DNS for Mail

Running a mail server requires a proper DNS records.

Before you begin

This guide assumes that you have already set up a properly functioning name server using nsd. If you have not already, you will want to read up on basic DNS concepts and set up your name server.

Adding to the zone file

For mail, you will need to add DNS records. Let's take a look at a sample zone file containing only what is needed to handle mail:

$ORIGIN and Start of Authority (SOA) record:

$ORIGIN example.com.
example.com.     3600   SOA   ns1.example.com. admin.example.com. (
                            2021050302   ; serial YYYYMMDDnn
                            1800        ; refresh
                            3600         ; retry
                            86400       ; expire
                            3600 )      ; minimum TTL

Here we define the $ORIGIN to be example.com. The $ORIGIN will be appended to every record to produce a fully qualified domain name. Make sure to read up on FQDN if you do not understand what that means.

The Start of Authority record ? says that the serial number was last updated on May 3rd, 2021; that the refresh interval is 1800 seconds, the retry interval is 3600 seconds, the record expires after 1 day, and the minimum time to live is 3600 seconds.

        3600    IN      MX      10 mail
        3600    IN      A       38.81.163.143
        3600    IN      AAAA    2602:fccf:1:143::
        3600    IN      NS      ns1
        3600    IN      NS      ns2
mail    3600    IN      A       38.81.163.143
        3600    IN      AAAA    2602:fccf:1:143::
pop     3600    IN      A       38.81.163.143
        3600    IN      AAAA    2602:fccf:1:143::
imap    3600    IN      A       38.81.163.143
        3600    IN      AAAA    2602:fccf:1:143::
smtp    3600    IN      A       38.81.163.143
        3600    IN      AAAA    2602:fccf:1:143::

When there is no name for the record, it just takes on the value of $ORIGIN: example.com.

Line 1 defines the mail exchange (MX) record for example.com. When another mail server sends your server mail, it will perform two DNS queries. First, it asks what your MX record is for example.com:

$ dig +short -t mx example.com
10 mail.example.com.

Here, the MX record for example.com is mail.example.com with a value of 10. This means that mail.example.com is the actual mail server that will handle mail.

Once an MX record is returned, the mail server will find the A/AAAA record for that mail server:

$ dig +short -t a mail.example.com
38.81.163.143

Normally, a domain will have multiple MX records so that if one mail server goes offline, another can continue serving mail. Most mail servers will choose the MX record with the lowest value to deliver to first.

SPF record

You'll want to add a TXT record in your domain's DNS zone for SPF:

        3600    IN      TXT     "v=spf1 mx -all"

This simple SPF record allows any mail exchange (MX) server for the domain to send mail, but no others.

DMARC records

_dmarc  3600   IN      TXT     "v=DMARC1;p=none;pct=0;fo=1;rua=mailto:postmaster@example.com;ruf=mailto:postmaster@example.com"

This record will provide you with reports for DKIM/SPF but will not filter any mail. It's useful for diagnosing problems with your configuration.

DKIM records

You will need to follow the instructions for creating a proper DKIM record:

First, you will need to create a public and private DKIM key:

$ openssl genrsa -out private.key 1024
$ openssl rsa -in private.key -pubout -out public.key
$ chmod og-rwx private.key
$ chmod og-wx public.key
$ chmod u-w public.key private.key
$ doas mkdir -m 770 /etc/mail/dkim
$ doas mv private.key public.key /etc/mail/dkim/
$ doas chown -R _dkimsign:_dkimsign /etc/mail/dkim/

We then create a DKIM record by taking the public key, removing the first and last line, then joining all the lines together:

$ doas cat /etc/mail/dkim/public.key | awk '/-----/{if (NR!=1)print "";next}{printf $0}' -

Running this command on public.key should produce text like the following:

MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCmseF9Dm8Dx1LtmLMD56d628JBNaQus8aEcdYYzvBVQ4rhetZzv/ZMafjTEf2RLoOQ+pb7pqL4G86lCZSF+Eeu2ODWQQGYqGVV0xUK5QJSnsGF5UKKscrxmTHSPPtoAQJt25fxNd3PtvH2ZonAGkZkntk+u6Wn5xxlI9hMOVxLUwIDAQAB

This key should go into the DKIM DNS records to replace <public key>:

_adsp._domainkey   86400   IN      TXT     "dkim=discardable;"
mail._domainkey   86400   IN      TXT     "k=rsa; t=s; p=<public key>"

The final result should look like this:

_adsp._domainkey   86400   IN      TXT     "dkim=discardable;"
mail._domainkey    86400   IN      TXT     "k=rsa; t=s; p=8AMIIBCgKCAQEAyBhtr90v64hQTfw1sUtFPg5bYXF/SxUTNMziGJMql81av47DG+cDEPmQW0XN8+Tb8yIwenh01hZ5Xh1gjWg1v8OIrnErf3482B8XRZykHJQUdjcALnZ9gGZ9CnzAhIC3TsAnTDSHdgk3c0oqJeilriW0EIAkV2+x1jWlPunGJgJT/bSc2rzZsZv2gZmrrR+2f4aK7xTamAyFUl+cSP/kcoHbEmvXEOtqTQZTTDhxM6BKELUO0xBBhlrsq8C3q92OqZtwflK+IbJDyQPndORMR7R4itIj6O+LMFlYziPitM4egw3KADLZSlycJuTLkhCG5b/3VHFy+uUn3kQc+/s17QIDAQAB"

Note: the _adsp records come from RFC5617 which was marked as historic in 2013. More testing is necessary to determine if these records are really needed.

Whitelists

dnswl is a DNS whitelist that is free of charge, so you should sign up for it.