Perguntas[postfix](server)

Estou recebendo o erro abaixo após instalar o Postfix seguindo este artigo .

2025-04-14T00:46:18.494081+00:00 mail postfix/lmtp[29381]: 5436D7EADB: to=<[email protected]>, relay=mail.example.com[private/dovecot-lmtp], delay=0.23, delays=0.12/0.01/0.01/0.09, dsn=5.1.1, status=bounced (host mail.example.com[private/dovecot-lmtp] said: 550 5.1.1 <[email protected]> User doesn't exist: [email protected] (in reply to RCPT TO command))

Abaixo está a saída do postconf

# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
compatibility_level = 2
disable_vrfy_command = yes
inet_interfaces = all
inet_protocols = all
invalid_hostname_reject_code = 550
mailbox_size_limit = 0
maximal_backoff_time = 3h
minimal_backoff_time = 180s
mydestination = localhost
mydomain = example.com
myhostname = mail.example.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = $mydomain
non_fqdn_reject_code = 550
readme_directory = no
recipient_delimiter = +
relayhost =
smtp_always_send_ehlo = yes
smtp_helo_timeout = 15s
smtp_rcpt_timeout = 15s
smtp_tls_security_level = may
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname
smtpd_recipient_limit = 40
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unlisted_recipient, reject_unauth_destination
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, reject_unknown_sender_domain
smtpd_timeout = 30s
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_tls_security_level = may
smtpd_use_tls = yes
strict_rfc821_envelopes = yes
unknown_address_reject_code = 550
unknown_client_reject_code = 550
unknown_hostname_reject_code = 550
unverified_recipient_reject_code = 550
unverified_sender_reject_code = 550
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf, mysql:/etc/postfix/mysql-virtual-email2email.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp
postconf: warning: /etc/postfix/main.cf: support for parameter "smtpd_use_tls" will be removed; instead, specify "smtpd_tls_security_level"

Executando os resultados do doveadm abaixo.

doveadm user [email protected]

userdb lookup: user [email protected] doesn't exist

Tenho executado meu servidor de e-mail sem problemas por alguns anos, mas recentemente tive duas instâncias em que me registrei em um site e nunca recebi o e-mail de verificação. Um era do mcsignup.comdomínio, o outro de mandrillapp.com.

Este é um exemplo de entrada do arquivo de log de e-mail:

postfix/smtpd[1550221]: connect from mail17.mcsignup.com[198.2.179.112]
postfix/smtpd[1550221]: discarding EHLO keywords: CHUNKING
postfix/smtpd[1550221]: disconnect from mail17.mcsignup.com[198.2.179.112] ehlo=1 starttls=1 quit=1 commands=3
postfix/smtpd[1550221]: connect from mail17.mcsignup.com[198.2.179.112]
postfix/smtpd[1550221]: discarding EHLO keywords: CHUNKING
postfix/smtpd[1550221]: disconnect from mail17.mcsignup.com[198.2.179.112] ehlo=1 starttls=1 quit=1 commands=3

Li em outro post que isso pode ser devido a algumas das minhas configurações serem muito restritas, mas gostaria de entender o problema antes de fazer qualquer alteração. Tenho o spamassassin em execução, mas acho que as mensagens nem chegam a esse estágio.

Há outros arquivos de log que devo verificar?

Avise-me se preciso compartilhar alguns arquivos de configuração para facilitar as coisas.

[EDITAR] main.cf

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
home_mailbox = Maildir/
inet_interfaces = all
inet_protocols = ipv4, ipv6
local_recipient_maps = proxy:unix:passwd.byname $alias_maps
mailbox_size_limit = 0
mailbox_transport = lmtp:unix:private/dovecot-lmtp
message_size_limit = 33554432
milter_default_action = accept
milter_protocol = 2
mydestination = mail.marcocastorina.com, marcocastorina.com, localhost.localdomain, localhost
mydomain = marcocastorina.com
myhostname = mail.marcocastorina.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = $mydomain
non_smtpd_milters = $smtpd_milters
readme_directory = no
recipient_delimiter = +
relayhost =
smtp_dns_support_level = dnssec
smtp_host_lookup = dns
smtp_tls_mandatory_protocols = >=TLSv1.2
smtp_tls_protocols = >=TLSv1.2
smtp_tls_security_level = dane
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_discard_ehlo_keywords = chunking
smtpd_forbid_unauth_pipelining = yes
smtpd_milters = inet:localhost:12301
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination reject_unknown_sender_domain
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $mydomain
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = permit_sasl_authenticated permit_mynetworks
smtpd_tls_CAfile = /etc/letsencrypt/live/mail.marcocastorina.com/fullchain.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.marcocastorina.com/cert.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.marcocastorina.com/privkey.pem
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5
smtpd_tls_mandatory_protocols = >=TLSv1.2
smtpd_tls_protocols = >=TLSv1.2
smtpd_tls_security_level = encrypt
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

mestre.cf

smtp       inet  n       -       y       -       -       smtpd -o content_filter=spamassassin
submission inet  n       -       y       -       -       smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject_unauth_destination,reject
pickup     unix  n       -       y       60      1       pickup
cleanup    unix  n       -       y       -       0       cleanup
qmgr       unix  n       -       n       300     1       qmgr
tlsmgr     unix  -       -       y       1000?   1       tlsmgr
rewrite    unix  -       -       y       -       -       trivial-rewrite
bounce     unix  -       -       y       -       0       bounce
defer      unix  -       -       y       -       0       bounce
trace      unix  -       -       y       -       0       bounce
verify     unix  -       -       y       -       1       verify
flush      unix  n       -       y       1000?   0       flush
proxymap   unix  -       -       n       -       -       proxymap
proxywrite unix  -       -       n       -       1       proxymap
smtp       unix  -       -       y       -       -       smtp
relay      unix  -       -       y       -       -       smtp
showq      unix  n       -       y       -       -       showq
error      unix  -       -       y       -       -       error
retry      unix  -       -       y       -       -       error
discard    unix  -       -       y       -       -       discard
local      unix  -       n       n       -       -       local
virtual    unix  -       n       n       -       -       virtual
lmtp       unix  -       -       y       -       -       lmtp
anvil      unix  -       -       y       -       1       anvil
scache     unix  -       -       y       -       1       scache
maildrop   unix  -       n       n       -       -       pipe flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
uucp       unix  -       n       n       -       -       pipe flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail     unix  -       n       n       -       -       pipe flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp      unix  -       n       n       -       -       pipe flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n       n       -       2       pipe flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman    unix  -       n       n       -       -       pipe flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user}
spamassassin unix -      n       n       -       -       pipe user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

De vez em quando vejo logs do postfix como este:

Mar 18 13:19:19 ... smtpd[1217240]: SSL_accept error from mx0b-002b8002.pphosted.com[148.163.140.242]: -1
Mar 18 13:19:19 ... smtpd[1217240]: warning: TLS library problem: error:0A0000C1:SSL routines::no shared cipher:../ssl/statem/statem_srvr.c:2220:

Eu bloqueio cifras antigas:

smtpd_tls_mandatory_ciphers = high                                                             
smtpd_tls_mandatory_exclude_ciphers = ECDHE-RSA-RC4-SHA                                        
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3                                                 
smtpd_tls_protocols = >=TLSv1  

Então agora eu gostaria de ver quais cifras o cliente está oferecendo quando ele tenta se conectar ao meu servidor, mas não consigo ver isso nos logs. Existe uma maneira de obter essas informações?

Estou tentando configurar o DKIM no Postfix com o OpenDKIM para vários domínios (1 é meu, 1 é um cliente para quem estou enviando e-mails) e cada domínio parece ter sua chave removida ao passar pelo pphosted ou O365 Protection. Isso é algo que preciso levantar com o PPHosted/MS ou preciso alterar meus MailHeaders para que alguma forma de Pass-through ou Transparência ocorra? O cabeçalho de exemplo abaixo e a entrada são bem-vindos, admito totalmente que não sou um especialista em e-mail por profissão.

Received: from CH0PR10MB5050.namprd10.prod.outlook.com (2603:10b6:610:c3::21)
 by CY5PR10MB6093.namprd10.prod.outlook.com with HTTPS; Thu, 13 Feb 2025
 09:47:34 +0000
Received: from BN1PR10CA0020.namprd10.prod.outlook.com (2603:10b6:408:e0::25)
 by CH0PR10MB5050.namprd10.prod.outlook.com (2603:10b6:610:c3::21) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8445.13; Thu, 13 Feb
 2025 09:47:32 +0000
Received: from BL02EPF0001A105.namprd05.prod.outlook.com
 (2603:10b6:408:e0:cafe::39) by BN1PR10CA0020.outlook.office365.com
 (2603:10b6:408:e0::25) with Microsoft SMTP Server (version=TLS1_3,
 cipher=TLS_AES_256_GCM_SHA384) id 15.20.8445.12 via Frontend Transport; Thu,
 13 Feb 2025 09:47:32 +0000
Authentication-Results: spf=softfail (sender IP is 205.220.176.61)
 smtp.mailfrom=myowndomain.net; dkim=fail (no key for signature)
 header.d=keyuk._domainkey.myowndomain.net myowndomain.net;dmarc=fail
 action=none header.from=myowndomain.net;compauth=softpass reason=201
Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
 myowndomain.net discourages use of 205.220.176.61 as permitted sender)
Received: from mx0b-00560d01.pphosted.com (205.220.176.61) by
 BL02EPF0001A105.mail.protection.outlook.com (10.167.241.137) with Microsoft
 SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.8445.10 via Frontend Transport; Thu, 13 Feb 2025 09:47:32 +0000
Received: from pps.filterd (m0211367.ppops.net [127.0.0.1])
    by mx0a-00560d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 51D10CS6012720
    for <[email protected]>; Thu, 13 Feb 2025 01:47:31 -0800
Authentication-Results-Original: ppops.net; dkim=permerror header.s=claimsuk
 header.d="claimsuk._domainkey.myowndomain.net myowndomain.net";    spf=pass
 [email protected];    dmarc=pass header.from=myowndomain.net
Received: from mail.myowndomainsolutions.com (dc.myowndomain.net [20.20.20.20])
    by mx0a-00560d01.pphosted.com (PPS) with ESMTPS id 44s6pp1824-1
    (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT)
    for <[email protected]>; Thu, 13 Feb 2025 01:47:31 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;
    d=keyuk._domainkey.myowndomain.net myowndomain.net; s=claimsuk;
    t=1739440046; bh=1ArcIF9kP5Ki5v8a3MA3aUgZVCpRrnOdX1Podyt6DKA=;
    h=To:From:Subject:Date:From;
    b=gtbRbsJl63Naj/XO76e/fdsbGo11dGry/EwBX2+Hepze3uaar15C5ym+LE05s9pCg
     iLCGtFYkqE8zPCWdSYBqVGbiFrpxLwME8vyTg6qNwAfK42f8NyvakbVSIE7e9fgXBu
     SsEYkYX4TNkga67HQUQKRKPvIRUo65RQyQZ6kTiE=
To: [email protected]
From: [email protected]
Subject: DKIM Key Test
Message-ID: <[email protected]>
Date: Thu, 13 Feb 2025 09:47:26 +0000 (GMT)
MIME-Version: 1.0
Content-Type: text/plain
Received-SPF: Pass (-MB01.corp.myowndomain.net: domain of
 [email protected] designates 20.20.20.20 as permitted sender)
 receiver=-MB01.corp.myowndomain.net; client-ip=20.20.20.20;
 helo=ukmail.myowndomain.net;
X-MS-Exchange-Inbox-Rules-Loop: [email protected]
X-Authority-Analysis: v=2.4 cv=eqolzppX c=1 sm=1 tr=0 ts=67adbfb3 cx=c_pps a=TJnIzTbciDcbiQthplJf9A==:117 a=TJnIzTbciDcbiQthplJf9A==:17 a=T2h4t0Lz3GQA:10 a=f_HGTJe14XwA:10 a=d9pSX2iPWizscR3k-fUA:9
X-Proofpoint-ORIG-GUID: 78cSzD9BjKsdz8sXytSnMvtT5Gxkzgwh
X-CLX-Shades: MLX
X-Proofpoint-GUID: 78cSzD9BjKsdz8sXytSnMvtT5Gxkzgwh
X-CLX-Response: 1TFkXHhMRCkx6FxoRCllEF2R6Xlt7YkN5eXNnEQpYWBdiHh1hfBJIHUtefxE KeE4XYE5wY05nHB15XQURCnlMF29oG00aZgFuZhscEQpDSBcYGhEKQ1kXBxsfEhEKQ0kXGgQaGh oRCllNF2dmchEKX1kXExIRCl9NF2dmchEKWUkXGxJxGwYZH3cGHxsGGgYaBgcbBhkacRsQGncGG
 gYaBhoGGgYaBhpxGhAadwYaEQpZXhdoY3kRCklGF0lFWE9GRU1DSXVCRVleT04RCklHF3hPTREK Q04XHRJJeVBuE2hAYVlOUBJZclNeeURnXF5+H21SQVBNXUIRClhcFx8EGgQZExsFGxoEGxoaBBs ZHgQZHhAbHhofGhEKXlkXTx4YeGURCk1cFwcYEQpMWhdobU1raxEKRVkXb2trEQpCTxdjSwFke0
 BOWRlhGBEKQ1oXHRsEGxMEGxIfBB4RCkJeFxsRCkJFF2IeHWF8EkgdS15/EQpCThdgTnBjTmccH XldBREKQkwXYh4dYXwSSB1LXn8RCkJsF2IeHWF8EkgdS15/EQpCQBdkXXtgf2ZMXQVPTxEKQlgX ZRpucxJGUAFDTX8RCk1eFxsRClpYFxsRCnlDF2cTcnpGQ3l8XXpmEQpZSxcSGB8TEQpwaBdtaHl
 zHkdFGB59XxAZGhEKbX4XGxEKWE0XSxEg
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1057,Hydra:6.0.680,FMLib:17.12.68.34
 definitions=2025-02-13_03,2025-02-13_01,2024-11-22_01
X-Proofpoint-Spam-Details: rule=inbound_notspam policy=inbound score=0 bulkscore=0 phishscore=0
 impostorscore=0 suspectscore=0 priorityscore=0 adultscore=0
 lowpriorityscore=0 mlxscore=0 clxscore=49 spamscore=0 malwarescore=0
 classifier= authscore=0 authtc=n/a authcc= route=inbound adjust=0
 reason=mlx scancount=1 engine=8.19.0-2501170000
 definitions=main-2502130074 domainage_hfrom=8259
Return-Path: [email protected]
X-MS-Exchange-Organization-ExpirationStartTime: 13 Feb 2025 09:47:32.1338
 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
 0845f00c-b8d9-4787-3ed4-08dd4c136fdd
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 2a7799fa-3705-4d9f-a766-ca37ccfafc06:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic:
 BL02EPF0001A105:EE_|CH0PR10MB5050:EE_|CY5PR10MB6093:EE_
X-MS-Exchange-Organization-AuthSource:
 BL02EPF0001A105.namprd05.prod.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Office365-Filtering-Correlation-Id: 0845f00c-b8d9-4787-3ed4-08dd4c136fdd
X-MS-Exchange-AtpMessageProperties: SA|SL
Content-Transfer-Encoding: quoted-printable
X-MS-Exchange-Organization-SCL: -1
X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026;
X-Forefront-Antispam-Report:
 CIP:205.220.176.61;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:CAL;SFV:SKN;H:mx0b-00560d01.pphosted.com;PTR:mx0b-00560d01.pphosted.com;CAT:NONE;SFS:(13230040)(82310400026);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Feb 2025 09:47:32.0401
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 0845f00c-b8d9-4787-3ed4-08dd4c136fdd
X-MS-Exchange-CrossTenant-Id: 2a7799fa-3705-4d9f-a766-ca37ccfafc06
X-MS-Exchange-CrossTenant-AuthSource:
 BL02EPF0001A105.namprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5050
X-MS-Exchange-Transport-EndToEndLatency: 00:00:02.9520118
X-MS-Exchange-Processed-By-BccFoldering: 15.20.8445.012
X-Microsoft-Antispam-Mailbox-Delivery:
    ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info:
    =?us-ascii?Q?yKtIQZypRgVxEQhMZnUTZx6QZFKRXYdcZWStsb3PIq7piO2S5jjceNnzBNxP?=
 =?us-ascii?Q?8dYtSz5BxP/wY7+TSj7ALvoGWI6QPl9nOMnr6WXno93ZosJilMZZxin9VnHM?=
 =?us-ascii?Q?VlPokmDKBi3hQCBRxQShRBPSInK8xYg/M3lv6fDUpNPA99Kf3Wh03kAkn2Gr?=
 =?us-ascii?Q?HXkzMD9855HMRBt9nmcFZ/y9xyFOx5xnA1zJyxjlybzthb5m7s2v6i4k3xdq?=
 =?us-ascii?Q?pBOdy1pYOC6NTZvw3OdkZ4NNZpxJFfYmr+iK+Xzb2Sd28ipPEbE7ISRhtl/c?=
 =?us-ascii?Q?vFi6QGXF3YzZQgWTbtUXdwryKGl/+FhgD3gNebQ8Hba47MSYl37VtUKljLh5?=
 =?us-ascii?Q?K/Jp88zCz+3QDgZHyoHaMguFdXYmJmCWT5hn+Nml+sjJF9DXbRd5V/GSyneQ?=
 =?us-ascii?Q?n16TYnm3u5AeytYrLycZ0aH+bOWM3Wpc94CMCE71xV4zGBFgHNd9sYg7OMNl?=
 =?us-ascii?Q?UMs/OORs44pc/PuRG9y7sPp/NF4UqdVkkXaT6D2crcNXsMnWGIlcd2O3yq0H?=
 =?us-ascii?Q?nHkdZpuIeLbFeW4JCs/fJXfzT1mdwcPuI7fJ7qauiXKYm8W+6JHn0T5Q+qNj?=
 =?us-ascii?Q?gL3SjnGUJVVmCfaeQzV87IlwcBUtIdEdkn/Uek+odZWoICpiFN5pfBRmZ/VD?=
 =?us-ascii?Q?+keN1zJdl86ZryJ+XY0yj2rqPEwqGbz8HIF1NWzFs2YvKuzh8RpyUlHxV4KH?=
 =?us-ascii?Q?dCjH1x+ZgH1YjdULLX/HZit2cLqPkv5pSCSvuhzQQ0tDXv/ot6ah5nHFhqB/?=
 =?us-ascii?Q?bEmLfbT/Xl2ryjb2Qh9uk4ewEFCFuOVzyF11UtiM1aPqYlVO5Y2DF5Q0SrJa?=
 =?us-ascii?Q?n+N2AaxFN8BFl6NQ6ZnePfAGnE5x8JHi344wrMcEV5hyYx576GTMV74Wzvlr?=
 =?us-ascii?Q?ySOpzwesijhmqVVvZmspxvxpo8rNRKQaZKdsb8jygEpm1OyuoyBN2lsb0pwV?=
 =?us-ascii?Q?JtWZHYQfKAwpSwH8DRxMmyrTaurTKZmMkQCxykKGPTcAjmcWsIZYec4u7yHm?=
 =?us-ascii?Q?AZ9QCXv3NcqiZokSn1wClrK/bn6aBjxthd0hqg104uo5IPyPk9UUgujkTiFu?=
 =?us-ascii?Q?UhU4h5oaOg6MYfO6HQuzO2ahw6ApJHw/7ntQec4Vo9IUZeRRBqAg9Qa6j6OO?=
 =?us-ascii?Q?lsOws1Lc2vSWJBbSuoDMp/IWU987Ko8eDfFi1WmUaaJC0qkcK/nxPUV/weCp?=
 =?us-ascii?Q?4UMUA+I4aemykxdIGUl/Rdi5rTd7wQYmZn+eHEoB4DHuOm6Z+/oeHW+hK6Wr?=
 =?us-ascii?Q?PUvIm3Hm1rgiVvQL5PARqXR5jGQbVGe3O8s7D9/cajO3f1X5RCR++DQTAef5?=
 =?us-ascii?Q?LTaFgmNINU8+muJAEVjIhSBCA7NHkmm9uUdgIkJMngxrW1bEtLXFdQo15as3?=
 =?us-ascii?Q?y11sKrkVvm8Mwecb5ibFsXqAqaQ0MxeHLzjj4K4v6fzt99gQELufE8zH6yMP?=
 =?us-ascii?Q?UrTbgs268Ww7f0mF/wmoPODtn8h2MLtYuuxaXxTTskHqN1cq57XQl53KSanK?=
 =?us-ascii?Q?VUen3cRfXS4KT2DGoU2m/sr0YBSIMwySLm+qXdXk4mrUb0EJHkmEwk2M6DZT?=
 =?us-ascii?Q?Tejx4DtBNKwhl4Wglva7p96Xpu0wDyyp8KJH42maKYyIlbn/FmpeIkMbz8go?=
 =?us-ascii?Q?ZQSJf3CDcxSsx4nLtLicJ7mO0QjwoRfOQ2bZrp0HtUm2ZaA7oWp2NexuSXy/?=
 =?us-ascii?Q?pixAqmEzh1vDjkeSvy2GDhsZsqzbhUJjZxTDsreMpv1OemdG9pnbYkkI52C7?=
 =?us-ascii?Q?G16Y7uEVXvsbl2Sdq0pmPEGNZbjT8Kra1P+l4fXQ3Diifnk8+3kz+y+0FNh1?=
 =?us-ascii?Q?556xITX28FaXEsMrr3AEWz4+2hDGetMu12tVm6V0VAT5xrBtPRmvSyw6UWmT?=
 =?us-ascii?Q?j/J2UfCjcUzi5U7bQW5qiyhuMJnYcoOw8oXC25pwbpsQCRrozVDmx6woaSZn?=
 =?us-ascii?Q?d3hVoxY5m45jSmNbL5MaEeRYS2flhFlAy/Y3WAZ+JGjbuNxup5fKSEfRTExs?=
 =?us-ascii?Q?l5hTIaKElO3cDUI1pVamxMmIzQdyxFRUrxEC2IW5UkGeuqt8eDRFhBC5OVE8?=
 =?us-ascii?Q?0BSTB5x0z+0YQXhBUliVCFwuj4mFvvPMatCqvLUZbYskPTyx3lS0NgXRCLCX?=
 =?us-ascii?Q?JNYyxO5RgnzJ2kBLKmQjpIr2nvgXF8gDbBpNYPhx9vsAYbyTBNlw3Q/BKPWQ?=
 =?us-ascii?Q?ETlmjTssGth3sokAnxelkI+aagWW7xVyjshtTrUFawTSkZzP29AGVAAsgzZg?=
 =?us-ascii?Q?/cYnbeNOi8LHQiV+3yDxHXpbhakX//IoIPKlhQ3XLkar/C3+Py9ZTHMqvoT7?=
 =?us-ascii?Q?LDcfkiDix3esT/BcmxOeTXOsOByd6PLp5LdPsJfsgwDjNA=3D=3D?=

No meu Raspberry Pi eu uso Postfix 3.7.11 e Dovecot 2.3.19.1 (9b53102964). Eu tenho um domínio válido mydomain.com . Eu emiti um certificado gratuito letsencrypt para seu subdomínio mail.mydomain.com e criei registros DNS no cloudfare. No meu roteador eu abri as portas 465 e 993 para os protocolos SMTP e IMAP. Para e-mail eu uso usuários do SO não virtuais

Verifiquei a porta telnet e o domínio e tudo parece bem. Também configurei o cliente thunderbird e consigo enviar e-mails com sucesso para qualquer serviço de e-mail e o e-mail vai para a pasta de renda (sem spam) porque adicionei registros SPF, DMARK e DKIM também.

Tenho problema apenas com o recebimento de e-mails de quaisquer serviços. Então o Gmail me dá um e-mail de feedback com texto:

O servidor do destinatário não aceitou nossas solicitações de conexão. Para obter mais informações, acesse https://support.google.com/mail/answer/7720 [mail.mydomain.com. [meu ip externo]: FAILED_PRECONDITION: erro de conexão (111): Conexão recusada]

Postei minha configuração sem comentários. Verifiquei se tudo parece bom. Mas algo deu errado. Obrigado.

/etc/postfix/main.cf

myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
append_dot_mydomain = no
readme_directory = no
compatibility_level = 3.6
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.mydomain.com-0001/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.mydomain.com-0001/privkey.pem
smtpd_tls_security_level = encrypt
smtpd_tls_auth_only = yes
smtpd_tls_wrappermode = yes
smtpd_tls_loglevel = 1
smtpd_use_tls = yes
smtp_tls_CApath=/etc/ssl/certs
smtp_tls_security_level=may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
myhostname = mail.mydomain.com
mydomain = mydomain.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = mydomain.com, mail.mydomain.com, localhost.localdomain, localhost
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4
home_mailbox = Maildir/
maillog_file = /var/log/mail.log
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

/etc/dovecot/dovecot.conf

!include_try /usr/share/dovecot/protocols.d/*.protocol
!include conf.d/*.conf
!include_try local.conf
log_path = /var/log/dovecot.log
auth_verbose = yes
protocols = imap lmtp

/etc/dovecot/conf.d/10-ssl.conf

ssl = required
ssl_cert = </etc/letsencrypt/live/mail.mydomain.com-0001/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.mydomain.com-0001/privkey.pem
ssl_ca = </etc/letsencrypt/live/mail.mydomain.com-0001/chain.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_dh = </usr/share/dovecot/dh.pem

/etc/dovecot/conf.d/10-auth.conf

disable_plaintext_auth = yes
auth_username_format = %n
auth_mechanisms = plain login
!include auth-system.conf.ext

/etc/dovecot/conf.d/10-master.conf

service imap-login {
inet_listener imaps {
    port = 993
    ssl = yes
}
}
service pop3-login {
inet_listener pop3s {
    port = 995
    ssl = yes
}
}
service submission-login {
inet_listener submission {
}
}
service lmtp {
unix_listener /var/spool/postfix/private/dovecot-lmtp {
    mode = 0600
    user = postfix
    group = postfix
}
}
service auth {
    unix_listener /var/spool/postfix/private/auth {
        mode = 0666
        user = postfix
        group = postfix
    }
}

Estou usando o Postfix para canalizar e-mails de três domínios diferentes para um único domínio, assim:

/etc/postfix/virtual:

@domain1.de     [email protected]
@domain2.de     [email protected]
@domain3.de     [email protected]

Enviar um e-mail para [email protected]resulta no seguinte cabeçalho:

Delivered-To: [email protected]
Return-Path: <[email protected]>
<[email protected]>
Received: from v2.domain1.de by v2.domain1.de with LMTP id pX7HGJd6ZGcVgBIAGUxxBA (envelope-from <[email protected]>) for <[email protected]>; Thu, 19 Dec 2024 19:57:11 +0000
Received: from mba.domain1.de (home.domain1.de [1.2.3.4]) by v2.domain1.de (Postfix) with ESMTP id 5CF148A278 for <[email protected]>; Thu, 19 Dec 2024 19:57:11 +0000 (UTC)
Received: by mba.domain1.de (Postfix, from userid 501) id 29B953B98524; Thu, 19 Dec 2024 20:57:11 +0100 (CET)

O endereço catchall é exposto duas vezes. Como posso evitar isso, de preferência substituindo [email protected]pelo destinatário real [email protected]?

postconf -M :

smtp       inet  n       -       y       -       -       smtpd
submission inet  n       -       y       -       -       smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth
pickup     unix  n       -       y       60      1       pickup
cleanup    unix  n       -       y       -       0       cleanup
qmgr       unix  n       -       n       300     1       qmgr
tlsmgr     unix  -       -       y       1000?   1       tlsmgr
rewrite    unix  -       -       y       -       -       trivial-rewrite
bounce     unix  -       -       y       -       0       bounce
defer      unix  -       -       y       -       0       bounce
trace      unix  -       -       y       -       0       bounce
verify     unix  -       -       y       -       1       verify
flush      unix  n       -       y       1000?   0       flush
proxymap   unix  -       -       n       -       -       proxymap
proxywrite unix  -       -       n       -       1       proxymap
smtp       unix  -       -       y       -       -       smtp
relay      unix  -       -       y       -       -       smtp -o syslog_name=postfix/$service_name
showq      unix  n       -       y       -       -       showq
error      unix  -       -       y       -       -       error
retry      unix  -       -       y       -       -       error
discard    unix  -       -       y       -       -       discard
local      unix  -       n       n       -       -       local
virtual    unix  -       n       n       -       -       virtual
lmtp       unix  -       -       y       -       -       lmtp
anvil      unix  -       -       y       -       1       anvil
scache     unix  -       -       y       -       1       scache
postlog    unix-dgram n  -       n       -       1       postlogd
maildrop   unix  -       n       n       -       -       pipe flags=DRXhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
uucp       unix  -       n       n       -       -       pipe flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail     unix  -       n       n       -       -       pipe flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp      unix  -       n       n       -       -       pipe flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n       n       -       2       pipe flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman    unix  -       n       n       -       -       pipe flags=FRX user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user}

postconf -n :

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
compatibility_level = 3.6
inet_interfaces = all
inet_protocols = all
mailbox_command =
mailbox_size_limit = 0
mailbox_transport = lmtp:unix:private/dovecot-lmtp
message_size_limit = 52428800
mydestination = domain1.de,domain2.de,domain3.de,localhost
myhostname = v2.domain1.de
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter =
relayhost =
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_loglevel = 1
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_enforce_tls = yes
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks permit_sasl_authenticated reject_invalid_helo_hostname reject_non_fqdn_helo_hostname reject_unknown_helo_hostname
smtpd_recipient_restrictions = reject_invalid_hostname reject_unauth_pipelining reject_unauth_destination permit_mynetworks, permit_sasl_authenticated, check_recipient_access hash:/etc/postfix/rcpt_blacklist
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_sender_restrictions = permit_mynetworks permit_sasl_authenticated reject_unknown_sender_domain reject_unknown_reverse_client_hostname reject_unknown_client_hostname
smtpd_tls_cert_file = /etc/letsencrypt/live/v2.domain1.de-0001/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/v2.domain1.de-0001/privkey.pem
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
smtputf8_enable = no
virtual_maps = hash:/etc/postfix/virtual

Eu hospedo meu próprio servidor de e-mail usando postfix/dovecot. Recentemente, recebi alguns e-mails de "e-mail rejeitado" agindo como se meu servidor tivesse enviado spam de uma conta que não existe no meu servidor. Procurei por /var/log/mail.logquaisquer ocorrências desse nome de conta, ou o nome do servidor receptor, etc., mas não consegui encontrar nada. Então as possibilidades que posso pensar são:

1. esses são e-mails de rejeição falsos que estão sendo enviados para mim por algum motivo
2. Não estou procurando as coisas certas nos logs, ou não estou procurando os logs certos, etc.
3. De alguma forma meu servidor está enviando e-mail sem registrá-lo

Existe alguma maneira de realmente confirmar qual desses é o caso? Não quero que meu host fique bravo comigo por retransmitir spam sem saber

Para referência, tentei comandos como:

cat mail.log |grep -v "relay=local" |grep "relay=" |grep "status=sent"
cat mail.log | grep submission
grep -o 'to=<[^@]@.[^>]' /var/log/mail.log
cat mail.log | grep <HOST URL>
cat mail.log | grep <SENDER USER NAME>

Também adicionei default_transport = error: This server sends mail only locally.ao meu postfix/main.cfarquivo, o que supostamente desabilita todos os e-mails de saída, mas ainda recebi outro e-mail do tipo 'e-mail rejeitado' retornado no dia seguinte

Ubuntu 24.04.1 LTS, "postfix start" e "postfix stop" funcionam perfeitamente.

systemctl start postfix (sem resposta)

/var/log/syslog

2024-12-13T21:49:14.744589+01:00 aaa systemd[1]: Starting [email protected] - Postfix Mail Transport Agent (instance -)...
2024-12-13T21:49:15.002726+01:00 aaa systemd[1]: [email protected]: Control process exited, code=exited, status=1/FAILURE
2024-12-13T21:49:15.003169+01:00 aaa systemd[1]: [email protected]: Failed with result 'exit-code'.
2024-12-13T21:49:15.004922+01:00 aaa systemd[1]: Failed to start [email protected] - Postfix Mail Transport Agent (instance -).

journalctl -xeu [email protected]

This looks like spam.

systemctl status postfix.service

systemctl status postfix.service
postfix.service - Postfix Mail Transport Agent
     Loaded: loaded (/usr/lib/systemd/system/postfix.service; enabled; preset: enabled)
     Active: active (exited) since Fri 2024-12-13 20:51:32 CET; 1h 1min ago
       Docs: man:postfix(1)
    Process: 960 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
   Main PID: 960 (code=exited, status=0/SUCCESS)
        CPU: 7ms

Dec 13 20:51:31 aaa systemd[1]: Starting postfix.service - Postfix Mail Transport Agent...
Dec 13 20:51:32 aaa systemd[1]: Finished postfix.service - Postfix Mail Transport Agent.

systemctl status [email protected]

[email protected] - Postfix Mail Transport Agent (instance -)
     Loaded: loaded (/usr/lib/systemd/system/[email protected]; enabled-runtime; preset: enabled)
     Active: failed (Result: exit-code) since Fri 2024-12-13 21:49:15 CET; 4min 48s ago
       Docs: man:postfix(1)
    Process: 2191 ExecStartPre=/usr/lib/postfix/configure-instance.sh - (code=exited, status=1/FAILURE)
        CPU: 246ms

Dec 13 21:49:14 aaa systemd[1]: Starting [email protected] - Postfix Mail Transport Agent (instance -)...
Dec 13 21:49:15 aaa systemd[1]: [email protected]: Control process exited, code=exited, status=1/FAILURE
Dec 13 21:49:15 aaa systemd[1]: [email protected]: Failed with result 'exit-code'.
Dec 13 21:49:15 aaa systemd[1]: Failed to start [email protected] - Postfix Mail Transport Agent (instance -).

postfix check (sem resposta) = configuração ok

Tentei tudo sem os arquivos

/var/lib/postfix/master.lock
/var/spool/postfix/pid/master.pid

Eu tentei também inet_interfaces = ipv4 e #inet_interfaces = ipv4 nada muda.

Ajuda, obrigado

Então, do nada, meu servidor começou a rejeitar todos os e-mails recebidos e eu descobri que ele estava zen.spamhaus.orgbloqueando tudo por causa de uma resposta de "volume excessivo" de spamhaus.org:

2024-11-28T11:57:46.954637-07:00 mail postfix/smtpd[338]: NOQUEUE: reject: RCPT from mail-vk1-f177.google.com[209.85.221.177]: 554 5.7.1 Service unavailable; Client host [XX.XX.XX.XX] blocked using zen.spamhaus.org; Error: excess volume; https://check.spamhaus.org/returnc/vol/XX.XX.XX.XX/; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-vk1-f177.google.com>

Eu zen.spamhaus.orgconfigurei como parte de alguns RBLs em smtpd_recipient_restrictions: reject_rbl_client zen.spamhaus.orge comentar isso "resolve" o problema, pois pelo menos os e-mails são entregues.

Então eu estava pensando se poderia haver uma maneira de olhar para o excess volumeerro, e se eu vir esse erro, então apenas passar/ignorar esse erro em vez de bloquear a entrega. Eu estava olhando os documentos do postfix, mas não consegui encontrar nada óbvio.

Parece que ele rbl_reply_mapstem acesso aos códigos de erro de retorno, mas não tenho certeza se ele tem a capacidade de substituir ou pular essa verificação rbl.

A default_rbl_replyopção de configuração serve principalmente para formatar uma mensagem de erro após o rbl rejeitá-la. Similarmente, maps_rbl_reject_codetambém parece apenas um mecanismo para traduzir para códigos de erro smtp específicos.

Estou esquecendo de algo? Parece que tem que haver uma maneira de personalizar o tratamento da resposta RBL e transformar rejeições específicas em uma "passagem" de algum tipo?

Configurei com sucesso Postfix + Dovecot + IMAP. E também instalei spamassassin, spamc, spamass-milter, e configurei imap_sieveo plugin para combater spam.

Saída de doveconf -n:

# 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.5.13 (cdd19fe3)
# OS: Linux 5.10.0-33-amd64 x86_64 Debian 11.11 
# Hostname: mail.example.com
mail_debug = yes
mail_location = maildir:~/Maildir
mail_privileged_group = mail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    auto = no
    special_use = \Drafts
  }
  mailbox Sent {
    auto = subscribe
    special_use = \Sent
  }
  mailbox Spam {
    auto = subscribe
    special_use = \Junk
  }
  mailbox Trash {
    auto = subscribe
    special_use = \Trash
  }
  prefix = 
}
passdb {
  args = %s
  driver = pam
}
plugin {
  imapsieve_mailbox1_before = file:/var/lib/dovecot/sieve.d/default.sieve
  imapsieve_mailbox1_name = INBOX
  sieve_plugins = sieve_imapsieve
}
protocols = imap sieve
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0660
    user = postfix
  }
}
service imap-login {
  inet_listener imap {
    port = 143
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}
ssl = required
ssl_cert = </etc/ssl/mail/domain.crt
ssl_key = # hidden, use -P to show it
userdb {
  driver = passwd
}
protocol imap {
  mail_max_userip_connections = 20
  mail_plugins = " imap_sieve"
}

Conteúdo de /var/lib/dovecot/sieve.d/default.sieve:

require "fileinto";

if header :contains "X-Spam-Flag" "YES" {
    fileinto "Spam";
    stop;
}

E testei minha configuração com:

# Executed from outside my network
wget https://spamassassin.apache.org/gtube/gtube.txt
swaks --to [email protected] --body gtube.txt

E funciona. O e-mail é marcado com sucesso como spam (evidente X-Spam-Flag: YESnos cabeçalhos). Mas o filtro Sieve não funciona como esperado. Ele deveria mover a mensagem para minha pasta "Spam", mas em vez disso ele copia a mensagem para a pasta "Spam", mas somente depois que eu abro a mensagem. A mensagem permanece dentro da CAIXA DE ENTRADA.

Como posso fazer para que a mensagem seja movida para a pasta "Spam" (não copiada)? E por que o filtro Sieve só funciona depois que eu abro a mensagem no meu cliente de e-mail?