SELinux in Permissive mode
iRedMail development team doesn’t provide SELinux policies for the service to work when SELinux is enforcing. You need to disable SELinux or configure it to run in Permissive mode.
setenforce 0
sed -i 's/^SELINUX=.*/SELINUX=permissive/g' /etc/selinux/config
reboot
Confirm current SELinux status after making the change.
sestatus
Hostname
export HOSTNAME="mail.domain123.ru"
sudo hostnamectl set-hostname $HOSTNAME --static
sudo hostnamectl set-hostname $HOSTNAME --transient
Set external public IP and FQDN hostname of the mail server
nano /etc/hosts
... 45.67.59.224 mail.domain123.ru
Check
host mail.domain123.ru
dig A mail.domain123.ru
Download and install iRedMail
mkdir ~/distr/
cd ./distr/
wget https://github.com/iredmail/iRedMail/archive/refs/tags/1.6.2.tar.gz
tar xvf 1.6.2.tar.gz
cd iRedMail-*/
chmod +x iRedMail.sh
tmux
./iRedMail.sh
Mail dir: /var/vmail
Web server: nginx
Backend to store mail accounts: MariaDB
Mysql admin password: PassWord
First mail account (it should be NOT admin domain "mail.domain123.ru"): don661.ru
postmaster@don661.ru admin password: PassWord
Optinal components: <select ALL components>
Continue? [y|N]: y
Write down following URLs and credentials:
******************************************************************** * URLs of installed web applications: * * - Roundcube webmail: https://mail.domain123.ru/mail/ * - SOGo groupware: https://mail.domain123.ru/SOGo/ * - netdata (monitor): https://mail.domain123.ru/netdata/ * * - Web admin panel (iRedAdmin): https://mail.domain123.ru/iredadmin/ * * You can login to above links with below credential: * * - Username: postmaster@don661.ru * - Password: PassWord * * ******************************************************************** * Congratulations, mail server setup completed successfully. Please * read below file for more information: * - /root/distr/iRedMail-1.6.2/iRedMail.tips * * And it's sent to your mail account postmaster@don661.ru. * ********************* WARNING ************************************** * * Please reboot your system to enable all mail services. * ********************************************************************
ERROR AFTER CLEAN INSTALL:
"Internal Server Error" at https://mail.domain123.ru/iredadmin/
DESCRIPTION:
cat /var/log/messages
... Jul 10 13:45:11 iredmail iredadmin[4313]: Traceback (most recent call last): Jul 10 13:45:11 iredmail iredadmin[4313]: File "/opt/www/iRedAdmin-1.3/iredadmin.py", line 8, in <module> Jul 10 13:45:11 iredmail iredadmin[4313]: from libs import iredbase Jul 10 13:45:11 iredmail iredadmin[4313]: File "/opt/www/iRedAdmin-1.3/libs/iredbase.py", line 5, in <module> Jul 10 13:45:11 iredmail iredadmin[4313]: import web Jul 10 13:45:11 iredmail iredadmin[4313]: ModuleNotFoundError: No module named 'web' ...
SOLUTION:
https://github.com/iredmail/iRedMail/issues/63
pip3 install web.py==0.62
reboot
Firewall
Add additional rules
Let's add input accept for zabbix agent
Install and run zabbix-agent
yum install -y https://repo.zabbix.com/zabbix/4.4/rhel/7/x86_64/zabbix-agent2-4.4.10-1.el7.x86_64.rpm
systemctl enable --now zabbix-agent2
systemctl status zabbix-agent2
Accept zabbix-agent input
nano /etc/firewalld/zones/iredmail.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>Mail services</short>
<description>Allow access to mail services from external network.</description>
<service name="http"/>
<...>
<service name="zabbix-agent"/>
</zone>
firewall-cmd --reload
Show rules
firewall-cmd --list-all
iredmail (active) target: default icmp-block-inversion: no interfaces: ens32 sources: services: http https imap imaps pop3 pop3s smtp smtp-submission ssh zabbix-agent
Letsencrypt certs
Certbot install
dnf install -y certbot
Cert create
You don't have to create cert for each domain. You can create one cert with a few certs in it.
Also you have to create certs for root domains of the mail domains (don661.ru, etc.). Otherwise mail clients (like Thunderbird will warning about untrusted cert of root domains).
In our example: domain123.ru,mail.domain123.ru,don661.ru,mail.don661.ru
certbot certonly --webroot --agree-tos -d domain123.ru,mail.domain123.ru,don661.ru,mail.don661.ru --cert-name ALL-MAIL-DOMAINS --email cless@don661.ru -w /var/www/html
Check certs
certbot certificates
... - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Found the following certs: Certificate Name: ALL-MAIL-DOMAINS Serial Number: 3f2f142e6ae07d2a6c251bdc15acf7d2774 Key Type: RSA Domains: domain123.ru mail.domain123.ru don661.ru mail.don661.ru Expiry Date: 2023-04-28 09:24:29+00:00 (VALID: 89 days) Certificate Path: /etc/letsencrypt/live/ALL-MAIL-DOMAINS/fullchain.pem Private Key Path: /etc/letsencrypt/live/ALL-MAIL-DOMAINS/privkey.pem - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ...
Renew certs
certbot renew --force-renewal --cert-name ALL-MAIL-DOMAINS
systemctl restart nginx
systemctl restart postfix
systemctl restart dovecot
Autorenew certs
crontab -e
... # letsencrypt weekly renew 0 8 * * 7 certbot renew --force-renewal --cert-name ALL-MAIL-DOMAINS
Nginx certs add
Comment native self-signed certs and add letsencrypt certs.
nano /etc/nginx/templates/ssl.tmpl
... #ssl_certificate /etc/pki/tls/certs/iRedMail.crt; #ssl_certificate_key /etc/pki/tls/private/iRedMail.key; ssl_certificate /etc/letsencrypt/live/ALL-MAIL-DOMAINS/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/ALL-MAIL-DOMAINS/privkey.pem;
systemctl restart nginx
Now you able to open any of your domains in browser for Roundcube, iRadMail (web panel), etc, because all of your certs for your domains are in the same cert files.
Postfix certs add
nano /etc/postfix/main.cf
... #smtpd_tls_key_file = /etc/pki/tls/private/iRedMail.key #smtpd_tls_cert_file = /etc/pki/tls/certs/iRedMail.crt #smtpd_tls_CAfile = /etc/pki/tls/certs/iRedMail.crt #smtpd_tls_CApath = /etc/pki/tls/certs smtpd_tls_key_file = /etc/letsencrypt/live/ALL-MAIL-DOMAINS/privkey.pem smtpd_tls_cert_file = /etc/letsencrypt/live/ALL-MAIL-DOMAINS/cert.pem smtpd_tls_CAfile = /etc/letsencrypt/live/ALL-MAIL-DOMAINS/chain.pem smtpd_tls_CApath = /etc/letsencrypt/live/ALL-MAIL-DOMAINS ...
systemctl restart postfix
Dovecot certs add
nano /etc/dovecot/dovecot.conf
... #ssl_cert = </etc/pki/tls/certs/iRedMail.crt #ssl_key = </etc/pki/tls/private/iRedMail.key ssl_dh = </etc/pki/tls/dh2048_param.pem ssl_cert = </etc/letsencrypt/live/ALL-MAIL-DOMAINS/fullchain.pem ssl_key = </etc/letsencrypt/live/ALL-MAIL-DOMAINS/privkey.pem ...
systemctl restart dovecot
Now you able to add your mail account to Desktop mail client without having a warning about untrusted certs.
Improving email deliverability (VERY IMPORTANT!)
https://www.linuxbabe.com/mail-server/centos-7-iredmail-email-server
To prevent your emails from being flagged as spam, you should set PTR, SPF, DKIM and DMARC records.
PTR записи на DNS сервере
Описание
Запись PTR прописывается _НЕ_ в ресурсных записях днс-сервера, к которому привязан ваш почтовый домен, это делает именно регистратор ip-адреса (провайдер или хостер, предоставляющий внешний ip-адрес)! Если провайдер ростелеком, пишем на электронку support@tmb.ru с просьбой зарегистрировать ptr-запись, штатная техподдержка отказывается предоставлять такую услугу
Если у вас есть свой почтовый сервер, то необходимо, чтобы ваш провайдер (а точнее тот, кто выдал вам статические ip-адреса. если ваш внешний IP предоставил вам хостер, на котором у вас крутится VPS/VDS, то обращаемся в техподдержку хостера) зарегистрировал на своем DNS-сервере PTR записи для вашего почтового сервера (MX-записи). Иначе, подавляющая часть почтовых серверов интернета откажется принимать почту от вашего почтового сервера.
Так же, многие почтовые сервера отвергают письма, если при проверке адреса отправителя в строке им выдается "dynamicip" или "dsl" или подобные слова означающие, что ваш адрес не статический или не совпадает с именем вашего домена.
Если в ответе сервера на ваше отправленное письмо вы видите что-то типа:
mxs.mail.ru: 550 Sorry, we do not accept mail from hosts with dynamic IP or generic DNS PTR-records. Please get a custom reverse DNS name from your ISP for your host 215.54.54.54 or contact abuse@corp.mail.ru in case of error
это значит, что вам необходимо корректно зарегистрировать PTR запись на DNS-сервере для вашего доменного имени.
Для этого необходимо послать запрос тому, кто выдал вам статические ip-адреса (обычно, это ваш провайдер) с просьбой зарегистрировать PTR запись для вашего домена.
PTR запись должна быть одна для одного IP (не нужно создавать две записи для основного домена (mydomain.ru) и почтового домена (mail.mydomain.ru) если оба они привязаны А-записью к одному IP)
PTR запись должна быть создана именно для MX записи. То есть, если адреса домена и почтового обменника не совпадают, то PTR создаем именно для MX записи.
Например, если домен mydomain.ru находится по адресу 22.11.33.44, а почтовый обменник (MX запись) создана для хоста mail.mydomain.ru, расположенного по адресу 11.22.33.44, то и PTR запись нужно создавать для mail.mydomain.ru:
44.33.22.11.in-addr.arpa mail.mydomain.ru
Естественно, можно "до кучи" создать обратную запись и для самого домена mydomain.ru. Она так же не помешает:
44.33.11.22.in-addr.arpa mydomain.ru
Резюмируя, необходимо сделать следующее:
1. Необходимо прописать ресурсную запись MX (MX 10 mail.don661.ru.) для основного домена "don661.ru", указав что почтовым доменом MX-сервера является "mail.don661.ru"
Это делаем мы.
Например, IP нашего don661.ru - 1.2.3.4
A don661.ru 1.2.3.4 MX 10 mail.don661.ru.
2. Создать PTR-запись на DNS сервере регистратора
IP домена "mail.don661.ru" необязательно должен совпадать с IP "don661.ru", но PTR-запись должна быть создана регистратором IP-адреса (5.6.7.8) домена "mail.don661.ru". Если у нас несколько почтовых доменов на одном почтовом сервере и все они выходят через единственный внешний IP, то PTR соответствие необходимо прописать для домена, которым именуется (hostname) сам физический почтовый сервер.
Например, сама физическая машина именуется mail.domain123.ru
(
Также для этого необходимо прописать "mail.domain123.ru" в следующих местах:
hostnamectl set-hostname mail.domain123.ru
- Cоответствие внешнего IP, для которого создаем PTR-запись, и домена mail.domain123.ru прописываем в /etc/hosts)
... 45.67.59.224 mail.domain123.ru
- Изменить настройки postfix
nano /etc/postfix/main.cf
... myhostname = mail.domain123.ru myorigin = mail.domain123.ru mydomain = mail.domain123.ru ...
)
mail.domain123.ru не обязан вообще быть почтовым доменом, но он будет в поле "helo: mail.domain123.ru" при отправке письма с любого другого почтового домена, работающего на нашем почтовом сервере. поэтому создаем ptr-запись именно для mail.domain123.ru - "8.7.6.5.in-addr.arpa mail.domain123.ru"
Это делает регистратор внешнего IP
Например, IP нашего mail.don661.ru 5.6.7.8
8.7.6.5.in-addr.arpa mail.don661.ru
Проверки
1.
host 5.6.7.8
... 8.7.6.5.in-addr.arpa domain name pointer mail.don661.ru. ...
Готово!
2.
Например, для домена mydomain.ru с адресом 215.54.54.54, необходимо зарегистрировать следующую запись:
54.54.54.215.in-addr.arpa name=mydomain.ru
А если почтовый сервер сидит на отдельном адресе, например, mail.mydomain.ru имеет адрес 215.54.54.55, то необходимо зарегистрировать еще одну PTR запись:
55.54.54.215.in-addr.arpa name=mail.mydomain.ru
Проверить наличие PTR записи на сервере DNS можно с помощью интерфейса команды NSLOOKUP:
nslookup
Теперь подключаемся к DNS-серверу провайдера:
server 215.54.54.1
Устанавливаем тип ресурсной записи:
set type=PTR
Делаем запрос на интересующий нас адрес:
215.54.54.54
В ответ мы должны получить имя своего домена mydomain.ru
SPF
SPF (Sender Policy Framework) record specifies which hosts or IP addresses are allowed to send emails on behalf of a domain. You should allow only your own email server or your ISP’s server to send emails for your domain. In your DNS management interface, create a new TXT record like below.
Add TXT-record to your main domain (for example "don661.ru", _NOT_ subdomain "mail.don661.ru"!)
A don661.ru 45.67.59.224 MX 10 mail.don661.ru. TXT v=spf1 mx ~all ^^^ THIS RECORD
Wait 5-10 minutes!
Test
dig don661.ru txt
... ;; ANSWER SECTION: don661.ru. 10 IN TXT "v=spf1 mx ~all" ...
DKIM
DKIM (DomainKeys Identified Mail) uses a private key to digitally sign emails sent from your domain. Receiving SMTP servers verify the signature by using the public key, which is published in the DNS DKIM record.
The iRedMail script automatically configured DKIM for your server. The only thing left to do is creating DKIM record in DNS manager. Run the following command to show the DKIM public key.
Add DKIM for the first mail domain (don661.ru)
Generate record in iredmail server CLI:
amavisd -c /etc/amavisd/amavisd.conf showkeys
... dkim._domainkey.don661.ru. 3600 TXT ( "v=DKIM1; p=" "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu6L+HQnFMEzYH+aETHbz" "3WYbOBXLoF/4+NHiSgXXyErE7IYkvwu4Nu02WPHczNAUCue0qRWMB5cr5b2NNoUg" "jOsjv/bHFxvrZK4/mW7Yy/8MDpbkUN/dVdeJmw8W6962woxe+YXZd5HVuBg3Xn0J" "xfqpsLBzzEGU0f+EZ/VA7yAKsuikKKWbT5Y46mj3JB548Hg2qjzzr9J2GjSQ6I9O" "YO3RcteaRTrtJpwckKv1dLT2GUK2jGlKDkSVlAuiPmVgfarZvSqvhP0qWTXSE61N" "rJHRa0Spo54U2qJBIflQ1oymY3dzHzJ7A08Vx3NJByzLbmRLQM1yuQqfrUbfPEVh" "kwIDAQAB") ...
Copy it from ""v=DKIM1..." to "...kwIDAQAB"
Remove all "" and line breaks
You'll get something like this:
v=DKIM1; p= MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu6L+HQnFMEzYH+aETHbz3WYbOBXLoF/4+NHiSgXXyErE7IYkvwu4Nu02WPHczNAUCue0qRWMB5cr5b2NNoUgjOsjv/bHFxvrZK4/mW7Yy/8MDpbkUN/dVdeJmw8W6962woxe+YXZd5HVuBg3Xn0JxfqpsLBzzEGU0f+EZ/VA7yAKsuikKKWbT5Y46mj3JB548Hg2qjzzr9J2GjSQ6I9OYO3RcteaRTrtJpwckKv1dLT2GUK2jGlKDkSVlAuiPmVgfarZvSqvhP0qWTXSE61NrJHRa0Spo54U2qJBIflQ1oymY3dzHzJ7A08Vx3NJByzLbmRLQM1yuQqfrUbfPEVhkwIDAQAB
Create subdomain "dkim._domainkey" for your main domain "don661.ru"
Create TXT-record in "dkim._domainkey" subdomain (_NOT_ for main domain "don661.ru" or subdomain "mail.don661.ru":
TXT v=DKIM1; p= MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu6L+HQnFMEzYH+aETHbz3WYbOBXLoF/4+NHiSgXXyErE7IYkvwu4Nu02WPHczNAUCue0qRWMB5cr5b2NNoUgjOsjv/bHFxvrZK4/mW7Yy/8MDpbkUN/dVdeJmw8W6962woxe+YXZd5HVuBg3Xn0JxfqpsLBzzEGU0f+EZ/VA7yAKsuikKKWbT5Y46mj3JB548Hg2qjzzr9J2GjSQ6I9OYO3RcteaRTrtJpwckKv1dLT2GUK2jGlKDkSVlAuiPmVgfarZvSqvhP0qWTXSE61NrJHRa0Spo54U2qJBIflQ1oymY3dzHzJ7A08Vx3NJByzLbmRLQM1yuQqfrUbfPEVhkwIDAQAB
Wait 5-10 minutes!
Test on iredmail server:
amavisd -c /etc/amavisd/amavisd.conf testkeys
... TESTING#1 don661.ru: dkim._domainkey.don661.ru => pass ...
Test on arbitrary server in internet:
dig dkim._domainkey.don661.ru txt
... ;; ANSWER SECTION: dkim._domainkey.don661.ru. 10 IN TXT "v=DKIM1; p= MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu6L+HQnFMEzYH+aETHbz3WYbOBXLoF/4+NHiSgXXyErE7IYkvwu4Nu02WPHczNAUCue0qRWMB5cr5b2NNoUgjOsjv/bHFxvrZK4/mW7Yy/8MDpbkUN/dVdeJmw8W6962woxe+YXZd5HVuBg3Xn0JxfqpsLBzzEGU0f+EZ/VA7yAKsuikKKWbT5Y46mj3JB548Hg2qjz" "zr9J2GjSQ6I9OYO3RcteaRTrtJpwckKv1dLT2GUK2jGlKDkSVlAuiPmVgfarZvSqvhP0qWTXSE61NrJHRa0Spo54U2qJBIflQ1oymY3dzHzJ7A08Vx3NJByzLbmRLQM1yuQqfrUbfPEVhkwIDAQAB" ...
Add second additional domain key
https://forum.iredmail.org/topic415-dkim-signing-for-additional-domains.html
1. Generate the new key.
cd /var/lib/dkim/
amavisd genrsa domain123.ru.pem
chmod 0644 domain123.ru.pem
2. Add it to your amavisd.conf file:
nano /etc/amavisd/amavisd.conf
Search for "# Add dkim_key here.", and add it alongside the others, preferably in alphabetic order so you can find it faster.
...
dkim_key("domain123.ru", "dkim", "/var/lib/dkim/domain123.ru.pem");
...
3. Add your new domain to @local_domains_maps in amavisd.conf. The line should now read something like this:
nano /etc/amavisd/amavisd.conf
# was: @local_domains_maps = 1; # now edit @local_domains_maps = ( [".$mydomain", "don661.ru", "domain123.ru"] ); # list of all local domains
4. Restart amavisd
systemctl restart amavisd
5. Test that the key was installed properly
amavisd -c /etc/amavisd/amavisd.conf showkeys
... ; key#2 1024 bits, s=dkim, d=domain123.ru, /var/lib/dkim/domain123.ru.pem dkim._domainkey.domain123.ru. 3600 TXT ( "v=DKIM1; p=" "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDaXxDmeelXeWKDYY7viovRIvMA" "ez/7Kfk9naYsDlrpKuHUVVUQ+fENPs85YVTJQthCP2sqOAxEj0//sHjuC0Gh2UFA" "8s7TW7/lC/UEXYFiyU+hAge+Tviallqk6m5z44dZAcDA5AONz619CbQKpBDt+4xA" "MWCMXChfwm6ndHEdXwIDAQAB") ...
Now add this key to DNS as the first domain!
DMARC
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. DMARC can help receiving email servers to identify legitimate emails and prevent your domain name from being used by email spoofing.
To create a DMARC record, go to your DNS manager and add a TXT record. In the name field, enter _dmarc. In the value field, enter the following. (You should create the dmarc@your-domain.com email address.)
Create subdomain "_dmarc" for your main domain "don661.ru"
Create TXT-record in "_dmarc" (_dmarc.don661.ru) subdomain (_NOT_ for main domain "don661.ru" or subdomain "mail.don661.ru":
A 45.67.59.224 TXT v=DMARC1; p=none; pct=100; rua=mailto:dmarc@don661.ru ^^^ THIS RECORD
Wait 5-10 minutes!
Test
dig _dmarc.don661.ru txt
... ;; ANSWER SECTION: _dmarc.don661.ru. 10 IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:dmarc@don661.ru" ...
General deliverability test
Go to:
Send email from your mail account of your new mail server to randomly generated service's mail address (test-avlwah6p3@srv1.mail-tester.com, for example)
Then click "Затем проверьте оценку"
Wait for tests passed
If your grade more than 8, congratulations!
Spamassasin
Configuration: It's already configured in default!
Test
- Send email to yourself from user@don661.ru to user@don661.ru with following string in its body:
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
- This email will be dropped to the SPAM folder in your mailbox
ClamAV
DB update mirrors
Set one of the links in param "DatabaseMirror" in /etc/freshclam.conf
pivotal-clamav-mirror.s3.amazonaws.com https://clamav.jinr.ru https://packages.microsoft.com/clamav/
Then remove the freshclam.dat file and restart the service:
rm -f /var/lib/clamav/freshclam.dat
systemctl restart clamav-freshclam
Test
- Download file https://secure.eicar.org/eicar.com.txt
- Send email with this file attached to yourself from user@don661.ru to user@don661.ru
- See /var/log/maillog, you'l see something like "Blocked INFECTED", and you'll not get this email
Conclusion
After the above setting, my sended mail from cless@don661.ru was graded as 9.5/10 scores at www.mail-tester.com and took on google and yandex without drop in spam.
Hints
Message size limit (message size itself + attached file size).
https://docs.iredmail.org/change.mail.attachment.size.html
You have to set limits in the each following entity.
In this example we make limit ast 30MB for attachment
Postfix limit
nano /etc/postfix/main.cf
... message_size_limit = 36700160 # 35MB ...
systemctl restart postfix
Roundcube limit
Note: Roundcube preserves some percentage of the max message size (search 1.33 on this page, so if you set the max to 100M, it tells you only 75MB is allowed (100 / 1.33). This is better because email messsage will be encoded before sending to MTA and the encoded attachment is larger than the original file.
nano /opt/www/roundcubemail-1.5.3/config/config.inc.php
... $config['max_message_size'] = '40M'; # max summ message size (not file) ...
Nginx limit
nano /etc/nginx/sites-available/00-default-ssl.conf
...
server {
...
client_max_body_size 30M; # max size of a message
client_body_timeout 300s; # timeout while upload attachment, otherwise upload may be canceled by timeout in case of a low upload speed, for example
}
systemctl restart nginx
PHP limit
nano /etc/php.ini
... post_max_size = 35M; upload_max_filesize = 35M; ...
reboot
ERROR Inbound messages don't come
Log
cat /var/log/maillog:
"Recipient address rejected: Intentional policy rejection, please try again"
Description
This is OK. Greylisting service drop the first attempt of the remote mail service (e.g. @gmail.com) to send message, if remote service tries one more time - it will be received. It's a protection from spammers. Spammers doubtfully will send the message for the second time.
Solution
1. https://docs.iredmail.org/manage.iredapd.html#how-to-disable-whiteblacklists-completely
To disable white/blacklists completely, please remove plugin name amavisd_wblist in iRedAPD config file /opt/iredapd/settings.py, parameter "plugins =":
# remove 'greylisting', 'amavisd_wblist' from here:
nano /opt/iRedAPD-5.1/settings.py
... plugins = [..., 'greylisting', ..., 'amavisd_wblist', ...] ...
2. (I'm not sure that it worked) Put remote mail domain to the whitelist
/opt/iRedAPD-5.1/tools/greylisting_admin.py --whitelist-domain --from '@google.com'
... * Whitelisting sender domain: gmail.com ...
Increase default mailbox size for new user (when you create one in the web-interface iRedMailAdmin):
mysql -uroot -p
Password for mariadb, that you type during iRedMail installation
MariaDB [(none)]> USE vmail;
4096 - 4GB don661.ru - user's domain
MariaDB [(none)]> UPDATE domain SET settings = 'default_user_quota:4096;' WHERE domain = 'don661.ru';
Forbid to send output messages for particular user
mysql -u root -p
MariaDB [none]> USE vmail;
Show tables
MariaDB [vmail]> SHOW TABLES;
Forbid
MariaDB [vmail]> UPDATE `mailbox` SET `enablesmtp` = '0', `enablesmtpsecured` = '0' WHERE `username` = 'cless@don661.ru' ;
MariaDB [vmail]> SELECT username,enablesmtp,enablesmtpsecured FROM mailbox;
+----------------------+------------+-------------------+ | username | enablesmtp | enablesmtpsecured | +----------------------+------------+-------------------+ | cless@don661.ru | 0 | 0 | +----------------------+------------+-------------------+
Allow
MariaDB [vmail]> UPDATE `mailbox` SET `enablesmtp` = '1', `enablesmtpsecured` = '1' WHERE `username` = 'cless@don661.ru' ;
Roundcube
Create new messages with HTML-EDITOR by default:
nano /opt/www/roundcubemail-1.5.3/config/defaults.inc.php
... $config['htmleditor'] = 1; ...
Renew Roundcube page
Desktop mail clients
Thunderbird
Username: user@don661.ru
IMAP:
Domain: mail.don661.ru Port: 143 Encryption type: STARTTLS
SMTP:
Domain: mail.don661.ru Port: 587 Encryption type: STARTTLS