Changes

From SME Server
Jump to navigationJump to search

Email/fr (view source)

Revision as of 20:30, 27 April 2022

5,584 bytes added ,  20:30, 27 April 2022
no edit summary
Line 661: Line 661:  
[[File:Screen Shot 2019-12-04 at 6.44.18 AM.png|450px]]
 
[[File:Screen Shot 2019-12-04 at 6.44.18 AM.png|450px]]
   −
==Server Settings==
+
==Réglages du serveur==
 
===qmail ConcurrencyLocal===
 
===qmail ConcurrencyLocal===
−
The default value for /var/qmail/control/concurrencylocal is 20. This setting controls the maximum amount of simultaneous local deliveries.
+
La valeur par défaut pour /var/qmail/control/concurrencylocal est 20. Ce réglage controle le nombre maximum d'envois simultanés en local.
   −
There is a optional database property (does not show unless changed from the default setting) called ConcurrencyLocal for qmail in the config database. The ConcurrencyLocal property changes the value stored in /var/qmail/control/concurrencylocal.
+
Il y a une propriété optionnelle de la base de données (qui n'apparaît pas jusqu'à qu'elle soit modifiée de sa valeur par défaut) dénommée ConcurrencyLocal pour qmail dans la base de données de configuration. La propriété ConcurrencyLocal change la valeur enregistrée dans /var/qmail/control/concurrencylocal.
   −
It can be set, for example to decrease the local concurrency limit
+
Elle peut être réglée, par exemple, pour diminuer la limite de concurrence :
 
  config setprop qmail ConcurrencyLocal 6
 
  config setprop qmail ConcurrencyLocal 6
 
  signal-event email-update
 
  signal-event email-update
    
===qmail ConcurrencyRemote===
 
===qmail ConcurrencyRemote===
−
The default value for /var/qmail/control/concurrencyremote is 20. This setting controls the maximum amount of simultaneous remote deliveries.
+
La valeur par défaut pour /var/qmail/control/concurrencyremote est 20. Ce réglage controle le nombre maximum d'envois simultanés à distance.
   −
There is a optional database property (does not show unless changed from the default setting) called ConcurrencyRemote for qmail in the config database. The ConcurrencyRemote property changes the value stored in /var/qmail/control/concurrencyremote.  
+
Il y a une propriété optionnelle de la base de données (qui n'apparaît pas jusqu'à qu'elle soit modifiée de sa valeur par défaut) dénommée ConcurrencyRemote pour qmail dans la base de données de configuration. La propriété ConcurrencyRemote change la valeur enregistrée dans /var/qmail/control/concurrencyremote.  
   −
It can be set, for example to decrease the remote concurrency limit
+
Elle peut être réglée, par exemple, pour diminuer la limite de concurrence à distance :
 
  config setprop qmail ConcurrencyRemote 10
 
  config setprop qmail ConcurrencyRemote 10
 
  signal-event email-update
 
  signal-event email-update
   −
Refer also this comment by CB
+
Se référer également à ce commentaire de CB http://forums.contribs.org/index.php/topic,50091.msg251320.html#msg251320
   −
http://forums.contribs.org/index.php/topic,50091.msg251320.html#msg251320
+
===Pendant combien de temps renvoyer un courriel avant de le déclarer comme non livrable===
−
 
+
Pour configurer la durée pendant laquelle le serveur SME essaiera de livrer un message avant de renvoyer une erreur permanente :
−
===How long retry before return e-mail as undeliverable===
  −
To configure how long SME server will try to delivery a message before return a permanent error
      
  mkdir -p /etc/e-smith/templates-custom/var/qmail/control
 
  mkdir -p /etc/e-smith/templates-custom/var/qmail/control
Line 692: Line 690:  
  sv t qmail
 
  sv t qmail
   −
The default value is 604800 seconds, or one week.<br>
+
La valeur par défaut est 604800 secondes, soit une semaine.<br>
−
The example above shows 172800 seconds, or two days (a weekend for infra upgrade!)
+
L'exemple ci-dessus montre 172800 secondes, soit deux jours (une fin de semaine pour la mise à niveau infra !)
    
source: http://forums.contribs.org/index.php/topic,47471.0.html
 
source: http://forums.contribs.org/index.php/topic,47471.0.html
      −
===Double bounce messages===
+
===Messages à double rebond===
−
To stop admin receiving double bounce messages
+
Pour empêcher l'administrateur de recevoir des messages à double rebond :
   −
config setprop qmail DoubleBounceTo someoneuser
+
  config setprop qmail DoubleBounceTo nom_d_utilisateur
−
signal-event email-update
+
  signal-event email-update
   −
Or just delete them. You risk losing legitimate double bounces (which are
+
Ou simplement les supprimer. Vous risquez de perdre des doubles rebonds légitimes (qui sont rares, mais vous voulez les regarder quand ils se produisent) :
−
rare, but you want to look at them when they do occur)
     −
config setprop qmail DoubleBounceTo devnull
+
  config setprop qmail DoubleBounceTo devnull
−
signal-event email-update
+
  signal-event email-update
   −
see a longer explaination [[Email_delete_double-bounce_messages | here]]
+
Voir une explication plus longue [[Email_delete_double-bounce_messages | ici]].
   −
===Keep a copy of all emails===
+
===Conservez une copie de tous les courriels===
−
You may need to keep a copy of all emails sent to or from your email server.
+
Vous devrez peut-être conserver une copie de tous les e-mails envoyés vers ou depuis votre serveur de messagerie.
−
This may be for legal, or other reasons.
+
Cela peut être pour des raisons juridiques ou autres.
   −
The following instructions will create a new user account (maillog) and forward every email that goes through your SME server to it.
+
Les instructions suivantes créeront un nouveau compte utilisateur (maillog par défaut) et lui transmettront tous les courriels qui transitent par votre serveur SME.
   −
First, log onto the server-manager and create the user '''maillog'''
+
Tout d'abord, connectez-vous au gestionnaire de serveur et créez l'utilisateur '''maillog'''.
   −
Go to the SME Command Line (logon as root) and issue the following commands:
+
Accédez à la ligne de commande SME (connectez-vous en tant qu'utilisateur root) et émettez les commandes suivantes :
    
  config setprop qpsmtpd Bcc enabled
 
  config setprop qpsmtpd Bcc enabled
 
  signal-event email-update
 
  signal-event email-update
   −
Optionally make the forwarding of the emails invisible to the end user. Without it, there will be an X-Copied-To: header in each email. Run this command before the signal-event
+
En option, rendez le transfert des courriels invisible pour l'utilisateur final. Sans cela, il y aura un en-tête X-Copied-To: dans chaque courriel. Exécutez cette commande avant le « signal-event » :
    
  config setprop qpsmtpd BccMode bcc
 
  config setprop qpsmtpd BccMode bcc
   −
If you want to view the emails, point your email client at the SME and log on as maillog.
+
Si vous souhaitez afficher les courriels, pointez votre client de messagerie vers le SME et connectez-vous en tant que maillog.
 +
 
 +
Vous pouvez modifier l'utilisateur par défaut :
 +
 
 +
config setprop qpsmtpd BccUser someuser
    
====Keep a copy of outgoing emails only====
 
====Keep a copy of outgoing emails only====
Line 752: Line 753:  
More info:
 
More info:
 
  perldoc /usr/share/qpsmtpd/plugins/bcc
 
  perldoc /usr/share/qpsmtpd/plugins/bcc
−
      
===Set Helo hostname===
 
===Set Helo hostname===
Line 766: Line 766:  
  signal-event email-update
 
  signal-event email-update
   −
===Régler la taille maximale des courriels===
+
===Set max email size===
   −
* IMPORTANT : [[bugzilla: 7876]] souligne que si votre système a ''/var/service/qpsmtpd/config/databytes'', cela doit être supprimé. (Corrigé depuis cette version de smeserver-qpsmtpd-2.4.0-7.el6.sme.noarch - voir [[bugzilla: 8329]]).
+
*IMPORTANT: [[bugzilla: 7876]] points out that if your system has ''/var/service/qpsmtpd/config/databytes'' it should be deleted. (Fixed as of smeserver-qpsmtpd-2.4.0-7.el6.sme.noarch - see [[bugzilla: 8329]]).
   −
Il y a plusieurs composants concernés dans l'envoi d'un courriel sur le serveur SME KOOZALI. Chaque composant a une limite de taille qui peut affecter un courriel qui transite par le serveur.
+
There are several components involved in sending email on a SME server. Each component has a size limit that may affect an email message that passes through the server.
   −
Sachez que la ''taille des courriels'' n'est pas la même chose que la ''taille des pièces jointes''. Les pièces binaires jointes aux courriels sont codées à l'aide de techniques qui entraînent des tailles de courriels pouvant être jusqu'à 30 % plus importantes que la pièce jointe d'origine. La plupart des principaux courrielleurs (Thunderbird, Apple Mail, Outlook) vous permettent d'activer une colonne "taille du message" dans la liste des messages qui vous montrera la taille de vos messages électroniques ([http://forums.contribs.org/index.php/topic,48366.msg241720.html#msg241720 Plus]).
+
Be aware that ''email size'' is not the same thing as ''attachment size''. Binary attachments to email are encoded using techniques that result in email sizes that can be as much as 30% larger than the original attachment. Most major email clients (Thunderbird, Apple Mail, Outlook) allow you to enable a "message size" column in the message list that will show you the size of your email messages ([http://forums.contribs.org/index.php/topic,48366.msg241720.html#msg241720 More]).
−
.
     −
{| cellspacing="0" cellpadding="5" width="100%" border="1"
+
{| width="100%" cellspacing="0" cellpadding="5" border="1"
−
! Sous-système
+
!Subsystem
−
! Fonction
+
!Function
−
! Limite par défaut
+
!Default Limit
−
! Commande pour changer la taille
+
!Command to change size
−
! Notes
+
!Notes
 
|-
 
|-
 
|qmail
 
|qmail
Line 792: Line 791:  
|15M
 
|15M
 
|config&nbsp;setprop&nbsp;clamav&nbsp;MaxFileSize&nbsp;15M
 
|config&nbsp;setprop&nbsp;clamav&nbsp;MaxFileSize&nbsp;15M
−
|Value includes human-readable abbreviations.  "15M" equals 15 MegaBytes.  
+
|Value includes human-readable abbreviations.  "15M" equals 15 MegaBytes.
 
|-
 
|-
 
|clamd
 
|clamd
Line 821: Line 820:     
These attributes could result in the rejection of a  compressed attachment on a SME server:
 
These attributes could result in the rejection of a  compressed attachment on a SME server:
−
* ArchiveMaxCompressionRatio (default 300)
+
 
−
* MaxFiles (default 1500)
+
*ArchiveMaxCompressionRatio (default 300)
−
* MaxRecursion (default 8)
+
*MaxFiles (default 1500)
 +
*MaxRecursion (default 8)
 +
 
 
====spamassassin====
 
====spamassassin====
 
By default the qpsmtpd 'spamassassin' plugin does not pass any messages over 500,000 bytes to spamassassin for scanning.  
 
By default the qpsmtpd 'spamassassin' plugin does not pass any messages over 500,000 bytes to spamassassin for scanning.  
Line 848: Line 849:  
  signal-event email-update
 
  signal-event email-update
   −
=== Large attachments not displaying in webmail ===
+
===Large attachments not displaying in webmail===
 
Due to limits set in the PHP configuration it might be that webmail will not display large attachments (see also [[bugzilla:3990]]). The following entries are related to the error and can be found in the log files:
 
Due to limits set in the PHP configuration it might be that webmail will not display large attachments (see also [[bugzilla:3990]]). The following entries are related to the error and can be found in the log files:
   Line 868: Line 869:     
Can be either a user, pseudonym or group
 
Can be either a user, pseudonym or group
−
  db accounts setprop groupname/username Visible internal
+
  db accounts setprop groupname/username/pseudonym Visible internal
 
  signal-event email-update
 
  signal-event email-update
    
If you want to remove  
 
If you want to remove  
−
  db accounts delprop groupname/username Visible
+
  db accounts delprop groupname/username/pseudonym Visible
 
  signal-event email-update
 
  signal-event email-update
   −
* If you need to restrict emails for all users you can perform this command line
+
*If you need to restrict emails for all users you can perform this command line
    
  db accounts show | awk -F "="  '/\=user/ {print $1}' |while read USER; do db accounts setprop $USER Visible internal; done
 
  db accounts show | awk -F "="  '/\=user/ {print $1}' |while read USER; do db accounts setprop $USER Visible internal; done
Line 883: Line 884:  
  db accounts show | awk -F "="  '/\=user/ {print $1}' |while read USER; do db accounts delprop $USER Visible; done
 
  db accounts show | awk -F "="  '/\=user/ {print $1}' |while read USER; do db accounts delprop $USER Visible; done
 
  signal-event email-update
 
  signal-event email-update
 +
{{Note box|Please note that admin and other system accounts can not be hidden from external network this way.
 +
 +
Also note that Pseudonyms can be set to internal only using the server-manager.}}
    
===I can't receive mail at: user@mail.domain.tld===
 
===I can't receive mail at: user@mail.domain.tld===
Line 894: Line 898:  
This is logged is in /var/log/messages.
 
This is logged is in /var/log/messages.
   −
===How do I enable smtp authentication for users on the internal network===
+
===Allow SMTP relay of mail without encryption/authentication===
−
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
+
 
−
  cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
+
Change the configuration of the system from the default, so that it no longer requires encryption/authentication before allowing relaying of mail.
−
cp /etc/e-smith/templates/var/service/qpsmtpd/config/peers/0/05auth_cvm_unix_local .
+
 
 +
* For most case, you really want to allow few specific clients on your LAN or trusted networks, this is done by setting a coma separated list of ip this way (replace IP1, IP2, IP3 by valid ips).
 +
  config set qpsmtpd UnauthenticatedRelayClients IP1,IP2,IP3
 
  signal-event email-update
 
  signal-event email-update
−
(note the "." at the end of the 3rd line)<br>
  −
Authentication for the local network will now follow the setting of config::qpsmtpd::Authentication
     −
ie do
+
* In some case you would have a whole dedicated network with appliances needing to send email without auth, this is done this way
−
  config setprop qpsmtpd Authentication enabled
+
  db networks setprop {$network} RelayRequiresAuth disabled
 
  signal-event email-update
 
  signal-event email-update
   −
===How do I disable SMTP relay for unauthenticated LAN clients===
+
* In case you needs are not fulfilled because you need to accommodate a list of remote IP or a sub network of a larger trusted network, you can create a custom template. Here for reference the accepted formats:
−
http://forums.contribs.org/index.php?topic=38797.msg176490#msg176490
  −
* Enable smtp authentication as shown above
  −
* Disable un-authenticated smtp relay for the local network(s)using:
   
  mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients
 
  mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients
−
  echo "# SMTP Relay from local network denied by custom template" >\
+
# a subnetwork by only using a prefix of full ip
−
  /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients/80relayFromLocalNetwork
+
  echo "10.10.0.">>  /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients/80custom
 +
# an external ip
 +
echo "99.10.1.23" >> /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients/80custom
 +
  # an external network you control
 +
echo "164.163.12.1/30" >> /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients/80custom
 
  signal-event email-update
 
  signal-event email-update
   −
* Configure your email clients to use smtps with authentication:<br>
+
* Disable smtp authentication on all local interfaces as shown in [[Bugzilla: 6522]]
−
- change outgoing smtp port to 465 and select SSL<br>
  −
- enable Authentication against the outgoing mail server
  −
 
  −
===Allow SMTP relay of mail without encryption/authentication===
  −
 
  −
Change the configuration of the system from the default, so that it no longer requires encryption/authentication before allowing relaying of mail.
  −
 
  −
Disable smtp authentication as shown in [[Bugzilla: 6522]]
      
  config setprop qpsmtpd RelayRequiresAuth disabled
 
  config setprop qpsmtpd RelayRequiresAuth disabled
Line 1,051: Line 1,048:  
harassment).  
 
harassment).  
    +
====Prior SME9.2 : qpsmtpd check_badmailfromto plugin====
 
To control mail from external locations to internal locations do
 
To control mail from external locations to internal locations do
 
  mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0
 
  mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0
 
  mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins
 
  mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins
−
  nano -w /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto
+
  echo "check_badmailfromto" > /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto
 +
ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/31check_badmailfromto
 +
signal-event email-update
 +
 
 +
To control mail sent from internal locations to internal locations, in addition to the above also do
 +
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
 +
ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/31check_badmailfromto
 +
signal-event email-update
   −
Type in the following followed by Enter
  −
check_badmailfromto
  −
Then save the file and exit
  −
Ctrl o
  −
Ctrl x
     −
Then do
+
====Since SME9.2 : qpsmtpd badmailfromto plugin====
−
  ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/31check_badmailfromto
+
remove previous templates, if you are updating
 +
rm /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto \
 +
/etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/31check_badmailfromto \
 +
/etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/31check_badmailfromto
 +
 
 +
To control mail from external locations to internal locations do
 +
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0
 +
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins
 +
echo "badmailfromto" > /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31badmailfromto
 +
  ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/31badmailfromto
 
  signal-event email-update
 
  signal-event email-update
    
To control mail sent from internal locations to internal locations, in addition to the above also do
 
To control mail sent from internal locations to internal locations, in addition to the above also do
 
  mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
 
  mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
−
  ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/31check_badmailfromto
+
  ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/31badmailfromto
 
  signal-event email-update
 
  signal-event email-update
 +
 +
====For Qmail====
 
   
 
   
 
Create and configure the badmailfromto custom template fragment
 
Create and configure the badmailfromto custom template fragment
Line 1,149: Line 1,160:     
This behaviour is only available as per e-smith-qmail-2.4.0-7.sme see bug #9540
 
This behaviour is only available as per e-smith-qmail-2.4.0-7.sme see bug #9540
−
=== Change the number of logs retained for qpsmtpd and/or sqpsmtpd ===
+
 
 +
===Change the number of logs retained for qpsmtpd and/or sqpsmtpd===
 
The normal retention is 5 logs for both qpsmptd and sqpsmtpd. This may or may not fit all installations. This information is pulled from bugzilla.
 
The normal retention is 5 logs for both qpsmptd and sqpsmtpd. This may or may not fit all installations. This information is pulled from bugzilla.
   Line 1,205: Line 1,217:  
If you want to customize the signing you can add parameters to the line in /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/69dkim_sign. Parameters and value are separated by a space only.
 
If you want to customize the signing you can add parameters to the line in /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/69dkim_sign. Parameters and value are separated by a space only.
   −
# keys : "dk" or "domainkeys" for domainkey signature only, "dkim" for DKIM signature only, default "both" (n.b. above template example is dkim ONLY)
+
#keys : "dk" or "domainkeys" for domainkey signature only, "dkim" for DKIM signature only, default "both" (n.b. above template example is dkim ONLY)
−
# dk_method : for domainkey method , default "nofws"
+
#dk_method : for domainkey method , default "nofws"
−
# selector : the selector you want, default "default"
+
#selector : the selector you want, default "default"
−
# algorithm : algorithm for DKIM signing, default "rsa-sha1"
+
#algorithm : algorithm for DKIM signing, default "rsa-sha1"
−
# dkim_method : for DKIM, default "relaxed"
+
#dkim_method : for DKIM, default "relaxed"
    
NB: key files can not be defined in parameters, they need to be in /var/service/qpsmtpd/config/dkimkeys/{SENDER_DOMAIN}.private
 
NB: key files can not be defined in parameters, they need to be in /var/service/qpsmtpd/config/dkimkeys/{SENDER_DOMAIN}.private
Line 1,241: Line 1,253:     
Incoming DKIM checking is also enabled out of the box.
 
Incoming DKIM checking is also enabled out of the box.
 +
 +
 +
In case you got a problem using the DKIM field provided with your DNS provider /registrar, please first contact them to ensure the problem is not how you try to enter the information. In the likelihood, you got "invalid field" or "too long field" errors and your provider is not able to help you or update its interface, you can generate a shorter DKIM key (with 1024 instead of the default 2048) this way:
 +
 +
cd /home/e-smith/dkim_keys/default
 +
mv private private.long
 +
mv public public.long
 +
openssl genrsa -out private 1024
 +
openssl rsa -in private -pubout -out public
 +
chown qpsmtpd:qpsmtpd private
 +
chown root:qpsmtpd public
 +
chmod 0400 private
 +
signal-event email-update
 +
qpsmtpd-print-dns
 +
 +
===Outbound DKIM signing / SPF / DMARC policy FOR MULTIPLE DOMAINS===
 +
The default DKIM key is created in /home/e-smith/dkim_keys/default. To enable DKIM signing for all the domains that you manage:
 +
db configuration setprop qpsmtpd DKIMSigning enabled
 +
signal-event email-update
 +
If you want to disable dkim signing for a domain, you can use:
 +
db domains setprop domain.com DKIMSigning disabled
 +
signal-event email-update
 +
The default behavior is to use the same key pair for all your domains. But you can create other key pairs for specific domain if you want. For example, if you want to use a specific key pair for the domain.net domain:
 +
cd /home/e-smith/dkim_keys
 +
mkdir domain.net
 +
cd domain.net
 +
echo default > selector
 +
openssl genrsa -out private 2048
 +
openssl rsa -in private -out public -pubout
 +
chown qpsmtpd:qpsmtpd private
 +
chmod 400 private
 +
signal-event email-update
 +
Now, the emails using a domain.net sender address will be signed by this new key instead of the default one.
    
==Domain Keys==
 
==Domain Keys==
Line 1,306: Line 1,351:  
   contribs
 
   contribs
 
         org
 
         org
 +
===Dovecot Idle_Notify===
 +
Poor battery consumption issues has been reported with K9-mail on recent Android systems. It is apparent one way of helping this is to modify the imap_idle_notify setting. The default is in Dovecot, and therefore on SME is 2 minutes.
 +
 +
K9 has an idle refresh of 24 mins but it seems with Dovecot defaults at 2 mins it causes lots of wake ups and battery drain.
 +
 +
This is configurable via a config db property.
 +
 +
Default on install
 +
# config show dovecot
 +
  dovecot=service
 +
    Quotas=enabled
 +
    status=enabled
 +
 +
Set dovecot Idle_Notify to 20 minutes
 +
 +
# config setprop dovecot Idle_Notify 20
 +
# config show dovecot
 +
  dovecot=service
 +
    Idle_Notify=20
 +
    Quotas=enabled
 +
    status=enabled
 +
 +
Expand template to update *.conf (can also issue a full reconfigure/reboot)
 +
 +
# expand-template /etc/dovecot/dovecot.conf
 +
# dovecot -a |grep imap_idle_notify_interval
 +
  imap_idle_notify_interval = 20 mins
    
==qpsmtpd==
 
==qpsmtpd==
Line 1,328: Line 1,400:     
The default configuration of each plugin is indicated in the 'Default Status' column.
 
The default configuration of each plugin is indicated in the 'Default Status' column.
−
{| cellspacing="0" cellpadding="5" width="100%" border="1"
+
{| width="100%" cellspacing="0" cellpadding="5" border="1"
 
!Plugin
 
!Plugin
 
!Purpose
 
!Purpose
Line 1,342: Line 1,414:  
|-
 
|-
 
|logging/logterse
 
|logging/logterse
−
|Allow greater logging detail using smaller log files.  Optionally supports [[Email_Statistics#qplogsumm.pl|qplogsumm.pl]] to compile qpsmtpd statistics.  
+
|Allow greater logging detail using smaller log files.  Optionally supports [[Email_Statistics#qplogsumm.pl|qplogsumm.pl]] to compile qpsmtpd statistics.
 
|enabled
 
|enabled
 
|-
 
|-
Line 1,429: Line 1,501:  
|'''disabled'''<br>(always disabled for local connections)
 
|'''disabled'''<br>(always disabled for local connections)
 
|-
 
|-
−
|virus/clamav  
+
|virus/clamav
 
|Scan incoming email with ClamAV
 
|Scan incoming email with ClamAV
 
|enabled
 
|enabled
Line 1,440: Line 1,512:     
===Qpsmtpd for SME versions 9.2 and Later===
 
===Qpsmtpd for SME versions 9.2 and Later===
−
{{Warning box|Please note that the version of qpsmtpd has been upgraded for SME version 9.2 and later to qpsptpd version 0.96. This change has resulted in a lot of changes to the way it works, the plugins (and their names!) and the corresponding database entries, so this section ONLY applies to SME Version 9.2 and later version, see the previous section for the details.}}
+
{{Warning box|Please note that the version of qpsmtpd has been upgraded for SME version 9.2 and later to qpsmtpd version 0.96. This change has resulted in a lot of changes to the way it works, the plugins (and their names!) and the corresponding database entries, so this section ONLY applies to SME Version 9.2 and later version, see the previous section for the details.}}
    
This section has been taken from the notes prepared by the dev who made the changes, the wiki is [https://wikit.firewall-services.com/doku.php/smedev/qpsmtpd_096#documentation here].  
 
This section has been taken from the notes prepared by the dev who made the changes, the wiki is [https://wikit.firewall-services.com/doku.php/smedev/qpsmtpd_096#documentation here].  
Line 1,446: Line 1,518:  
Here is a list of the plugins in use, and a note of any changes that might have occurred:
 
Here is a list of the plugins in use, and a note of any changes that might have occurred:
   −
  * logterse: no change
+
*logterse: no change
−
  * tls: no change
+
*tls: no change
−
  * auth_cvm_unix_local: no change
+
*auth_cvm_unix_local: no change
−
  * check_earlytalker: **renamed earlytalker**
+
*check_earlytalker: '''renamed earlytalker'''
−
  * count_unrecognized_commands: no change
+
*count_unrecognized_commands: no change
−
  * bcc: no change
+
*bcc: no change
−
  * check_relay: **renamed relay**
+
*check_relay: '''renamed relay'''
−
  * check_norelay: **merged into the relay plugin**
+
*check_norelay: '''merged into the relay plugin'''
−
  * require_resolvable_fromhost: **renamed resolvable_fromhost**
+
*require_resolvable_fromhost: '''renamed resolvable_fromhost'''
−
  * check_basicheaders: **renamed headers**
+
*check_basicheaders: '''renamed headers'''
−
  * rhsbl: no change
+
*rhsbl: no change
−
  * dnsbl: no change
+
*dnsbl: no change
−
  * check_badmailfrom: **renamed badmailfrom**
+
*check_badmailfrom: '''renamed badmailfrom'''
−
  * check_badrcptto_patterns: **doesn't exist anymore, merged with badrcptto**
+
*check_badrcptto_patterns: '''doesn't exist anymore, merged with badrcptto'''
−
  * check_badrcptto: **renamed badrcptto**
+
*check_badrcptto: '''renamed badrcptto'''
−
  * check_spamhelo: **renamed helo**
+
*check_spamhelo: '''renamed helo'''
−
  * check_smtp_forward: no change
+
*check_smtp_forward: no change
−
  * check_goodrcptto: no change
+
*check_goodrcptto: no change
−
  * rcpt_ok: no change
+
*rcpt_ok: no change
−
  * pattern_filter: no change
+
*pattern_filter: no change
−
  * tnef2mime: no change
+
*tnef2mime: no change
−
  * spamassassin: no change
+
*spamassassin: no change
−
  * clamav: no change
+
*clamav: no change
−
  * qmail-queue: no change
+
*qmail-queue: no change
    
Here is a section for each of the new plugins which are installed by default. The ones that have not changed are documented [https://wiki.contribs.org/Email#Default_Plugin_Configuration above].
 
Here is a section for each of the new plugins which are installed by default. The ones that have not changed are documented [https://wiki.contribs.org/Email#Default_Plugin_Configuration above].
   −
==== Karma ====
+
====Karma====
    
The karma plugin tracks sender history. For each inbound email, various plugins can raise, or lower the "naughtiness" of the connection (eg, if SPF check passes, if the message is spammy etc...). For each host sending us email, the total number of connections, and the number of good and bad connections is recorded in a database. If a host as more bad than good connections in its history, emails will be rejected for 1 day. 3 settings are available for this plugin:
 
The karma plugin tracks sender history. For each inbound email, various plugins can raise, or lower the "naughtiness" of the connection (eg, if SPF check passes, if the message is spammy etc...). For each host sending us email, the total number of connections, and the number of good and bad connections is recorded in a database. If a host as more bad than good connections in its history, emails will be rejected for 1 day. 3 settings are available for this plugin:
   −
  * Karma (enabled|disabled): Default value is disabled. Change to enabled to use the plugin
+
*Karma (enabled|disabled): Default value is disabled. Change to enabled to use the plugin<br />
−
  * KarmaNegative (integer): Default value is 2. It's the delta between good and bad connection to consider the host naughty enough to block it for 1 day. Eg, with a default value of two, a host can be considered naughty if it sent you 8 good emails and 10 bad ones
+
*KarmaNegative (integer): Default value is 2.<br /> It's the delta between good and bad connection to consider the host naughty enough to block it for 1 day.<br /> Eg, with a default value of two, a host can be considered naughty if it sent you 8 good emails and 10 bad ones<br />
−
  * KarmaStrikes (integer): Default value is 3. This is the threshold for a single email to be considered good or bad. Eg, with the default value of 3, an email needs at least 3 bad karmas (reaches -3) for the connection to be considered bad. On the other side, 3 good karmas are needed for the connection to be considered good. Between the two, the connection is considered neutral and won't be used in the history count
+
*KarmaStrikes (integer): Default value is 3. This is the threshold for a single email to be considered good or bad. <br />Eg, with the default value of 3, an email needs at least 3 bad karmas (reaches -3) for the connection to be considered bad.<br />On the other side, 3 good karmas are needed for the connection to be considered good. Between the two, the connection is considered neutral<br />and won't be used in the history count
    
Example:
 
Example:
−
<code bash>
+
db configuration setprop qpsmtpd Karma enabled KarmaNegative 3
−
db configuration setprop qpsmtpd Karma enabled KarmaNegative 3
+
signal-event email-update
−
signal-event email-update
+
 
−
</code>
     −
==== URIBL ====
+
====URIBL====
    
The URIBL plugin works a bit like RHSBL, except that it checks domain names found in the body of the email. For each URI identified, the corresponding domain name can be submitted to a BL list (through DNS queries). Two settings are available:
 
The URIBL plugin works a bit like RHSBL, except that it checks domain names found in the body of the email. For each URI identified, the corresponding domain name can be submitted to a BL list (through DNS queries). Two settings are available:
   −
  * URIBL (enabled|disabled): Default is disabled. Set this to enabled to use the plugin
+
*URIBL (enabled|disabled): Default is disabled. Set this to enabled to use the plugin
−
  * UBLList: (Comma separated list addresses): Default value is **multi.surbl.org:8-16-64-128,black.uribl.com,rhsbl.sorbs.net**. This can be the same as RBLList. You can also set bitmask to use for combined lists (in the default value, the bitmask is 8-16-64-128)
+
*UBLList: (Comma separated list addresses): Default value is '''multi.surbl.org:8-16-64-128,black.uribl.com,rhsbl.sorbs.net'''.<br />This can be the same as RBLList. You can also set bitmask to use for combined lists (in the default value, the bitmask is 8-16-64-128)
 +
 
 +
 
    
Example:
 
Example:
−
<code bash>
+
db configuration setprop qpsmtpd URIBL enabled UBLList multi.surbl.org,black.uribl.com
−
db configuration setprop qpsmtpd URIBL enabled UBLList multi.surbl.org,black.uribl.com
+
signal-event email-update
−
signal-event email-update
  −
</code>
     −
==== Helo ====
+
 
 +
====Helo====
    
Previously, the helo plugin was just checking for some known bad helo hostnames used by spammers (aol.com and yahoo.com). Now, it can check much more than that. This plugin is always enabled and has a single setting:
 
Previously, the helo plugin was just checking for some known bad helo hostnames used by spammers (aol.com and yahoo.com). Now, it can check much more than that. This plugin is always enabled and has a single setting:
   −
  * HeloPolicy: (lenient|rfc|strict). The default value is **lenient**. See https://github.com/smtpd/qpsmtpd/blob/master/plugins/helo for a description of the various tests done at each level
+
*HeloPolicy: (lenient|rfc|strict). The default value is '''lenient'''.
 +
 
 +
See https://github.com/smtpd/qpsmtpd/blob/master/plugins/helo for a description of the various tests done at each level
    
Example:
 
Example:
 +
db configuration setprop qpsmtpd HeloPolicy rfc
 +
signal-event email-update
   −
<code bash>
+
====Inbound DKIM / SPF / DMARC====
−
db configuration setprop qpsmtpd HeloPolicy rfc
  −
signal-event email-update
  −
</code>
     −
==== Inbound DKIM / SPF / DMARC ====
+
DMARC is a policy on top of DKIM and SPF. By default, SPF and DKIM are now checked on every inbound emails, but no reject is attempted. The dmarc plugin can decide to reject the email (depending on the sender policy). dkim and spf plugins are always enabled. dmarc has two settings:
   −
DMARC is a policy on top of DKIM and SPF. By default, SPF and DKIM are now checked on every inbound emails, but no reject is attempted. The dmarc plugin can decide to reject the email (depending on the sender policy). dkim and spf plugins are always enabled. dmarc has two settings:
+
*DMARCReject (enabled|disabled): Default value is disabled.<br />If set to enabled, the dmarc plugin can decide to reject an email (if the policy of the sender is to reject on alignment failure)<br />
 +
*DMARCReporting (enabled|disabled): Default value is enabled.<br />If set to enabled, enable reporting (which is the '''r''' in dma'''r'''c). Reporting is a very important part of the DMARC standard.<br />When enabled, you'll record information about email you receive from domains which have published a DMARC policy in a local<br />SQLite database (/var/lib/qpsmtpd/dmarc/reports.sqlite).<br />Then, once a day, you send the aggregate reports to the domain owner so they have feedback.<br />You can set this to disabled if you want to disable this feature<br />
 +
*SPFRejectPolicy (0|1|2|3|4): Default value is 0. Set the policy to apply in case of SPF failure when the sender hasn't published a DMARC policy.<br />Note: this is only used when no DMARC policy is published by the sender.<br />If there's a DMARC policy, even a "p=none" one (meaning no reject), then the email won't be rejected, even on failed SPF tests.
 +
 
 +
:*0: do not reject anything
 +
:*1: reject when SPF says fail
 +
:*2: reject when SPF says softfail
 +
:*3: reject when SPF says neutral
 +
:*4: reject when an error occurred (like a syntax error in SPF entry) or if no SPF entry is published
   −
  * DMARCReject (enabled|disabled): Default value is disabled. If set to enabled, the dmarc plugin can decide to reject an email (if the policy of the sender is to reject on alignment failure)
+
*Inbound DKIM checks are only used by DMARC. No reject solely based on DKIM is supported
−
  * DMARCReporting (enabled|disabled): Default value is enabled. If set to enabled, enable reporting (which is the **r** in dma**r**c). Reporting is a very important part of the DMARC standard. When enabled, you'll record information about email you receive from domains which have published a DMARC policy in a local SQLite database (/var/lib/qpsmtpd/dmarc/reports.sqlite). Then, once a day, you send the aggregate reports to the domain owner so they have feedback. You can set this to disabled if you want to disable this feature
  −
  * SPFRejectPolicy (0|1|2|3|4): Default value is 0. Set the policy to apply in case of SPF failure when the sender hasn't published a DMARC policy. Note: this is only used when no DMARC policy is published by the sender. If there's a DMARC policy, even a "p=none" one (meaning no reject), then the email won't be rejected, even on failed SPF tests.
  −
    * 0: do not reject anything
  −
    * 1: reject when SPF says fail
  −
    * 2: reject when SPF says softfail
  −
    * 3: reject when SPF says neutral
  −
    * 4: reject when an error occurred (like a syntax error in SPF entry) or if no SPF entry is published
  −
  * Inbound DKIM checks are only used by DMARC. No reject solely based on DKIM is supported
      
Example:
 
Example:
−
<code bash>
+
db configuration setprop qpsmtpd DMARCReject disabled SPFRejectPolicy 2
−
db configuration setprop qpsmtpd DMARCReject disabled SPFRejectPolicy 2
+
signal-event email-update
−
signal-event email-update
+
====Outbound DKIM signing / SPF / DMARC policy====
−
</code>
  −
==== Outbound DKIM signing / SPF / DMARC policy ====
      
Everything is now ready for you to sign your outbound emails, and publish your public key, as well as your SPF and DMARC policy. A default DKIM key is created in /home/e-smith/dkim_keys/default. To enable DKIM signing for all the domain you manage:
 
Everything is now ready for you to sign your outbound emails, and publish your public key, as well as your SPF and DMARC policy. A default DKIM key is created in /home/e-smith/dkim_keys/default. To enable DKIM signing for all the domain you manage:
−
 
+
db configuration setprop qpsmtpd DKIMSigning enabled
−
<code bash>
+
signal-event email-update
−
db configuration setprop qpsmtpd DKIMSigning enabled
  −
signal-event email-update
  −
</code>
      
If you want to disable dkim signing for a domain, you can use:
 
If you want to disable dkim signing for a domain, you can use:
−
<code bash>
+
db domains setprop domain.com DKIMSigning disabled
−
db domains setprop domain.com DKIMSigning disabled
+
signal-event email-update
−
signal-event email-update
  −
</code>
      
The default behavior is to use the same key pair for all your domains. But you can create other key pairs for specific domain if you want. For example, if you want to use a specific key pair for the domain.net domain:
 
The default behavior is to use the same key pair for all your domains. But you can create other key pairs for specific domain if you want. For example, if you want to use a specific key pair for the domain.net domain:
−
 
+
cd /home/e-smith/dkim_keys
−
<code bash>
+
mkdir domain.net
−
cd /home/e-smith/dkim_keys
+
cd domain.net
−
mkdir domain.net
+
echo default > selector
−
cd domain.net
+
openssl genrsa -out private 2048
−
echo default > selector
+
openssl rsa -in private -out public -pubout
−
openssl genrsa -out private 2048
+
chown qpsmtpd:qpsmtpd private
−
openssl rsa -in private -out public -pubout
+
chmod 400 private
−
chown qpsmtpd:qpsmtpd private
+
signal-event email-update
−
chmod 400 private
  −
signal-event email-update
  −
</code>
      
Now, the emails using a domain.net sender address will be signed by this new key instead of the default one.
 
Now, the emails using a domain.net sender address will be signed by this new key instead of the default one.
   −
==== Publishing your DNS entries ====
+
====Publishing your DNS entries====
    
Signing your outbound emails is just part of the process. You now need to publish some DNS entries so everyone can check if the email they receive matches your policy. This part is not to be done on your SME Server, but on your public DNS provider. A script helps you by creating some sample DNS entries already formatted for a bind-like zone file. To use it:
 
Signing your outbound emails is just part of the process. You now need to publish some DNS entries so everyone can check if the email they receive matches your policy. This part is not to be done on your SME Server, but on your public DNS provider. A script helps you by creating some sample DNS entries already formatted for a bind-like zone file. To use it:
−
 
+
qpsmtpd-print-dns <domain name>
−
<code bash>
  −
qpsmtpd-print-dns <domain name>
  −
</code>
   
If omitted, the primary domain name is assumed.
 
If omitted, the primary domain name is assumed.
    
Example output:
 
Example output:
−
<code>
+
Here are sample DNS entries you should add in your public DNS
−
Here are sample DNS entries you should add in your public DNS
+
The DKIM entry can be copied as is, but others will probably need to be adjusted
−
The DKIM entry can be copied as is, but others will probably need to be adjusted
+
to your need. For example, you should either change the reporting email adress
−
to your need. For example, you should either change the reporting email adress
+
for DMARC (or create the needed pseudonym)
−
for DMARC (or create the needed pseudonym)
+
 +
 +
default._domainkey IN TXT "v=DKIM1; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs/Qq3Ntpx2QNdRxGKMeKc2r9ULvyYW633IbLivHznN9JvjJIbS54PGIEk3sSxvZSdpTRAvYlxn/nRi329VmcDK0vJYb2ut2rnZ3VO3r5srm+XEvTNPxij5eU4gqw+5ayySDjqzAMEMc5V7lUMpZ/YiqnscA075XiMF7iEq8Quv1y0LokmgwtxzOXEZap34WXlKyhYzH+D""fabF6SUllmA0ovODNvudzvEOanPlViQ7q7d+Mc3b7X/fzgJfh5P9f5U+iSmzgyGctSb6GX8sqsDMNVEsRZpSE3jd2Z33RDWyW21PGOKB/ZrLiliKfdJbd3Wo7AN7bWsZpQsei2Hsv1niQIDAQAB"
 +
@ IN SPF "v=spf1 mx a -all"
 +
@ IN TXT "v=spf1 mx a -all"
 +
_dmarc IN TXT "v=DMARC1; p=none; adkim=s; aspf=r; rua=mailto:dmarc-feedback@domain.net; pct=100"
 +
All you have to do now is publish those records, but do note that there is a point to consider when publishing the default._domainkey DNS record, as produced by the ''qpsmtpd-print-dns'' command: if the DNS record includes '';t=y'' then as per the DKIM specification ([http://dkim.org/specs/rfc4871-dkimbase.html#keys RFC4781 section 3.6.1]) this means that your ''"...domain is testing DKIM. Verifiers MUST NOT treat messages from signers in testing mode differently from unsigned email, even should the signature fail to verify. Verifiers MAY wish to track testing mode results to assist the signer."''
   −
<br>
+
On the other hand, if no '';t=y'' is included, then it means you are intending to use DKIM in production mode. It might be a good idea to publish the DKIM DNS record first in testing mode ('';t=y'' included), check how things go and if everything is alright, remove the '';t=y'' part.
−
default._domainkey IN TXT "v=DKIM1;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs/Qq3Ntpx2QNdRxGKMeKc2r9ULvyYW633IbLivHznN9JvjJIbS54PGIEk3sSxvZSdpTRAvYlxn/nRi329VmcDK0vJYb2ut2rnZ3VO3r5srm+XEvTNPxij5eU4gqw+5ayySDjqzAMEMc5V7lUMpZ/YiqnscA075XiMF7iEq8Quv1y0LokmgwtxzOXEZap34WXlKyhYzH+D""fabF6SUllmA0ovODNvudzvEOanPlViQ7q7d+Mc3b7X/fzgJfh5P9f5U+iSmzgyGctSb6GX8sqsDMNVEsRZpSE3jd2Z33RDWyW21PGOKB/ZrLiliKfdJbd3Wo7AN7bWsZpQsei2Hsv1niQIDAQAB"
  −
@ IN SPF "v=spf1 mx a -all"
  −
@ IN TXT "v=spf1 mx a -all"
  −
_dmarc IN TXT "v=DMARC1; p=none; adkim=s; aspf=r; rua=mailto:dmarc-feedback@domain.net; pct=100"
  −
</code>
     −
All you have to do now is publish those records
     −
==== Testing ====
+
====Testing====
 
You can install spfquery:
 
You can install spfquery:
   Line 1,601: Line 1,661:  
  dig -t TXT +short somedomain.co.uk
 
  dig -t TXT +short somedomain.co.uk
   −
==== Load ====
+
====Load====
 
The loadcheck plugin can temporarily deny inbound emails if your server is overloaded. This plugin is always enabled and has a single setting:
 
The loadcheck plugin can temporarily deny inbound emails if your server is overloaded. This plugin is always enabled and has a single setting:
   −
  * MaxLoad (int number): Default is 7. If your load is above this value, emails from the outside will be deferred.
+
*MaxLoad (int number): Default is 7. If your load is above this value, emails from the outside will be deferred.
    
===Other QPSMTPD Plugins===
 
===Other QPSMTPD Plugins===
 
The following qpsmtpd plugins will work on a SME server, but are either not included or are not configured by default.
 
The following qpsmtpd plugins will work on a SME server, but are either not included or are not configured by default.
−
{| cellspacing="0" cellpadding="5" width="100%" border="1"
+
{| width="100%" cellspacing="0" cellpadding="5" border="1"
 
!Plugin
 
!Plugin
 
!Purpose
 
!Purpose
Line 1,649: Line 1,709:  
  signal-event email-update
 
  signal-event email-update
   −
== Secondary/Backup Mail Server Considerations ==
+
==Secondary/Backup Mail Server Considerations==
    
Many people misunderstand the issues of using a secondary or backup  
 
Many people misunderstand the issues of using a secondary or backup  
Line 1,673: Line 1,733:  
===='''Without''' a backup MX====
 
===='''Without''' a backup MX====
   −
* The sending mail server cannot connect to your server.
+
*The sending mail server cannot connect to your server.
−
* The sending mail server MUST queue the mail and try again later.
+
*The sending mail server MUST queue the mail and try again later.
−
* The mail stays on the sender's server.
+
*The mail stays on the sender's server.
−
* The sender's server resends the mail at a later date.
+
*The sender's server resends the mail at a later date.
    
''The requirement to re-queue is a fundamental part of the SMTP protocol - ''
 
''The requirement to re-queue is a fundamental part of the SMTP protocol - ''
 
it is not optional. So, if your server is '''offline''' due to a link or ISP  
 
it is not optional. So, if your server is '''offline''' due to a link or ISP  
−
outage, '''the mail just stays at the sender's server until you are once'''  
+
outage, '''the mail just stays at the sender's server until you are once '''
 
again reachable'''.'''
 
again reachable'''.'''
    
===='''With''' a backup MX====
 
===='''With''' a backup MX====
   −
* The sending mail server cannot contact your server.
+
*The sending mail server cannot contact your server.
−
* The sending mail server sends the mail to your secondary MX.
+
*The sending mail server sends the mail to your secondary MX.
−
* The secondary MX queues the mail until your link/server is up.
+
*The secondary MX queues the mail until your link/server is up.
−
* The mail is queued on an '''untrusted''' third-party mail server (''think about confidential mail between your company and some business partner'').
+
*The mail is queued on an '''untrusted''' third-party mail server (''think about confidential mail between your company and some business partner'').
−
* The sending mail server's administrator ''thinks'' it has been delivered, according to their logs.
+
*The sending mail server's administrator ''thinks'' it has been delivered, according to their logs.
−
* You have no, or little, visibility over the queued mail.
+
*You have no, or little, visibility over the queued mail.
−
* When your link comes up, the secondary MX sends the mail on to your server.
+
*When your link comes up, the secondary MX sends the mail on to your server.
−
* You have added more hops, more systems and more delay to the process.
+
*You have added more hops, more systems and more delay to the process.
    
If you think that a backup MX will protect against broken mail servers  
 
If you think that a backup MX will protect against broken mail servers  
Line 1,723: Line 1,783:  
So:
 
So:
   −
* If you trust the secondary MX, you <u>will</u> accept a lot of SPAM when the link comes up.
+
*If you trust the secondary MX, you <u>will</u> accept a lot of SPAM when the link comes up.
−
* If you don't trust it, you will cause a lot of SPAM backscatter as the mail has been accepted at the secondary MX and then later bounced by you.
+
*If you don't trust it, you will cause a lot of SPAM backscatter as the mail has been accepted at the secondary MX and then later bounced by you.
−
* Stopping backscatter is why SME Server rejects invalid addresses during the initial SMTP transaction.
+
*Stopping backscatter is why SME Server rejects invalid addresses during the initial SMTP transaction.
    
The SPAM backscatter can only be stopped if the secondary MX has a full list
 
The SPAM backscatter can only be stopped if the secondary MX has a full list
Line 1,732: Line 1,792:  
But:
 
But:
   −
* You need to be able to configure this secondary MX with such user/domain lists
+
*You need to be able to configure this secondary MX with such user/domain lists
−
* You need to maintain these secondary configurations when users are added/deleted from your primary server configuration
+
*You need to maintain these secondary configurations when users are added/deleted from your primary server configuration
−
* You need to test (regularly) if the secondary is successfully accepting/rejecting mail as required.
+
*You need to test (regularly) if the secondary is successfully accepting/rejecting mail as required.
    
Quite a few sites have lost lots of mail through misconfigured backup MX servers. Unfortunately, the time when you find  
 
Quite a few sites have lost lots of mail through misconfigured backup MX servers. Unfortunately, the time when you find  
Line 1,741: Line 1,801:  
Then you realise that this mail could have queued at the sender's site if there hadn't been a broken secondary MX bouncing the mail for you.
 
Then you realise that this mail could have queued at the sender's site if there hadn't been a broken secondary MX bouncing the mail for you.
   −
* If you bounce mail at your server, you have logs to show what's wrong.  
+
*If you bounce mail at your server, you have logs to show what's wrong.
−
* If your secondary MX bounces your mail, you usually have no way to determine what happened other than via reports from the original senders that your mail bounced.
+
*If your secondary MX bounces your mail, you usually have no way to determine what happened other than via reports from the original senders that your mail bounced.
    
===Summary===
 
===Summary===
Line 1,754: Line 1,814:  
If you still want to consider setting up a seconday MX, ensure that:
 
If you still want to consider setting up a seconday MX, ensure that:
   −
* you have fully control of the configuration of each of the email gateways for your domain
+
*you have fully control of the configuration of each of the email gateways for your domain
−
* each gateway can make decisions on whether to accept/reject mail for the users at the domain
+
*each gateway can make decisions on whether to accept/reject mail for the users at the domain
    
==Mail server on dynamic IP==
 
==Mail server on dynamic IP==
Line 1,777: Line 1,837:     
Whether this issue is really a problem to end users, depends on how much you "value" your mail. For a home user having their own mail server, it is probably not a great problem if some messages should happen to go astray, but for all other classes of users, you should really avoid running a mail server on a dynamic IP, without implementing a suitable queueing workaround as suggested. Some ISPs change the IP very infrequently eg yearly, so in those cases it is also not a significant problem. Many/most ISP's will issue a new IP every time a connection is lost & re-established, so these situations are more problematic.
 
Whether this issue is really a problem to end users, depends on how much you "value" your mail. For a home user having their own mail server, it is probably not a great problem if some messages should happen to go astray, but for all other classes of users, you should really avoid running a mail server on a dynamic IP, without implementing a suitable queueing workaround as suggested. Some ISPs change the IP very infrequently eg yearly, so in those cases it is also not a significant problem. Many/most ISP's will issue a new IP every time a connection is lost & re-established, so these situations are more problematic.
 +
 +
==How to re-apply procmail rules==
 +
 +
If you have a folder of email that needs to have the procmail rules applied, then the trick is to be logged in as the email user, and then position your self in the home directory, and then this works:
 +
su <username> -s /bin/bash
 +
cd ~
 +
for m in <fullpath to maildirectory>/cur/*; do echo $m; procmail < $m && rm $m; done
 +
    
<noinclude>
 
<noinclude>
−
[[Category:Mail/fr]]
+
[[Category:Mail]]
−
[[Category:Howto/fr]]
+
[[Category:Howto]]
 
</noinclude>
 
</noinclude>
Gieres
3,072

edits

Retrieved from "https://wiki.koozali.org/Special:MobileDiff/41131"

Navigation menu