Postfix TLS & DKIM

Submission vs implicit TLS, the two tls_security_level knobs that everyone gets wrong, DANE, postscreen, OpenDKIM, and the SPF/DMARC DNS records that actually survive deliverability audits.

Ports 25, 465 and 587

Both 465 and 587 live in master.cf, not main.cf. Enabling them is two uncommented stanzas and a handful of per-service overrides. Anything shared (keys, cipher lists, log levels) goes in main.cf.

smtp_tls_security_level and friends

Postfix has two independent TLS policies. They are prefixed smtp_ (outbound — Postfix is a client talking to another MTA) and smtpd_ (inbound — Postfix is the server). Read them out loud: "SMTP dee" is the daemon, the receiver.

A sane main.cf TLS baseline

# /etc/postfix/main.cf
# ---- Identity ----
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain

# ---- Keys and trust ----
smtpd_tls_cert_file = /etc/pki/tls/certs/mail.example.com.crt
smtpd_tls_key_file  = /etc/pki/tls/private/mail.example.com.key
smtpd_tls_CAfile    = /etc/pki/tls/certs/ca-bundle.crt

# ---- Inbound (port 25): advertise STARTTLS, never require ----
smtpd_tls_security_level = may
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes

# Modern ciphers only; the medium grade list Postfix ships is fine for public MX.
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_protocols           = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_mandatory_ciphers   = medium
tls_medium_cipherlist         = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256

# ---- Outbound ----
smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt

# ---- SASL on submission only (see master.cf) ----
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = no
broken_sasl_auth_clients = yes

Cross-link: see Postfix Config for the wider main.cf walkthrough, and Dovecot for the SASL socket this snippet references.

Submission (587) with STARTTLS

In master.cf, uncomment the submission block and add per-service overrides. The overrides re-scope things so that authenticated clients — not strangers on port 25 — are allowed to relay outbound:

# /etc/postfix/master.cf
submission     inet  n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_sender_restrictions=reject_sender_login_mismatch,permit_sasl_authenticated,reject
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

Key points:

• smtpd_tls_security_level=encrypt here is fine because only your own users hit 587.
• reject_sender_login_mismatch prevents a logged-in user from spoofing another user's From:.
• ORIGINATING tells milters (OpenDKIM, DMARC checkers) to treat this as your own mail — e.g. OpenDKIM will sign rather than verify.

Implicit TLS on 465

Same idea, different stanza. smtps expects TLS at the first byte, so you set smtpd_tls_wrappermode=yes:

# /etc/postfix/master.cf
smtps     inet  n       -       n       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

Open the firewall

firewall-cmd --permanent --add-service=smtp          # 25
firewall-cmd --permanent --add-service=smtps         # 465
firewall-cmd --permanent --add-service=smtp-submission   # 587
firewall-cmd --reload

See firewalld if the named services are not defined on your distro.

DANE for server-to-server

DANE uses DNSSEC-signed TLSA records to pin a certificate (or its issuing CA) for a given mail server. For outbound Postfix it turns opportunistic TLS into verifiable TLS without ever touching a public CA bundle — your peer's DNS is the source of trust.

Three preconditions: the peer's zone is signed, the peer publishes a TLSA record, and your resolver validates DNSSEC. Then:

# /etc/postfix/main.cf — outbound DANE
smtp_dns_support_level = dnssec
smtp_tls_security_level = dane
smtp_tls_loglevel = 1

Publishing your own TLSA record (for the cert on your MX):

# Generate the TLSA RR from your cert. 3 1 1 = "EE cert, SubjectPublicKeyInfo, SHA-256".
openssl x509 -in /etc/pki/tls/certs/mail.example.com.crt \
  -noout -pubkey \
  | openssl pkey -pubin -outform DER \
  | openssl dgst -sha256 -binary \
  | hexdump -ve '/1 "%02x"'
# -> 3f29577fc82... (long hex)

# Then the record:
# _25._tcp.mail.example.com. IN TLSA 3 1 1 3f29577fc82...

Rotate the cert: publish the new TLSA alongside the old one, wait for TTL, then flip.

postscreen basics

Most botnet senders fail the SMTP protocol in stereotyped ways — they pre-greet, they pipeline before they should, they ignore 4xx responses. postscreen is a lightweight triage process that parks connections for a moment, checks them against DNS blocklists, and only hands them to the real smtpd if they look like a legitimate MTA.

In master.cf:

smtp      inet  n       -       n       -       1       postscreen
smtpd     pass  -       -       n       -       -       smtpd
dnsblog   unix  -       -       n       -       0       dnsblog
tlsproxy  unix  -       -       n       -       0       tlsproxy

And the minimum useful tuning in main.cf:

# ---- postscreen ----
postscreen_access_list = permit_mynetworks,
    cidr:/etc/postfix/postscreen_access.cidr
postscreen_greet_action = enforce
postscreen_dnsbl_threshold = 3
postscreen_dnsbl_sites =
    zen.spamhaus.org*3
    bl.spamcop.net*2
    b.barracudacentral.org*1
postscreen_dnsbl_action = enforce
postscreen_blacklist_action = drop

The *N after each blocklist is the score weight — Spamhaus ZEN alone is enough to reject at threshold=3. postscreen does not sit on 587 or 465; it is strictly an MX-side tool. Subscription to some of these blocklists has rate limits for high-volume hosts; check the per-list policy.

OpenDKIM: install & wire up

DKIM signs outbound messages with a private key; receivers fetch the matching public key from your DNS and verify the signature. Done right, it makes DMARC possible. Done wrong (mismatched selectors, wrong From: alignment), it is worse than not signing because reputation systems penalize broken signatures.

Install

dnf install -y opendkim opendkim-tools    # RHEL-family
# or
apt install -y opendkim opendkim-tools    # Debian-family

mkdir -p /etc/opendkim/keys/example.com
chown -R opendkim:opendkim /etc/opendkim

Generate a key

cd /etc/opendkim/keys/example.com
opendkim-genkey -b 2048 -s mail -d example.com
# Produces:
#   mail.private  (keep; chmod 600, owner opendkim)
#   mail.txt      (publish as a TXT record at mail._domainkey.example.com)
chown opendkim:opendkim mail.private
chmod 600 mail.private

KeyTable, SigningTable, TrustedHosts

# /etc/opendkim/KeyTable
mail._domainkey.example.com example.com:mail:/etc/opendkim/keys/example.com/mail.private

# /etc/opendkim/SigningTable
*@example.com mail._domainkey.example.com

# /etc/opendkim/TrustedHosts
127.0.0.1
::1
localhost
mail.example.com
10.0.0.0/8

opendkim.conf

# /etc/opendkim.conf
Syslog                  yes
SyslogSuccess           yes
Canonicalization        relaxed/simple
Mode                    sv
SubDomains              no
AutoRestart             yes
AutoRestartRate         10/1h
Background              yes
DNSTimeout              5
SignatureAlgorithm      rsa-sha256

KeyTable                file:/etc/opendkim/KeyTable
SigningTable            refile:/etc/opendkim/SigningTable
ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts           refile:/etc/opendkim/TrustedHosts

Socket                  inet:8891@127.0.0.1
PidFile                 /run/opendkim/opendkim.pid
UserID                  opendkim
UMask                   002

Tell Postfix about the milter

# /etc/postfix/main.cf
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = $smtpd_milters

systemctl enable --now opendkim
systemctl restart postfix

If SELinux is in enforcing mode you may need setsebool -P postfix_local_write_mail_spool on; see SELinux for the general pattern.

DNS: DKIM, SPF, DMARC

All three live in your authoritative zone for example.com.

DKIM

mail._domainkey.example.com. 3600 IN TXT ( "v=DKIM1; k=rsa; s=email; "
  "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7x9p..."
  "...QIDAQAB" )

Split the p= value across quoted chunks of 255 characters — most DNS servers will refuse a single TXT string longer than that.

SPF

example.com. 3600 IN TXT "v=spf1 mx a:mail.example.com ip4:198.51.100.25 -all"

-all is a hard fail. Use ~all (soft fail) while you are still discovering unknown senders in an enterprise environment, then tighten once DMARC rua reports go quiet.

DMARC — a sensible starting policy

_dmarc.example.com. 3600 IN TXT ( "v=DMARC1; p=quarantine; adkim=s; aspf=s; "
  "rua=mailto:dmarc-reports@example.com; "
  "ruf=mailto:dmarc-forensics@example.com; "
  "fo=1; pct=100" )

Key tags:

• p=none — report only. Start here for 2-4 weeks.
• p=quarantine — unsigned/misaligned mail goes to spam. Good steady state.
• p=reject — unsigned/misaligned mail is dropped. Target state after you trust your reports.
• adkim=s, aspf=s — strict alignment: the DKIM d= and SPF envelope sender must match the From: header exactly. r (relaxed) allows subdomains.
• pct= — roll out partial enforcement: pct=25 applies the policy to 25% of unaligned mail, the rest falls back to the next-softer action.

Reading TLS logs

With smtpd_tls_loglevel = 1 you get one-line summaries. A successful inbound TLS session looks like this:

postfix/smtpd[12345]: initializing the server-side TLS engine
postfix/smtpd[12345]: connect from mx.partner.net[203.0.113.12]
postfix/smtpd[12345]: Anonymous TLS connection established from mx.partner.net[203.0.113.12]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256

Outbound (Postfix-the-client) is postfix/smtp:

postfix/smtp[7781]: Trusted TLS connection established to gmail-smtp-in.l.google.com[142.251.x.x]:25: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)

The word before "TLS connection" is the verification result:

• Anonymous — peer did not present a cert (inbound) or you did not verify (may).
• Untrusted — peer's cert did not chain to your CA bundle. may accepts this; verify rejects it.
• Trusted — chain verified.
• Verified — chain verified and hostname matches (required for verify / secure).

Troubleshooting