Mail services: Postfix, Dovecot, SPF, DKIM, DMARC
You run your own mail server with Postfix and Dovecot, protect your domain from spoofing with SPF, DKIM and DMARC, and trace undelivered mail.
Level 301 · 20 lessons · 18 practice labs
Lessons
Mail flow
- A message’s journey: MUA, MTA, MDA
- MX records and delivery order
- Installing Postfix and the basic settings
- The mail queue: mailq, postqueue, postsuper
- Short task: send mail between two lab domains
Mailboxes and secure connections
- IMAP with Dovecot
- SMTP authentication and the 587 submission port
- Encrypted mail with STARTTLS and TLS
- Open relays: why they are dangerous and how to test
- Short task: let only authenticated users send mail
Protecting the domain
- Writing an SPF record
- Signing mail with OpenDKIM
- DMARC policy and reports
- Recognising a spoofed message from its headers
- Spam filtering with Rspamd
- Short task: protect a domain with SPF, DKIM and DMARC
Operations
- Bounces and delivery errors
- Tracing a message through the mail logs
- Short task: track down a lost invoice email
Wrap-up
- Capstone: a secure mail service for a small company
Practice labs
- Inbound mail vanishes: there is no MX: Find why mail from the second lab domain never arrives, add the correct MX and A records to the zone and show a test message landing in the mailbox.
- The backup MX is being tried first: Fix the domain whose MX priorities are reversed and prove with two tests that the backup server only receives mail while the primary is down.
- Mail keeps looping back to itself: Untangle from the logs the mail loop caused by mismatched mydestination, myhostname and MX on Caravan Travel’s Postfix server, fix the configuration and show delivery both ways between the two domains.
- Hundreds of messages stuck in the queue: Use postqueue to find why messages are deferred in the queue, fix the cause, flush the queue and show from the log that they were delivered.
- The order confirmation never reached the customer: Trace Piril Bakery’s lost order confirmation through the mail logs by queue ID, find at which stage and why it was dropped and write a short delivery report.
- A storm of bounced mail: Find the source of the bounces filling the queue (backscatter, missing recipient validation), clear the junk with postsuper and make the server reject unknown recipients during the SMTP dialogue.
- Staff cannot send mail: 587 is closed: Enable the 587 submission port in Postfix with SASL authentication and show a client sending a message with a username and password.
- Is the server relaying for anyone?: On your own lab server, try sending from an outside address to another outside address, prove it is an open relay, fix the relay restrictions and show the same test is refused.
- Only one subnet seems able to relay: On the Saltmarsh Fisheries server, find and fix three faults—an over-broad mynetworks, a wrongly ordered restriction list and unauthenticated submission—and give a separate test result for each.
- The mailbox will not open: Dovecot login: Fix the mailbox location or authentication error in Dovecot and show a user listing their messages over IMAP with openssl s_client.
- STARTTLS is offered, but does it work?: Attach a valid certificate to Postfix, test the STARTTLS handshake and show in the log that delivery between the two domains used TLS.
- Passwords are crossing the network in clear text: Find clear-text POP3/IMAP/SMTP logins in traffic captured on the lab network, disable clear-text authentication on the server and prove a new capture shows no passwords.
- Mail lands in spam: SPF is missing: Identify the domain’s sending servers, write the correct SPF record and show spf=pass in the receiving side’s headers.
- The DKIM signature does not verify: Find why messages signed by OpenDKIM fail at the receiver (selector name, key in DNS, truncated TXT record), fix it and show dkim=pass.
- Move DMARC from none to reject: Review Copperleaf Insurance’s DMARC aggregate reports, find and fix the legitimate but unaligned sender, then move the policy to reject and prove a forged sender is refused.
- A payment request in the boss’s name: Examine the full headers of the given message, list the inconsistencies in From, Return-Path, the Received chain and authentication results and write down why it is forged.
- An invoice from a domain one letter off: Find the messages to Demirhan Machinery that came from look-alike domains, write an Rspamd rule for them and show a test message being flagged.
- The spam filter is swallowing invoices too: Pull out from the Rspamd logs the rules and scores causing false positives, tune the thresholds and allow list, and show with sample messages that spam is caught while invoices get through.
About this course
You run your own mail server with Postfix and Dovecot, protect your domain from spoofing with SPF, DKIM and DMARC, and trace undelivered mail.
What you will learn
- Mail flow
- Mailboxes and secure connections
- Protecting the domain
- Operations
- Wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.