{"id":51,"date":"2026-02-06T07:48:42","date_gmt":"2026-02-06T07:48:42","guid":{"rendered":"https:\/\/vyos.web.id\/?p=51"},"modified":"2026-02-06T08:15:47","modified_gmt":"2026-02-06T08:15:47","slug":"spfdkim-and-dmarc","status":"publish","type":"post","link":"https:\/\/vyos.web.id\/?p=51","title":{"rendered":"SPF,DKIM and DMARC"},"content":{"rendered":"\n

Architecture We Are Building<\/h2>\n\n\n\n
Postfix  \u2192  OpenDKIM  \u2192  Internet\n               \u2191\n           DKIM DNS\n<\/code><\/pre>\n\n\n\n
SPF \u2013 Allow your server to send email<\/h2>\n\n\n\n
In your domain DNS (for example yourdomain.id<\/code>), create a TXT<\/strong> record:<\/p>\n\n\n\n
Field<\/th>Value<\/th><\/tr><\/thead>
Host<\/td>@<\/code><\/td><\/tr>
Type<\/td>TXT<\/code><\/td><\/tr>
Value<\/td>v=spf1 ip4:103.xx.xx.xx mx -all<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Replace 103.<\/code><\/strong>xx.xx.xx with your Postfix server\u2019s public IP address.<\/p>\n\n\n\n
Meaning:<\/strong><\/p>\n\n\n\n
    \n
  • Only this IP and your MX servers are allowed to send email<\/li>\n\n\n\n
  • All others are rejected<\/strong><\/li>\n<\/ul>\n\n\n\n
    Install OpenDKIM<\/h2>\n\n\n\n
    apt install opendkim opendkim-tools -y\n<\/code><\/pre>\n\n\n\n
    Configure OpenDKIM<\/h2>\n\n\n\n
    Edit the configuration file:<\/p>\n\n\n\n
    nano \/etc\/opendkim.conf\n<\/code><\/pre>\n\n\n\n
    Ensure the following settings:<\/p>\n\n\n\n
    Mode                    sv\nCanonicalization        relaxed\/simple\nSubDomains              no\nOversignHeaders         From\nAutoRestart             yes\nAutoRestartRate         10\/1h\nBackground              yes\nDNSTimeout              5\nSignatureAlgorithm      rsa-sha256\n\nUserID                  opendkim\nSocket                  inet:8891@localhost\n\nKeyTable                \/etc\/opendkim\/key.table\nSigningTable            \/etc\/opendkim\/signing.table\nTrustedHosts            \/etc\/opendkim\/trusted.hosts\n<\/code><\/pre>\n\n\n\n
    Trusted Hosts<\/h2>\n\n\n\n
    Edit:<\/p>\n\n\n\n
    nano \/etc\/opendkim\/trusted.hosts\n<\/code><\/pre>\n\n\n\n
    Add:<\/p>\n\n\n\n
    127.0.0.1\nlocalhost\nmail.yourdomain.id\n103.30.246.60\n<\/code><\/pre>\n\n\n\n
    Generate DKIM keys<\/h2>\n\n\n\n
    mkdir -p \/etc\/opendkim\/keys\/yourdomain.id\ncd \/etc\/opendkim\/keys\/yourdomain.id\n\nopendkim-genkey -s mail -d yourdomain.id\nchown opendkim:opendkim mail.private\n<\/code><\/pre>\n\n\n\n
    This will create:<\/p>\n\n\n\n
    mail.private   \u2190 private key\nmail.txt       \u2190 DNS record\n<\/code><\/pre>\n\n\n\n
    Configure KeyTable & SigningTable<\/h2>\n\n\n\n
    Edit KeyTable<\/strong>:<\/p>\n\n\n\n
    nano \/etc\/opendkim\/key.table\n<\/code><\/pre>\n\n\n\n
    Add:<\/p>\n\n\n\n
    mail._domainkey.yourdomain.id yourdomain.id:mail:\/etc\/opendkim\/keys\/yourdomain.id\/mail.private\n<\/code><\/pre>\n\n\n\n
    Edit SigningTable<\/strong>:<\/p>\n\n\n\n
    nano \/etc\/opendkim\/signing.table\n<\/code><\/pre>\n\n\n\n
    Add:<\/p>\n\n\n\n
    *@yourdomain.id mail._domainkey.yourdomain.id\n<\/code><\/pre>\n\n\n\n
    Connect Postfix to OpenDKIM<\/h2>\n\n\n\n
    Edit Postfix configuration:<\/p>\n\n\n\n
    nano \/etc\/postfix\/main.cf\n<\/code><\/pre>\n\n\n\n
    Add:<\/p>\n\n\n\n
    milter_default_action = accept\nmilter_protocol = 6\nsmtpd_milters = inet:localhost:8891\nnon_smtpd_milters = inet:localhost:8891\n<\/code><\/pre>\n\n\n\n
    Restart services:<\/p>\n\n\n\n
    systemctl restart opendkim postfix\n<\/code><\/pre>\n\n\n\n
    Add DKIM record to DNS<\/h2>\n\n\n\n
    View the DKIM DNS record:<\/p>\n\n\n\n
    cat \/etc\/opendkim\/keys\/yourdomain.id\/mail.txt\n<\/code><\/pre>\n\n\n\n
    Example output:<\/p>\n\n\n\n
    mail._domainkey.yourdomain.id IN TXT (\n\"v=DKIM1; k=rsa; p=MIIBIjANBgkqh...\"\n)\n<\/code><\/pre>\n\n\n\n
    Add this to your DNS:<\/p>\n\n\n\n
    Field<\/th>Value<\/th><\/tr><\/thead>
    Host<\/td>mail._domainkey<\/code><\/td><\/tr>
    Type<\/td>TXT<\/code><\/td><\/tr>
    Value<\/td>(paste the entire p=...<\/code> value)<\/em><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    DMARC Configuration<\/h2>\n\n\n\n
    Add the following DNS record:<\/p>\n\n\n\n
    Field<\/th>Value<\/th><\/tr><\/thead>
    Host<\/td>_dmarc<\/code><\/td><\/tr>
    Type<\/td>TXT<\/code><\/td><\/tr>
    Value<\/td>v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.id; ruf=mailto:dmarc@yourdomain.id; fo=1<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    For strict enforcement<\/strong>, change:<\/p>\n\n\n\n
    p=reject\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
     Final Verification<\/h2>\n\n\n\n
    Test DKIM:<\/p>\n\n\n\n
    opendkim-testkey -d yourdomain.id -s mail -vvv\n<\/code><\/pre>\n\n\n\n
    Expected result:<\/p>\n\n\n\n
    key OK\n<\/code><\/pre>\n\n\n\n
    Send a test email to Gmail and check headers:<\/p>\n\n\n\n
    SPF: PASS\nDKIM: PASS\nDMARC: PASS\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
    Architecture We Are Building SPF \u2013 Allow your server to send email In your domain DNS (for example yourdomain.id), create a TXT record: Field Value Host @ Type TXT Value v=spf1 ip4:103.xx.xx.xx mx -all Replace 103.xx.xx.xx with your Postfix server\u2019s public IP address. Meaning: Install OpenDKIM Configure OpenDKIM Edit the configuration file: Ensure the following […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-51","post","type-post","status-publish","format-standard","hentry","category-mail-server"],"_links":{"self":[{"href":"https:\/\/vyos.web.id\/index.php?rest_route=\/wp\/v2\/posts\/51","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vyos.web.id\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vyos.web.id\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vyos.web.id\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vyos.web.id\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=51"}],"version-history":[{"count":2,"href":"https:\/\/vyos.web.id\/index.php?rest_route=\/wp\/v2\/posts\/51\/revisions"}],"predecessor-version":[{"id":53,"href":"https:\/\/vyos.web.id\/index.php?rest_route=\/wp\/v2\/posts\/51\/revisions\/53"}],"wp:attachment":[{"href":"https:\/\/vyos.web.id\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=51"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vyos.web.id\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=51"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vyos.web.id\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=51"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}