Overview

• What you’ll learn: How to integrate Postfix, Dovecot, OpenDKIM, SpamAssassin, and Let’s Encrypt TLS into a complete, production-ready mail server stack on Ubuntu — from DNS setup through final testing and monitoring.
• Prerequisites: All previous Mail Services lessons (Email Protocols, Postfix, Dovecot, SPF/DKIM/DMARC, Exim4)
• Estimated reading time: 22 minutes

Introduction

In the previous lessons, you learned about each component of a mail server individually — Postfix for SMTP, Dovecot for IMAP/POP3, OpenDKIM for message signing, and SPF/DKIM/DMARC for authentication. Now it is time to bring everything together into a cohesive, production-ready mail stack.

Building a complete mail server requires careful coordination between components. Postfix must hand off delivered mail to Dovecot, Dovecot must authenticate users for Postfix, OpenDKIM must sign outgoing messages, TLS certificates must be shared across services, and DNS records must be correctly configured to support all authentication mechanisms.

In this lesson, you will walk through the complete integration process, from DNS planning through final testing. By the end, you will have a fully functional mail server capable of sending, receiving, and securing email for your domain.

DNS Foundation

A properly functioning mail server begins with correct DNS configuration. Before installing any software, you need to set up all the required DNS records for your domain.

# Required DNS records for mail.example.com

# A record — points your mail server hostname to its IP
mail.example.com.       IN  A     203.0.113.10

# MX record — tells other servers where to send mail for your domain
example.com.            IN  MX    10 mail.example.com.

# Reverse DNS (PTR) — maps IP back to hostname (set via your hosting provider)
10.113.0.203.in-addr.arpa.  IN  PTR  mail.example.com.

# SPF record — authorizes your mail server to send for this domain
example.com.            IN  TXT   "v=spf1 mx a:mail.example.com -all"

# DKIM record — public key for signature verification
mail._domainkey.example.com.  IN  TXT  "v=DKIM1; h=sha256; k=rsa; p=MIIBIjAN..."

# DMARC record — authentication policy and reporting
_dmarc.example.com.     IN  TXT   "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100"

# Verify all DNS records
$ dig +short A mail.example.com
203.0.113.10
$ dig +short MX example.com
10 mail.example.com.
$ dig +short TXT example.com | grep spf
"v=spf1 mx a:mail.example.com -all"
$ dig +short TXT mail._domainkey.example.com
"v=DKIM1; h=sha256; k=rsa; p=MIIBIjAN..."
$ dig +short TXT _dmarc.example.com
"v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100"

# Check reverse DNS
$ dig +short -x 203.0.113.10
mail.example.com.

Integrated Stack Installation

Install all components in a single step, then configure them to work together. The installation order matters because some packages prompt for configuration during installation.

# Install the complete mail stack
$ sudo apt update
$ sudo apt install -y 
    postfix 
    dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd 
    opendkim opendkim-tools 
    spamassassin spamc 
    certbot

# Obtain TLS certificates with Let's Encrypt
$ sudo certbot certonly --standalone -d mail.example.com 
    --agree-tos --email admin@example.com

# Set up automatic certificate renewal with post-hook
$ sudo cat > /etc/letsencrypt/renewal-hooks/post/mail-services.sh << 'SCRIPT'
#!/bin/bash
systemctl reload postfix
systemctl reload dovecot
SCRIPT
$ sudo chmod +x /etc/letsencrypt/renewal-hooks/post/mail-services.sh

# Create mail user (virtual or system)
$ sudo useradd -m -s /usr/sbin/nologin -G mail mailuser
$ sudo passwd mailuser

# Create Maildir structure
$ sudo -u mailuser mkdir -p /home/mailuser/Maildir/{cur,new,tmp}

Postfix Configuration for Integration

# /etc/postfix/main.cf — Complete integrated configuration

# Basic identity
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

# Network settings
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
inet_interfaces = all
inet_protocols = all

# TLS for incoming connections
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_tls_security_level = may
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

# TLS for outgoing connections
smtp_tls_security_level = may
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# Dovecot SASL authentication
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes

# Dovecot LMTP delivery
mailbox_transport = lmtp:unix:private/dovecot-lmtp

# DKIM via OpenDKIM milter
milter_default_action = accept
milter_protocol = 6
smtpd_milters = local:opendkim/opendkim.sock
non_smtpd_milters = $smtpd_milters

# SpamAssassin via milter (or content_filter)
content_filter = spamassassin

# Security restrictions
smtpd_recipient_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    reject_unauth_destination,
    reject_invalid_hostname,
    reject_non_fqdn_sender,
    reject_non_fqdn_recipient,
    reject_unknown_sender_domain,
    reject_unknown_recipient_domain
smtpd_helo_required = yes
disable_vrfy_command = yes
message_size_limit = 26214400
smtpd_banner = $myhostname ESMTP

Service Integration and Testing

With all components configured, restart every service and run a comprehensive test to verify the integration works end-to-end.

# Restart all services in the correct order
$ sudo systemctl restart opendkim
$ sudo systemctl restart spamassassin
$ sudo systemctl restart dovecot
$ sudo systemctl restart postfix

# Enable all services to start at boot
$ sudo systemctl enable opendkim spamassassin dovecot postfix

# Verify all services are running
$ sudo systemctl status opendkim dovecot postfix spamassassin --no-pager

# Test SMTP submission (port 587 with TLS)
$ openssl s_client -starttls smtp -connect mail.example.com:587
250 DSN
EHLO test.example.com
250-mail.example.com
250-PIPELINING
250-SIZE 26214400
250-STARTTLS
250-AUTH PLAIN LOGIN
250 8BITMIME

# Test IMAP (port 993 with implicit TLS)
$ openssl s_client -connect mail.example.com:993
* OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE] Dovecot ready.
a1 LOGIN user@example.com password
a1 OK [CAPABILITY IMAP4rev1 SORT] Logged in
a2 SELECT INBOX
* 0 EXISTS
a2 OK [READ-WRITE] Select completed.

# Send a test email and verify the full chain
$ echo "Test email body" | mail -s "Integration Test" -r sender@example.com recipient@example.com

# Check the mail log for the complete flow
$ sudo tail -50 /var/log/mail.log | grep -E "postfix|dovecot|opendkim"
# Expected flow:
# 1. postfix/smtpd: received message
# 2. opendkim: DKIM-Signature field added
# 3. postfix/lmtp: delivered to dovecot
# 4. dovecot/lmtp: saved to INBOX

# Verify DKIM signing
$ sudo grep "DKIM-Signature" /var/log/mail.log

# Use doveadm to check delivery
$ sudo doveadm mailbox status -u mailuser messages INBOX
INBOX messages=1

Monitoring and Maintenance

A production mail server requires ongoing monitoring to ensure deliverability, detect issues, and maintain security. Set up monitoring for key metrics and establish maintenance procedures.

# Monitor the mail queue for backlog
$ mailq | tail -1
-- 0 Kbytes in 0 Requests.

# Set up a cron job to alert on queue growth
$ sudo crontab -e
# Check mail queue every 5 minutes
*/5 * * * * QUEUE=$(mailq | tail -1 | awk '{print $5}'); 
  [ "$QUEUE" -gt 50 ] && echo "Mail queue: $QUEUE messages" | 
  mail -s "ALERT: Mail queue backlog" admin@example.com

# Monitor authentication failures
$ sudo grep "authentication failed" /var/log/mail.log | tail -20

# Check TLS certificate expiration
$ sudo certbot certificates
Certificate Name: mail.example.com
  Expiry Date: 2026-06-01 (VALID: 89 days)

# Regular maintenance tasks:
# 1. Monitor /var/log/mail.log for errors
# 2. Check DMARC aggregate reports (daily XML emails)
# 3. Review spam filter effectiveness
# 4. Verify TLS certificate auto-renewal
# 5. Update SpamAssassin rules
$ sudo sa-update && sudo systemctl restart spamassassin

# Check mail server reputation and blacklist status
# Use online tools: mxtoolbox.com/blacklists.aspx
# Or from the command line:
$ dig +short A mail.example.com.zen.spamhaus.org
# No response = not blacklisted
# 127.0.0.x response = blacklisted

Key Takeaways

• A complete mail stack requires coordinated DNS records (A, MX, PTR, SPF, DKIM, DMARC), Postfix for SMTP, Dovecot for IMAP/POP3, OpenDKIM for signing, and TLS certificates for encryption.
• Postfix and Dovecot integrate via two Unix sockets: LMTP for mail delivery and SASL for authentication; both sockets are placed in Postfix's chroot directory at /var/spool/postfix/private/.
• Let's Encrypt certificates should be shared between Postfix and Dovecot with a renewal post-hook that reloads both services automatically.
• Comprehensive SMTP restrictions (reject_unauth_destination, reject_unknown_sender_domain, HELO required) protect against spam and abuse while allowing legitimate mail through.
• Ongoing monitoring of the mail queue, authentication logs, TLS certificates, DMARC reports, and blacklist status is essential for maintaining a healthy production mail server.

What's Next

You have completed the Mail Services module. You now have the knowledge to build, secure, and maintain a complete email infrastructure on Linux. The skills you have learned — SMTP, IMAP, Postfix, Dovecot, TLS, SPF, DKIM, and DMARC — form the foundation for managing email services in any production environment.

# mail.example.com 所需的 DNS 記錄

# A 記錄 — 將郵件伺服器主機名指向其 IP
mail.example.com.       IN  A     203.0.113.10

# MX 記錄 — 告訴其他伺服器將郵件發送到哪裡
example.com.            IN  MX    10 mail.example.com.

# 反向 DNS（PTR）— 將 IP 映射回主機名
10.113.0.203.in-addr.arpa.  IN  PTR  mail.example.com.

# SPF 記錄
example.com.            IN  TXT   "v=spf1 mx a:mail.example.com -all"

# DKIM 記錄
mail._domainkey.example.com.  IN  TXT  "v=DKIM1; h=sha256; k=rsa; p=MIIBIjAN..."

# DMARC 記錄
_dmarc.example.com.     IN  TXT   "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100"

# 驗證所有 DNS 記錄
$ dig +short A mail.example.com
$ dig +short MX example.com
$ dig +short TXT example.com | grep spf

# 安裝完整的郵件堆疊
$ sudo apt update
$ sudo apt install -y 
    postfix 
    dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd 
    opendkim opendkim-tools 
    spamassassin spamc 
    certbot

# 使用 Let's Encrypt 取得 TLS 憑證
$ sudo certbot certonly --standalone -d mail.example.com

# 設定自動憑證更新及後置掛鉤
$ sudo cat > /etc/letsencrypt/renewal-hooks/post/mail-services.sh << 'SCRIPT'
#!/bin/bash
systemctl reload postfix
systemctl reload dovecot
SCRIPT
$ sudo chmod +x /etc/letsencrypt/renewal-hooks/post/mail-services.sh

# /etc/postfix/main.cf — 完整的整合設定

myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

# TLS
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_tls_security_level = may

# Dovecot SASL 身份驗證
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes

# Dovecot LMTP 投遞
mailbox_transport = lmtp:unix:private/dovecot-lmtp

# OpenDKIM
milter_default_action = accept
milter_protocol = 6
smtpd_milters = local:opendkim/opendkim.sock
non_smtpd_milters = $smtpd_milters

# 安全限制
smtpd_recipient_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    reject_unauth_destination,
    reject_invalid_hostname,
    reject_non_fqdn_sender
smtpd_helo_required = yes
disable_vrfy_command = yes

# 按正確順序重新啟動所有服務
$ sudo systemctl restart opendkim
$ sudo systemctl restart spamassassin
$ sudo systemctl restart dovecot
$ sudo systemctl restart postfix

# 啟用所有服務在開機時啟動
$ sudo systemctl enable opendkim spamassassin dovecot postfix

# 驗證所有服務正在運行
$ sudo systemctl status opendkim dovecot postfix spamassassin --no-pager

# 測試 SMTP 提交（連接埠 587，TLS）
$ openssl s_client -starttls smtp -connect mail.example.com:587

# 測試 IMAP（連接埠 993，implicit TLS）
$ openssl s_client -connect mail.example.com:993

# 檢查郵件日誌以驗證完整流程
$ sudo tail -50 /var/log/mail.log | grep -E "postfix|dovecot|opendkim"

# 監控郵件佇列
$ mailq | tail -1

# 監控身份驗證失敗
$ sudo grep "authentication failed" /var/log/mail.log | tail -20

# 檢查 TLS 憑證到期時間
$ sudo certbot certificates

# 更新 SpamAssassin 規則
$ sudo sa-update && sudo systemctl restart spamassassin

# 檢查郵件伺服器聲譽和黑名單狀態
$ dig +short A mail.example.com.zen.spamhaus.org

# mail.example.com に必要な DNS レコード

# A レコード — メールサーバーのホスト名を IP に紐付け
mail.example.com.       IN  A     203.0.113.10

# MX レコード — 他のサーバーにメールの送信先を指示
example.com.            IN  MX    10 mail.example.com.

# 逆引き DNS（PTR）— IP をホスト名にマッピング
10.113.0.203.in-addr.arpa.  IN  PTR  mail.example.com.

# SPF レコード
example.com.            IN  TXT   "v=spf1 mx a:mail.example.com -all"

# DKIM レコード
mail._domainkey.example.com.  IN  TXT  "v=DKIM1; h=sha256; k=rsa; p=MIIBIjAN..."

# DMARC レコード
_dmarc.example.com.     IN  TXT   "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100"

# すべての DNS レコードを確認
$ dig +short A mail.example.com
$ dig +short MX example.com
$ dig +short TXT example.com | grep spf

# 完全なメールスタックのインストール
$ sudo apt update
$ sudo apt install -y 
    postfix 
    dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd 
    opendkim opendkim-tools 
    spamassassin spamc 
    certbot

# Let's Encrypt で TLS 証明書を取得
$ sudo certbot certonly --standalone -d mail.example.com

# 証明書更新のポストフックを設定
$ sudo cat > /etc/letsencrypt/renewal-hooks/post/mail-services.sh << 'SCRIPT'
#!/bin/bash
systemctl reload postfix
systemctl reload dovecot
SCRIPT
$ sudo chmod +x /etc/letsencrypt/renewal-hooks/post/mail-services.sh

# /etc/postfix/main.cf — 完全な統合設定

myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

# TLS
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_tls_security_level = may

# Dovecot SASL 認証
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes

# Dovecot LMTP 配信
mailbox_transport = lmtp:unix:private/dovecot-lmtp

# OpenDKIM
milter_default_action = accept
milter_protocol = 6
smtpd_milters = local:opendkim/opendkim.sock
non_smtpd_milters = $smtpd_milters

# セキュリティ制限
smtpd_recipient_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    reject_unauth_destination,
    reject_invalid_hostname,
    reject_non_fqdn_sender
smtpd_helo_required = yes
disable_vrfy_command = yes

# 正しい順序ですべてのサービスを再起動
$ sudo systemctl restart opendkim
$ sudo systemctl restart spamassassin
$ sudo systemctl restart dovecot
$ sudo systemctl restart postfix

# すべてのサービスを起動時に有効化
$ sudo systemctl enable opendkim spamassassin dovecot postfix

# すべてのサービスが実行中であることを確認
$ sudo systemctl status opendkim dovecot postfix spamassassin --no-pager

# SMTP 送信テスト（ポート 587、TLS）
$ openssl s_client -starttls smtp -connect mail.example.com:587

# IMAP テスト（ポート 993、暗黙的 TLS）
$ openssl s_client -connect mail.example.com:993

# メールログで完全なフローを確認
$ sudo tail -50 /var/log/mail.log | grep -E "postfix|dovecot|opendkim"

# メールキューのモニタリング
$ mailq | tail -1

# 認証失敗のモニタリング
$ sudo grep "authentication failed" /var/log/mail.log | tail -20

# TLS 証明書の有効期限を確認
$ sudo certbot certificates

# SpamAssassin ルールの更新
$ sudo sa-update && sudo systemctl restart spamassassin

# メールサーバーの評判とブラックリストステータスの確認
$ dig +short A mail.example.com.zen.spamhaus.org