آموزش کانفیگ سرور ایمیل یا Mail Server به کمک Postfix, Dovecot, MySQL

# A Record
mail.yourdomain.com.    IN  A    192.0.2.1

# MX Record
yourdomain.com.         IN  MX   10 mail.yourdomain.com.

# PTR (Reverse DNS) - از هاستینگ درخواست کنید
1.2.0.192.in-addr.arpa. IN PTR mail.yourdomain.com.

# SPF Record
yourdomain.com.         IN  TXT  "v=spf1 mx ip4:192.0.2.1 ~all"

# DMARC Record
_dmarc.yourdomain.com.  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"

# بروزرسانی سیستم
sudo apt update && sudo apt upgrade -y

# تنظیم hostname
sudo hostnamectl set-hostname mail.example.com

# ویرایش /etc/hosts
sudo nano /etc/hosts

127.0.0.1 localhost
192.0.2.1 mail.example.com mail

sudo apt install postfix postfix-mysql dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd dovecot-mysql mariadb-server opendkim opendkim-tools -y

sudo mysql -u root -p

CREATE DATABASE mailserver CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;

CREATE USER 'mailuser'@'localhost' IDENTIFIED BY 'StrongPassword123!';
GRANT ALL PRIVILEGES ON mailserver.* TO 'mailuser'@'localhost';
FLUSH PRIVILEGES;

USE mailserver;

CREATE TABLE virtual_domains (
    id INT NOT NULL AUTO_INCREMENT,
    name VARCHAR(50) NOT NULL,
    PRIMARY KEY (id),
    UNIQUE KEY (name)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

CREATE TABLE virtual_users (
    id INT NOT NULL AUTO_INCREMENT,
    domain_id INT NOT NULL,
    email VARCHAR(120) NOT NULL,
    password VARCHAR(150) NOT NULL,
    PRIMARY KEY (id),
    UNIQUE KEY (email),
    FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

CREATE TABLE virtual_aliases (
    id INT NOT NULL AUTO_INCREMENT,
    domain_id INT NOT NULL,
    source VARCHAR(120) NOT NULL,
    destination VARCHAR(120) NOT NULL,
    PRIMARY KEY (id),
    FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

INSERT INTO virtual_domains (name) VALUES ('example.com');

EXIT;

# نصب ابزار doveadm (باید Dovecot نصب باشد)
doveadm pw -s SHA512-CRYPT -p YourPassword123

{SHA512-CRYPT}$6$rounds=5000$...hashstring...

sudo mysql -u root -p mailserver

INSERT INTO virtual_users (domain_id, email, password) 
VALUES (
    1, 
    'info@example.com', 
    '{SHA512-CRYPT}$6$rounds=5000$...hashstring...'
);

SELECT * FROM virtual_users;
EXIT;

# ساخت گروه و کاربر سیستمی
sudo groupadd -g 5000 vmail
sudo useradd -g vmail -u 5000 vmail -d /var/mail -m

# ساخت دایرکتوری ایمیل‌ها
sudo mkdir -p /var/mail/vhosts/example.com

# تنظیم مالکیت
sudo chown -R vmail:vmail /var/mail

# تنظیم Permission
sudo chmod -R 770 /var/mail

sudo nano /etc/postfix/mysql-virtual-mailbox-domains.cf

user = mailuser
password = StrongPassword123!
hosts = 127.0.0.1
dbname = mailserver
query = SELECT 1 FROM virtual_domains WHERE name='%s'

sudo nano /etc/postfix/mysql-virtual-mailbox-maps.cf

user = mailuser
password = StrongPassword123!
hosts = 127.0.0.1
dbname = mailserver
query = SELECT 1 FROM virtual_users WHERE email='%s'

sudo nano /etc/postfix/mysql-virtual-alias-maps.cf

user = mailuser
password = StrongPassword123!
hosts = 127.0.0.1
dbname = mailserver
query = SELECT destination FROM virtual_aliases WHERE source='%s'

sudo chmod 640 /etc/postfix/mysql-virtual-*.cf
sudo chown root:postfix /etc/postfix/mysql-virtual-*.cf

sudo cp /etc/postfix/main.cf /etc/postfix/main.cf.backup
sudo nano /etc/postfix/main.cf

# تنظیمات اصلی
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
mydestination = localhost
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
inet_interfaces = all
inet_protocols = all

# Virtual domains
virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf

# TLS/SSL
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_use_tls = yes
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_security_level = may
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1

# SASL Authentication
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname

# Restrictions
smtpd_helo_required = yes
smtpd_recipient_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    reject_unauth_destination,
    reject_non_fqdn_recipient,
    reject_unknown_recipient_domain

smtpd_sender_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    reject_non_fqdn_sender,
    reject_unknown_sender_domain

smtpd_relay_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    defer_unauth_destination

# محدودیت‌ها
message_size_limit = 52428800
mailbox_size_limit = 0

# DKIM
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = $smtpd_milters

sudo nano /etc/postfix/master.cf

submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_tls_auth_only=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_recipient_restrictions=
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

smtps     inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_recipient_restrictions=
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

sudo nano /etc/dovecot/dovecot.conf

protocols = imap pop3 lmtp
listen = *, ::

sudo nano /etc/dovecot/conf.d/10-mail.conf

mail_location = maildir:/var/mail/vhosts/%d/%n
mail_privileged_group = mail
first_valid_uid = 5000
last_valid_uid = 5000
first_valid_gid = 5000
last_valid_gid = 5000

sudo nano /etc/dovecot/conf.d/10-auth.conf

disable_plaintext_auth = yes
auth_mechanisms = plain login

# کامنت کردن این خط:
#!include auth-system.conf.ext

# فعال کردن این خط:
!include auth-sql.conf.ext

sudo nano /etc/dovecot/conf.d/auth-sql.conf.ext

passdb {
  driver = sql
  args = /etc/dovecot/dovecot-sql.conf.ext
}

userdb {
  driver = static
  args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
}

sudo nano /etc/dovecot/dovecot-sql.conf.ext

driver = mysql
connect = host=127.0.0.1 dbname=mailserver user=mailuser password=StrongPassword123!
default_pass_scheme = SHA512-CRYPT
password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'
user_query = SELECT 5000 AS uid, 5000 AS gid, '/var/mail/vhosts/%d/%n' as home FROM virtual_users WHERE email='%u'

sudo chown root:dovecot /etc/dovecot/dovecot-sql.conf.ext
sudo chmod 640 /etc/dovecot/dovecot-sql.conf.ext

sudo nano /etc/dovecot/conf.d/10-ssl.conf

ssl = required
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.example.com/privkey.pem
ssl_prefer_server_ciphers = yes
ssl_min_protocol = TLSv1.2

sudo nano /etc/dovecot/conf.d/10-master.conf

service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    mode = 0600
    user = postfix
    group = postfix
  }
}

service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
  }
  
  unix_listener auth-userdb {
    mode = 0600
    user = vmail
    group = vmail
  }
  
  user = dovecot
}

service auth-worker {
  user = vmail
}

# نصب Certbot
sudo apt install certbot -y

# دریافت گواهینامه (توقف موقت Postfix/Dovecot)
sudo systemctl stop postfix dovecot
sudo certbot certonly --standalone -d mail.example.com

# راه‌اندازی مجدد
sudo systemctl start postfix dovecot

# تمدید خودکار
sudo crontab -e

0 3 * * * certbot renew --quiet --post-hook "systemctl reload postfix dovecot"

sudo mkdir -p /etc/opendkim/keys/example.com
cd /etc/opendkim/keys/example.com

sudo opendkim-genkey -s default -d example.com
sudo chown opendkim:opendkim default.private

sudo cat default.txt

default._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC..."

sudo nano /etc/opendkim.conf

Syslog yes
SyslogSuccess yes
LogWhy yes
UMask 002
OversignHeaders From
Canonicalization relaxed/simple
Mode sv
SubDomains no
AutoRestart yes
AutoRestartRate 10/1M
Background yes
DNSTimeout 5
SignatureAlgorithm rsa-sha256

# Domains
Domain example.com
KeyFile /etc/opendkim/keys/example.com/default.private
Selector default

# Sockets
Socket inet:8891@localhost
PidFile /run/opendkim/opendkim.pid

sudo systemctl enable opendkim
sudo systemctl restart opendkim postfix

sudo ufw allow 25/tcp    # SMTP
sudo ufw allow 587/tcp   # Submission
sudo ufw allow 465/tcp   # SMTPS
sudo ufw allow 143/tcp   # IMAP
sudo ufw allow 993/tcp   # IMAPS
sudo ufw allow 110/tcp   # POP3
sudo ufw allow 995/tcp   # POP3S

sudo ufw enable
sudo ufw status

# بررسی وضعیت
sudo systemctl status postfix

# بررسی لاگ
sudo tail -f /var/log/mail.log

# تست اتصال SMTP
telnet localhost 25

EHLO mail.example.com
QUIT

# بررسی وضعیت
sudo systemctl status dovecot

# تست IMAP
telnet localhost 143

# نصب mailutils
sudo apt install mailutils -y

# ارسال ایمیل تست
echo "This is a test email" | mail -s "Test Subject" info@example.com

mailq

sudo postsuper -d ALL

# A Record
mail.example.com.    IN  A    192.0.2.1

# MX Record
example.com.         IN  MX   10 mail.example.com.

# PTR (Reverse DNS) - درخواست از هاستینگ
1.2.0.192.in-addr.arpa. IN PTR mail.example.com.

# SPF Record
example.com.         IN  TXT  "v=spf1 mx ip4:192.0.2.1 ~all"

# DKIM Record (از فایل default.txt کپی کنید)
default._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCS..."

# DMARC Record
_dmarc.example.com.  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; ruf=mailto:dmarc@example.com; fo=1"