Running you own mail server III: DNS records — SPF, DKIM and DMARC

Through the internet or within any network — data travels and reaches its destination solely thanks to IP addresses. They label devices and allow them to identify one another, facilitating sending and recieving packages to and from the correct locations. But, even if IP addresses aren't technically endless, there are too many of them for us to be able to remember them all. You wouldn't be able to type from memory every website you want to visit, or every mail server's IP you need to send an email to. Here is where DNS comes into play, also known as 'the phonebook of the internet'.

The Domain Name System

The Domain Name System (DNS) translates readable domain names into their corresponding IP addresses, building a bridge between human and machine-to-maschine communication. When sending an email, your computer first reaches out to a DNS server, for it to translate the given address into the correct destination IP. Which IP address corresponds to which domain, and its routing directions, are described in DNS records. These are instructions stored in authorative DNS servers.To continue setting up your own mail server and to bring your domain to life, you'll need to write some DNS records yourself.

DNS records

Once you've acquired a domain, log into your domain registrar and look for a records editing section. Let's first create an A record entry. An A or AAAA DNS record determines the destination's IPv4 or IPv6 address, respectively. Select type A and and type in your server's IP address on the destination field. On the hostname field just enter an @ symbol. An @ — or sometimes just an empty field, depending on your registrar — refers to your organisational domain name.

To determine mail routing, make an MX (mail exchanger) entry. Again enter @ for the hostname and type in your domain name in the destination field. When having just one MX record, 10 is a default number for the priority field (lower numbers equal higherpriority). Your entries should end up looking something like this:

	Host Type MX Destination
	@ A 62.54.239.211
	@ MX 10 <YourDomain>.com

Authenticating mail

This basic setup will get the mail server running, but still in quite a chaotic manner. Your mail box would become full of spam, your sent emails would probably get rejected and you'd be at risk of interference back-and-forth, the famous Man-in-the-Middle attacks. Since email communication only makes sense if it is authenticated and secure, let's set some more DNS records.

There are three essential mail security and authentication protocols: SPF, DKIM and DMARC. Each is responsible for a different step on assuring that an email is legitimate.

Sender Policiy Framework (SPF)

The Sender Policy Framework (SPF) lets you define which servers are authorised to send mail on behalf of your domain. Mailservers check incoming mail, comparing the sending IP address with the ones listed on the domain's SPF records and ensuring they are actually authorised. This instructions must be specified in DNS records. They indicate not only which IP addresses are valid for that domain, but also suggest the receiving end what to do with your mail if the sending address isn't authorised. To set an SPF record, create a TXT entry and give in @ as your host. In the destination field, enter v=spf1 mx -all.

	Host Type MX Destination
	@ TXT v=spf1 mx -all

You'll notice we haven't actually specified any IP address. By adding mx instead of an address, we authorize automatically any server mentioned in our MX records. This is more efficient than having to edit both SPF and MX records in case of any change or addition. The -all indicates the recipient to completely reject all mail which does not pass SPF authentication. Another alternative is to replace this last property with ~all, which instead delivers it but marks it as spam.

DKIM signing

While SPF verifies where mail comes from focusing on the message's path, the DomainKeys Identified Mail protocol (DKIM) focuses on the content of the message, verifying this wasn't tempered with in transit. DKIM uses digital signatures based on public-private key cryptography. When sending an email, the mailserver first hashes certain content of the message — like the subject or the body — to then encrypt it using its private key. This crafted signature is added to the email as a header. The recipient looks for the corresponding public key on the sender's DNS records and uses it to decrypt the header. It then hashes the content of the email itself and compares the result with the decrypted sender's hash. If they are identical, the message hasn't been altered and the email is authentic.

Before writing a DNS record, you first have to generate a key pair for DKIM signing. On the terminal, run openssl genrsa -out dkim.<YourDomain>.key 2048. OpenSSL is included by default in the FreeBSD system. To retrieve the public key run openssl rsa -in dkim.<YourDomain>.key -pubout -out dkim.<YourDomain>.pub. Save your keys securely — we'll need their location path later. Under /usr/local/etc/mail/ make a new directory /dkim and move both keys to it.

#	mkdir /usr/local/etc/mail/dkim
#	mv dkim.<YourDomain>.key /usr/local/etc/mail/dkim
#	mv dkim.<YourDomain>.pub /usr/local/etc/mail/dkim

Back in the DNS records, create a TXT entry to register your DKIM public key. The host field must be completed with a selector — a unique string to identify a DKIM public key record — followed by _domainkey. The selector can be anything, here we are using the date in which the keys were created. Lastly run cat /usr/local/etc/mail/dkim/dkim.<YourDomain>.pub and copy the public key in the destination field as shown.

	Host Type MX Destination
	16072026._domainkey TXT v=DKIM1;k=rsa;p=<YourPublicKey>

Domain-based Message Authentication, Reporting and Conformance (DMARC)

DMARC stands for Domain-based Message Authentication, Reporting and Conformance; a protocol which instructs receiver servers what to do with messages that fail either SPF or DKIM authentication and allows senders to get feedback on their rejected mail. Not-aligned messages can get passed, rejected or quarantined (marked as spam).

Note that, since these three policies are closely linked, SPF and DKIM must be already working accordingly before setting up DMARC. Both of them can be checked under dkimvalidator.com.

Make a TXT entry in your DNS records. 'V' describes the protocol, 'p' the actions for the organisational domain, 'sp' the actions for the subdomains, 'pct' the percentage of messages to be filtered, and 'rua' the address to which DMARC reports should be sent.

	Host Type MX Destination
	_dmarc TXT v=DMARC1;p=reject;sp=reject;pct=100;rua=mailto:<User>@<YourDomain>;

The next step

We have specified our DKIM key in our DNS records, but we still need a tool to actively sign our outgoing mail with it. Here again comes in play the simplicity of OpenSMTPd as a Mail Transfer Agent (MTA): you can either install and set up the filter opensmtpd-filter-dkimsign, or go a step further and install Rspamd, covering DKIM signing and spam filtering all in one go. Meet Rspamd in our next and last entry on running your own mail server — Running your own mail server IV: Rspamd.