Comments

• AuroraZero

  January 2023

  

  Thanked by (1)FrankZ

  "I would have gotten away with it too, if it wasn't for that meddling Frankz and Mason!!"
• Mason AdministratorOG

  January 2023

  Thanks for the contribution and easy-to-follow write-up, @FrankZ!

  Thanked by (1)FrankZ

  Head Janitor @ LES • About • Rules • Support • Donate
• yoursunny OG

  January 2023

  What's the purpose of including the mail relay server's IP address in the SPF record?
  This IP wouldn't connect to recipient MX servers.

  Thanked by (1)FrankZ

  Webhosting24 aff best VPS; ServerFactory aff best VDS; Cloudie best ASN; Huel aff best brotein.
• Not_Oles Hosting ProviderContent Writer

  January 2023

  Hi @FrankZ! Thanks for the great article! I seem to recall hearing somewhere that using the hardfail qualifier "-all" in the spf record might result in emails becoming slightly more likely to be classified as spam. Apparently, and counter intuitively, the softfail qualifier "~all" might work better for deliverability. I wish I remembered the source for this. ¡Saludos!

  Thanked by (2)FrankZ abtdw

  MetalVPS
• Ganonk

  January 2023

  very nice tutor 💯

  Thanked by (1)FrankZ

  free KVM & free LXC on stock || free NAT KVM v2.1
• Flying_Chinaman

  January 2023 edited January 2023

  very nice turtle💯

  Thanked by (2)ehab FrankZ

  Yo, join our premium masochist club
• imok OG

  January 2023

  That's a lot of steps.
• ehab Content Writer

  January 2023

  @imok said:
  That's a lot of steps.

  i can help you .... give me your passwords,

  Thanked by (1)FrankZ
• Mason AdministratorOG

  January 2023

  @imok said:
  That's a lot of steps.

  

  "No thanks, God, that's a lot of steps." - @imok

  Thanked by (2)imok FrankZ

  Head Janitor @ LES • About • Rules • Support • Donate
• vyas OGRetired

  January 2023

  @imok said:
  That's a lot of steps.

  @FrankZ means business. he is implying, "Step up or be left out."

  Thanked by (1)FrankZ

  VPS reviews and benchmarks |
• AlwaysSkint OG

  January 2023 edited January 2023

  @FrankZ said: If you're sending a limited amount of mail..

  

  Thanked by (1)FrankZ

  It wisnae me! A big boy done it and ran away.
  NVMe2G for life! until death (the end is nigh)
• FrankZ Moderator

  January 2023

  @yoursunny said:
  What's the purpose of including the mail relay server's IP address in the SPF record?
  This IP wouldn't connect to recipient MX servers.

  Force of habit. On the few occasions that I have had issues connecting to MXRoute and send mail directly from the relay server, I have sometimes forgotten to add the IP of the relay server to the SPF record, which with the hard fail SPF record causes mail to be rejected. Force of habit also has me set up a reverse DNS entry for the relay server by default even though that is also not required to send outbound mail via MXRoute.

  ---

  @Not_Oles said: Hi @FrankZ! Thanks for the great article! I seem to recall hearing somewhere that using the hardfail qualifier "-all" in the spf record might result in emails becoming slightly more likely to be classified as spam. Apparently, and counter intuitively, the softfail qualifier "~all" might work better for deliverability. I wish I remembered the source for this. ¡Saludos!

  Hi Tom and thank you for the compliment on my first attempt at this sort of thing
  Most people do use the the softfail qualifier "~all" instead of the hardfail qualifier "-all" and it is reasonable to do so. Personally I do not recommend doing this as the softfail qualifier is taken by many receiving mail servers as "even if the sending server does not match the SPF record it is still ok to accept mail from the server". If someone has set up the outbound mail server as I have shown above, the hardfail qualifier "-all" should not be an issue as the SPF record should always match the sending mail server. The biggest reason I recommend the hard fail in the SPF record is that mail that is sent from email servers that you do not control, who are spoofing your domain as the sender may be accepted with a softfail, with a hardfail those emails should always be rejected by the receiving mail server.

  ---

  @imok said:
  That's a lot of steps.

  I was probably overly explicit, so it looks more intimidating than it is. If there is any demand I can turn this into a couple of install scripts so that it would be easier to install. You would still need to set a few things manually like the SPF record, but the script would do most of the heavy lifting.

  ---

  @AlwaysSkint said:

  @FrankZ said: If you're sending a limited amount of mail..

  

  Corrected. If you only found one error in my long post I am going to consider that a success.

  Thanked by (5)vyas AuroraZero AlwaysSkint Not_Oles Mason

  LES • About • Donate • Rules • Support
• AlwaysSkint OG

  January 2023

  I'll give this a run through (with CWP installing the core software), when/if the $6 Dallas VPS gets activated.

  Thanked by (2)FrankZ edrebe

  It wisnae me! A big boy done it and ran away.
  NVMe2G for life! until death (the end is nigh)
• JDMcPea

  January 2023

  This is probably obvious to more experienced folks but what is the advantage of setting up an outgoing mail relay on a VPS to send mail mail to an MXRoute account? Wouldn't it be easier to direct your outgoing mail straight to MXRoute instead of having it go through an extra relay point?

  Isn't the MXRoute service an outgoing mail relay itself (as well as other things)?

  DISCLAIMER: I iz notz zo zmarty

  Thanked by (3)AuroraZero FrankZ localhost
• FrankZ Moderator

  January 2023 edited January 2023

  @JDMcPea said:
  This is probably obvious to more experienced folks but what is the advantage of setting up an outgoing mail relay on a VPS to send mail mail to an MXRoute account? Wouldn't it be easier to direct your outgoing mail straight to MXRoute instead of having it go through an extra relay point?

  Isn't the MXRoute service an outgoing mail relay itself (as well as other things)?

  DISCLAIMER: I iz notz zo zmarty

  Hello. The relay is to send mail out through MXRoute to other mail servers like gmail and such. Not to send email to MXRoute, as you are correct that would not serve any real purpose. The reason I like to relay my outbound mail through MXRoute is that @Jarland is very good at deliver-ability so I don't have to worry about if the mail gets to the recipient.

  The idea behind a relay of this type is so that if you have various different web servers that send outbound mail, as an example a forum, you could setup that VPS to relay its mail via the relay server, then through MXRoute, and finally to the destination mail server of the recipient. You could of course just do part one of this tutorial on each server that you wanted to send outbound mail from, if you only had a few servers. I normally have at least 40 servers sending some outbound mail so I find it more convenient to set up a couple of relay servers and have all the other servers send mail through the relays.

  Another reason, or use, for the relay is if your VPS host blocks email ports (25, 465, 587) by using the relay which is on port 2525 these servers can still send outbound email via the relay.

  Thanked by (3)jarland JDMcPea Mason

  LES • About • Donate • Rules • Support
• jarland Hosting ProviderOG

  January 2023 edited January 2023

  It’s worth noting that a slight variation on this kind of setup consumes a significant amount of my time trying to protect the infrastructure from being overwhelmed by pure junk that drags down IP reputation by increasing the association between our IPs and spam folders. These are the big line items:

  1. Almost no one who does this cares that their hostname isn’t an actual valid domain, forcing me to locate all of their server hostnames and add them to a banned sender list so they get errors instead of flooding the queue with junk I can’t deliver or bounce.
  2. That cron job you have set to run every minute sends a notification, and the person who sets this up commonly has all of these emails sent to their Gmail address.
  3. A simple command line interface or a cron job notification lacks the required headers that a legitimate email client would add without the user noticing.

  Number 1 causes our mail queues to be packed full of “root@vps{1..999}” emails that I can’t and won’t deliver because they’re not from valid envelope senders. But I can’t say that these are inherently bad and prevent them from going out before I identify each one of them because temporary DNS issues could cause a sending address to appear invalid that isn’t later. So I queue them, but then I audit the queues every day for this junk and use it to build my banned sender list (ex. *@localhost, *@vps1, *@vps.local, etc.).

  Number 2 loops in with #1, and the two items work hand in hand to try to overly associate our IP addresses with Gmail’s spam folder, and number 3 comes in here as part of that. A bad sending address, a cron job notification that the user never meant for human consumption (and will never read, save for the 1 in a million user who might), and a lack of valid headers combined with Gmail’s threading feature mean you see one little junk email in your Spam folder, but you actually sent 1,440 junk emails per cron job to Gmail that were all destined to the spam folder. Combine that with the 600 other users doing the same thing, and you then have 864,000 emails from our platform daily, which are guaranteed to land in Gmail’s spam folder. Almost none of those users even meant to send those emails. The users rarely have any idea that they sent them, and they have no plan of gaining anything from it. It’s hard to let all of that through and then tell people I’m focused on doing everything I can to ensure inbox delivery.

  All this to say, it’s good to be able to configure your systems to do this, but please keep one thing in mind: The MXroute platform is designed to send emails that are intended for either human consumption or automatic processing. It is not intended to be used as a garbage delivery system for Gmail. It also can’t be used as a garbage delivery system for Gmail, expecting that intentionally sent emails have a high probability of landing in the inbox. It can be one or the other. It can’t be both. Doing everything I can to get intentional emails into the inbox has always been my top focus. So please, if you do this, take a moment to consider what your server is doing and how it may use this configuration in ways you weren’t thinking of at the time.

  Do make sure that your sending addresses are always valid. If your hostname isn’t valid, has no MX or SPF records itself, then your cron jobs and other system emails are going to be sending as invalid envelope senders. Think “root@localhost” that’s not valid, even “[email protected]” is invalid if myvps.mydomain.tld lacks valid MX/SPF. Most of that is fine if you’re sending to yourself to be delivered to an inbox on the same MXroute server that your service is hosted on, but if you’re sending these out to remote recipients that’s when you really need to dot your I’s and cross your T’s, making sure you have everything done properly.

  Thanked by (5)FrankZ JDMcPea ralf beagle jcolideles

  Hate radiates from the source. If you look around and see it everywhere, it's coming from you.
• JDMcPea

  January 2023

  @FrankZ said:

  @JDMcPea said:
  This is probably obvious to more experienced folks but what is the advantage of setting up an outgoing mail relay on a VPS to send mail mail to an MXRoute account? Wouldn't it be easier to direct your outgoing mail straight to MXRoute instead of having it go through an extra relay point?

  Isn't the MXRoute service an outgoing mail relay itself (as well as other things)?

  DISCLAIMER: I iz notz zo zmarty

  Hello. The relay is to send mail out through MXRoute to other mail servers like gmail and such. Not to send email to MXRoute, as you are correct that would not serve any real purpose. The reason I like to relay my outbound mail through MXRoute is that @Jarland is very good at deliver-ability so I don't have to worry about if the mail gets to the recipient.

  The idea behind a relay of this type is so that if you have various different web servers that send outbound mail, as an example a forum, you could setup that VPS to relay its mail via the relay server, then through MXRoute, and finally to the destination mail server of the recipient. You could of course just do part one of this tutorial on each server that you wanted to send outbound mail from, if you only had a few servers. I normally have at least 40 servers sending some outbound mail so I find it more convenient to set up a couple of relay servers and have all the other servers send mail through the relays.

  Another reason, or use, for the relay is if your VPS host blocks email ports (25, 465, 587) by using the relay which is on port 2525 these servers can still send outbound email via the relay.
  

  @FrankZ Thanks for your answer- I now understand that one advantage would be if my VPS provider blocks the email ports then setting up a relay on another VPS would be a good solution.

  I think I phrased my question poorly- what I meant to write was is why not have outgoing email relayed directly through (not to) an MXRoute account? Assuming my host does not block email ports. For example- lets say I have a VPS with a WordPress website and the Contact form is set up to send outgoing messages through MXroute, which then delivers them reliably to Gmail, Outlook, etc.

  Or I could have it set up to send the WordPress email first to a relay server that I have set up on another VPS, which will then send the email to MXroute, which will then send to Gmail, etc.

  One possible advantage I can think of (please let me know if this is not accurate) is that when I get an account with MXRoute they limit the servers/IP addresses that I can use to send outgoing mail through their service? In that case a setting up my own relay on a VPS would allow an unlimited number of IPs/servers from which I can send email through MXRoute?
• FrankZ Moderator

  January 2023

  @JDMcPea Your assessment is correct. The relay server in Part 1 can be setup on any VPS. In your example of the VPS with the WordPress site you could set up the mail server as described in Part 1 on the same VPS as the WordPress site and do not do Part 2.
  You would need to set WordPress to use Mail SMTP instead of the default wp_mail (PHP mail) by going to the menu item "WP Mail SMTP", choosing "Other SMTP" and entering localhost as the SMTP server. In this case I would also suggest setting up OpenDKIM, on the same VPS which will be a tutorial I will be putting up shortly as a companion to this one or if you do a google search I am sure you can find a tutorial regarding OpenDKIM that you can use. It this scenario your email would go directly to MXRoute from your WP VPS with no second VPS but your email is still being relayed via MXRoute.

  Thanked by (1)JDMcPea

  LES • About • Donate • Rules • Support
• flips OG

  January 2023

  I guess you would also add a step for autoupdating the .pem, tied into letsencrypt setup ... (Unless I missed that when reading through)

  Thanked by (1)FrankZ
• FrankZ Moderator

  January 2023

  @flips said:
  I guess you would also add a step for autoupdating the .pem, tied into letsencrypt setup ... (Unless I missed that when reading through)

  Thank you for pointing that out, you are correct, that step is not included and should be. I will make a note in the above that the cert step should be redone as the cert expires.

  Thanked by (1)flips

  LES • About • Donate • Rules • Support
• flips OG

  January 2023

  For Lighty I found Dehydrated easy to use to add a hook/script to generate the pem and reload the web server ...

  Thanked by (1)FrankZ
• ariq01

  March 2023 edited March 2023

  I was looking for this to setup my fail2ban notifications, and I found your article.
  Thanks man

  *edit, sorry didn't mean to necropost, can I cite this thread in my blog post?

  Thanked by (1)FrankZ

  I’m a simple man I see gifs, I press thanks
• FrankZ Moderator

  March 2023

  @ariq01 said: can I cite this thread in my blog post?

  Feel free.

  Thanked by (1)ariq01

  LES • About • Donate • Rules • Support
• legendary

  March 2023

  300 mails/hour could be easily exhausted with buggy cron. Be sure to tight up your system messaging before relay setup.

  I would like to see proper guides for exim, postfix and qmail. And some amavis rules maybe? Lets get fancy!
• ariq01

  March 2023 edited March 2023

  I'm using Ubuntu 20.04,

  - using libsasl2-2 sasl2-bin libsasl2-modules rather than cyrus-sasl cyrus-sasl-plain
  - replace everything /sendmail-cf/ to /sendmail/cf/ in Makefile
  - replace on /etc/mail/sendmail.mc to from sendmail-cf/ to sendmail/cf/ too

  Everything on step 1 completed, vm and service restarted, but still no luck

  Mar 19 09:35:27 email sendmail[2254]: NOQUEUE: SYSERR(root): hash map "Alias0": unsafe map file /etc/aliases.db: Permission denied
  Mar 19 09:35:27 email sendmail[2254]: NOQUEUE: SYSERR(root): Cannot create database for alias file /etc/aliases
  Mar 19 09:35:27 email sm-mta[2163]: restarting /usr/sbin/sendmail-mta due to signal
  Mar 19 09:35:27 email sm-mta[2163]: error: safesasl(/usr/lib/sasl2/Sendmail.conf) failed: Permission denied
  Mar 19 09:35:27 email sm-mta[2271]: starting daemon (8.15.2): SMTP+queueing@00:10:00
  Mar 19 09:35:27 email sm-mta[2271]: STARTTLS=server: file /etc/mail/certs/ca-bundle.crt unsafe: No such file or directory
  Mar 19 09:35:44 email sendmail[2299]: 32J9ZitB002299: from=root, size=33, class=0, nrcpts=1, msgid=<[email protected]>, relay=root@localhost
  Mar 19 09:35:44 email sm-mta[2300]: 32J9ZioN002300: SYSERR(root): collect: Cannot write ./df32J9ZioN002300 (bfcommit, uid=0, gid=120): Permission denied
  Mar 19 09:35:44 email sm-mta[2300]: 32J9ZioN002300: from=<[email protected]>, size=304, class=0, nrcpts=1, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
  Mar 19 09:35:44 email sendmail[2299]: 32J9ZitB002299: [email protected], ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30033, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: 421 4.3.0 collect: Cannot write ./df32J9ZioN002300 (bfcommit, uid=0, gid=120): Permission denied
  

  *Edit: nevermind, I'm using msmtp msmtp-mta right now

  I’m a simple man I see gifs, I press thanks
• somik OG

  May 2023

  @Mason said:

  @imok said:
  That's a lot of steps.

  "No thanks, God, that's a lot of steps." - @imok

  New tutorial:
  Step 1, Install Virtualmin Panel
  Step 2, From Virtualmin Panel, Go to Webmin > Servers > Postfix Mail Server > SMTP Authentication And Encryption
  Step 3, Change "Send outgoing mail via host", "Use SASL SMTP authentication", "SMTP login to outgoing mail host"

  That is what I use to send emails through my prefered SMTP relay. It works perfectly for my use case.

  Thanked by (1)FrankZ

  Somik.org - Server admins cheat codes