How to Host Multiple Mail Domains in PostfixAdmin on Ubuntu

This tutorial will be showing you how to set up multiple mail domains (virtual hosting) on Ubuntu server with PostfixAdmin, which is an open-source web-based interface to configure and manage a Postfix based email server for many domains and users.

Prerequisites

To follow this tutorial, it’s assumed that

What You Need to Do

If you want to host multiple mail domains, then you need to

  • Add a new mail domain and user in PostfixAdmin web-based panel.
  • Create MX, A and SPF record for the new mail domain.
  • Set up DKIM signing for the new domain.
  • Create DMARC Record for the new domain.
  • Set up RoundCube Webmail, Postfix and Dovecot for multiple domains
Reverse DNS check is used to check if the sender’s IP address matches the HELO hostname. You don’t need to add another PTR record when adding a new mail domain.

Step 1: Adding Additional Domains in PostfixAdmin Panel

Log into PostfixAdmin panel with the postmaster account. (https://postfixadmin.your-domain.com/) Then go to Domain List -> New Domain to add a new domain.

postfixadmin multiple domains

Note that the new domain should have DNS A record, or PostfixAdmin would throw the following error message. You can check the DNS propagation status on dnsmap.io.

Invalid domain domain2.com, and/or not discoverable in DNS

Next, add a user under the new domain.

postfixadmin add new mailbox

Step 2: Creating MX, A and SPF record for the new mail domain

In your DNS manager, add MX record for the new domain like below.

Record Type    Name      Value

MX             @         mail.domain2.com

The A record points to your mail server’s IP address.

Record Type    Name     Value

A              mail     IP-address-of-mail-server

If your server uses IPv6 address, be sure to add AAAA record.

Then create SPF record to allow the MX host to send email for the new mail domain.

Record Type    Name      Value

TXT            @         v=spf1 mx ~all

Step 3: Setting up DKIM signing for the new domain

We have installed and configured OpenDKIM for a single domain in part 4 of this tutorial series. Now we need to tell OpenDKIM to sign every outgoing email for the new mail domain.

Edit the OpenDKIM signing table file.

sudo nano /etc/opendkim/signing.table

Add the second domain like below.

*@domain1.com       default._domainkey.domain1.com
*@domain2.com       default._domainkey.domain2.com

Edit the key table file.

sudo nano /etc/opendkim/key.table

Add the second domain like below.

default._domainkey.domain1.com     domain1.com:default:/etc/opendkim/keys/domain1.com/default.private
default._domainkey.domain2.com     domain2.com:default:/etc/opendkim/keys/domain2.com/default.private

Edit the trusted hosts file.

sudo nano /etc/opendkim/trusted.hosts

Add the second domain like below.

127.0.0.1
localhost

*.domain1.com
*.domain2.com

Next, we need to generate a priavte/public keypair for the second domain. Create a separate folder for the second domain.

sudo mkdir /etc/opendkim/keys/domain2.com

Generate keys using opendkim-genkey tool.

sudo opendkim-genkey -b 2048 -d domain2.com -D /etc/opendkim/keys/domain2.com -s default -v

The above command will create 2048 bits keys. -d (domain) specifies the domain. -D (directory) specifies the directory where the keys will be stored and we use default as the selector (-s). Once the command is executed, the private key will be written to default.private file and the public key will be written to default.txt file.

Make opendkim as the owner of the private key.

sudo chown opendkim:opendkim /etc/opendkim/keys/domain2.com/default.private

Display the public key

sudo cat /etc/opendkim/keys/domain2.com/default.txt

The string after the p parameter is the public key.

add a new domain in opendkim

In your DNS manager, create a TXT record for the second domain. Enter default._domainkey in the Name field. Copy everything in the parentheses and paste into the value field. Delete all double-quotes. (You can paste it into a text editor first, delete all double quotes, then copy it to your DNS manager. Your DNS manager may require you to delete other invalid characters, such as carriage return.)

create dkim record

After saving your changes. Check the TXT record with this command.

dig TXT default._domainkey.domain2.com

Now you can run the following command to test if your DKIM DNS record is correct.

sudo opendkim-testkey -d domain2.com -s default -vvv

If everything is OK, you will see

opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: checking key 'default._domainkey.domain2.com'
opendkim-testkey: key secure
opendkim-testkey: key OK

If you see “Key not secure”, don’t panic. This is because DNSSEC isn’t enabled on your domain name. DNSSEC is a security standard for secure DNS query. Most domain names haven’t enabled DNSSEC. You can continue to follow this guide.

Restart OpenDKIM so it will start signing emails for the second domain.

sudo systemctl restart opendkim

Step 4: Creating DMARC Record For the New Domain

To create a DMARC record, go to your DNS manager and add a TXT record. In the name field, enter _dmarc. In the value field, enter the following. Note that you need to create the dmarc-reports@domain2.com email address.

v=DMARC1; p=none; pct=100; rua=mailto:dmarc-reports@domain2.com

create dmarc record txt

The above DMARC record is a safe starting point. To see the full explanation of DMARC, please check the following article.

Step 5: Setting up RoundCube, Postfix and Dovecot for Multiple Domains

I assume you installed Roundcube webmail for the first mail domain.

It makes sense to let users of the first domain use mail.domain1.com and users of the second domain use mail.domain2.com when accessing RoundCube webmail. I will show you how to do it with Apache and Nginx.

Apache

If Roundcube is served by Apache web server, then create a virtual host for the second domain.

sudo nano /etc/apache2/sites-available/mail.domain2.com.conf

Put the following text into the file.

<VirtualHost *:80>
  ServerName mail.domain2.com
  DocumentRoot /var/www/roundcube/

  ErrorLog ${APACHE_LOG_DIR}/mail.domain2.com_error.log
  CustomLog ${APACHE_LOG_DIR}/mail.domain2.com_access.log combined

  <Directory />
    Options FollowSymLinks
    AllowOverride All
  </Directory>

  <Directory /var/www/roundcube/>
    Options FollowSymLinks MultiViews
    AllowOverride All
    Order allow,deny
    allow from all
  </Directory>

</VirtualHost>

Save and close the file. Then enable this virtual host with:

sudo a2ensite mail.domain2.com.conf

Reload Apache for the changes to take effect.

sudo systemctl reload apache2

Nginx

If Roundcube is served by Nginx web server, then create a virtual host for the second domain.

sudo nano /etc/nginx/conf.d/mail.domain2.com.conf

Put the following text into the file.

server {
  listen 80;
  server_name mail.domain2.com;
  root /var/www/roundcube/;
  index index.php index.html index.htm;

  error_log /var/log/nginx/mail.domain2.com.error;
  access_log /var/log/nginx/mail.domain2.com.access;

  location / {
    try_files $uri $uri/ /index.php;
  }

  location ~ \.php$ {
   try_files $uri =404;
    fastcgi_pass unix:/run/php/php7.2-fpm.sock;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
  }

  location ~ /.well-known/acme-challenge {
    allow all;
  }
 location ~ ^/(README|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
    deny all;
  }
  location ~ ^/(bin|SQL)/ {
    deny all;
  }
 # A long browser cache lifetime can speed up repeat visits to your page
  location ~* \.(jpg|jpeg|gif|png|webp|svg|woff|woff2|ttf|css|js|ico|xml)$ {
       access_log        off;
       log_not_found     off;
       expires           360d;
  }
}

Note: If you use Ubuntu 20.04, you should replace php7.2-fpm with php7.4-fpm in the above code.

Save and close the file. Then test Nginx configurations.

sudo nginx -t

If the test is successful, reload Nginx for the changes to take effect.

sudo systemctl reload nginx

Obtaining TLS Certificate

Now use Certbot to obtain TLS certificate for all your mail domains, so you will have a single TLS certificate with multiple domain names on it.

Apache

sudo certbot --apache --agree-tos --redirect --hsts --staple-ocsp -d mail.domain1.com,mail.domain2.com --cert-name mail.domain1.com --email you@example.com

Nginx

sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp -d mail.domain1.com,mail.domain2.com --cert-name mail.domain1.com --email you@example.com

Notice that in the above command, we specified the cert name using the first mail domain, which will be used in the file path, so you don’t have to change the file path in Postfix or Dovecot configuration file.

When it asks if you want to update the existing certificate to include the new domain, answer U and hit Enter.

certbot multi-domain iredmail

Now you should see the following message, which indicates the multi-domain certificate is successfully obtained.

iredmail nginx multiple domain

Reload Apache or Nginx to pick up the new certificate.

sudo systemctl reload apache2
sudo systemctl reload nginx

You should now be able to use different domains to access RoundCube webmail. Also you need to reload Postfix SMTP server and Dovecot IMAP server in order to let them pick up the new certificate. That’s all you need to do for Postfix and Dovecot to serve multiple domains.

sudo systemctl reload postfix dovecot

Using Mail Client on Your Computer or Mobile Device

Fire up your desktop email client such as Mozilla Thunderbird and add a mail account of the second domain.

  • In the incoming server section, select IMAP protocol, enter mail.domain2.com as the server name, choose port 143 and STARTTLS. Choose normal password as the authentication method.
  • In the outgoing section, select SMTP protocol, enter mail.domain2.com as the server name, choose port 587 and STARTTLS. Choose normal password as the authentication method.

postfixadmin-multiple-domain-postfix-dovecot

Hint: You can also use port 993 with SSL/TLS encryption for IMAP, and use port 465 with SSL/TLS encryption for SMTP. You should not use port 25 as the SMTP port to submit outgoing emails.

Although Postfix SMTP server and Dovecot IMAP server are using the hostname of the first mail domain (mail.domain1.com) when communicating with others, they are now using a multi-domain certificate, so the mail client won’t display certificate warnings.

SPF and DKIM Check

Now you can use your desktop email client or webmail client to send a test email to check-auth@verifier.port25.com and get a free email authentication report. Here’s the report I got from port25.com

postfix spf dkim ubuntu

Don’t forget to test your email score at https://www.mail-tester.com and also test email placement with GlockApps.

If DKIM check fails, you can go to https://www.dmarcanalyzer.com/dkim/dkim-check/ to see if there are any errors with your DKIM record.

dmarc analyzer dkim record checker

What if Your Emails Are Still Being Marked as Spam?

I have more tips for you in this article: How to stop your emails being marked as spam. Although it requires some time and effort, your emails will eventually be placed in the inbox after applying these tips.

Wrapping Up

That’s it! I hope this tutorial helped you host multiple email domains with PostfixAdmin. As always, if you found this post useful, then subscribe to our free newsletter to get more tips and tricks. Take care 🙂

Rate this tutorial
[Total: 2 Average: 5]

54 Responses to “How to Host Multiple Mail Domains in PostfixAdmin on Ubuntu

  • Firstly, Thanks for the whole series, I really loved it and helped me a lot.

    If you can help, In Step 5 I cannot see the steps or configuration for Postfix and Dovecot for Multiple Domains.

    It will be really helpful if you can update it.

    Thank you!

    • You just need to reload Postfix and Dovecot to pick up the new certificate which has multiple domains on it. That’s all you need to do for Postfix and Dovecot, when you are using virtual mailbox domains.

      • Okay. Thank you very much!

        I’ll give it a try.

        Is there any changes I have to make in Postfix main.cf related myhostname or mymailname ? As I have two different @domain so while sending the emails form which domain it will go ? I might getting confused! 🙂

    • myhostname is only used when Postfix identifies itself to other SMTP servers. It won’t affect your sending domain. mymailname is used for emails without the sending domain specified. That usually happens on the command line.

      If you follow my tutorials, you don’t have to change any of that.

      • Got it! Thanks.

        One last question, I have followed your TLS for postfix using Let’s Encrypt but when I send email to gmail it is showing red lock and not encrypted. I have researched a lot. Mostly, this should resolve my problem smtpd_use_tls=yes but though not working.

        Any Idea!

    • smtpd_use_tls=yes is for the SMTP daemon when receiving emails from other SMTP server.

      To enable TLS when sending emails to other SMTP server, add the following two lines.

      smtp_tls_security_level = may
      smtp_tls_loglevel = 1

      Then restart Postfix.

      PS: This has already been mentioned in part 2 of this tutorial series.

  • This website is the best one that I’ve searched for long time. Help me so much. Really Thanks for the author to share suche detailed knowledge on internet.

  • Hey. First of all, you made a great tutorial for setting up a mail server and it all works fine as long as I have all the domains on the same server where this is set up. I’ve tried setting this part of the tutorial for a domain that is on a different server than where my postfix admin is set. Since I’m new to this and I assume that I made an error in my thinking process I have a question.

    My question is, can this work like this if domains are on different server than where postfix admin is, and if not, what would I actually need to do to make it work?

    • If you have PostfixAdmin on one server, and a domain name is using another mail server to send and receive emails, you can follow this tutorial to add that domain to your PostfixAdmin server, then move your existing email files to the PostfixAdmin server.

      • So I still need to do part 1 of this entire tutorial series on every server where my domains are to just setup Postfix and then I can follow up this part of the series?

        Or do I need to do everything besides setting up new PostfixAdmin on each of the servers?

    • Suppose you have server A, on which you have installed Postfix, Dovecot, PostfixAdmin and OpenDKIM by following part 1 to part 4, so your server A has one mail domain.

      If you need to host a second domain name on server A, then follow this tutorial. You don’t need to do any thing on other servers.

      • That part I know and I’m sorry if I haven’t been very clear up to now, but what you’re explaining to me here revolves only around 1 server and domains on that server, so I’ll try to be as specific as I can be.

        I have Postfix, Dovecot, PostfixAdmin and OpenDKIM all set up on server A which has my main domain and that works great.

        But I also have servers B and C in different areas of the world and I would like, for the domains that are on them ( servers B and C ), to use server A for sending and receiving mail.

        I have tried setting up this part of the tutorial on server A ( considering all the linux part) and server B ( all the MX, TXT, A and AAAA records ), hoping that it’ll be simple as that, but it didn’t work. So that’s where I’m stuck at this point.

    • If you want server B and C to use server A for sending and receiving mail, that’s not hosting multiple domains on one mail server. And it will require some advanced skills. Basically, you need to set up SMTP and IMAP proxy like in this article: https://www.linuxbabe.com/mail-server/smtp-imap-proxy-with-haproxy-debian-ubuntu-centos, although it’s not 100% in line with your situation.

      • Ah, I see. Well, I did mention that I’m new to this 🙂

        But ok, thanks for the information and the link. I’ve checked it out and I think I understand the process and in worst case scenario, at least I know what to look for and how to explain my problem and that makes a world of difference 🙂

  • Can I add 2 more domains using this guide ?

  • Marshall Latham
    6 months ago

    I am getting the following message from PostfixAdmin: Invalid domain thechristophercompany.com, and/or not discoverable in DNS. I don’t understand what I am doing wrong. I have this domain hosted on a VPS from HostWinds using Nginx. With just a few snags I was able to get the jmlatham.com up and running from your tutorials (actually using the email address I configured using your tutorials), but now that I am trying to get a second domain in the system, the control panel is preventing me. I have configured the following:

    Type	Name	Value
    A	mail	
    A	thechristophercompany.com	
    AAAA	thechristophercompany.com	
    MX	thechristophercompany.com	0 mail.thechristophercompany.com.
    A	www	
    

    I have the actual ip4 and ip6 address in the system without the . You can navigate to the under construction web page by going to thechristophercompany.com address. Any idea what I might be missing?

    • Marshall
      6 months ago

      I wasn’t thinking about the information inside of angle braces being removed. The values for the DNS records are the appropriate ip4 and ip6 addresses. These ip addresses are the same as the jmlatham.com ip addresses because they are on the same server.

    • I’m also confused. I can visit thechristophercompany.com in my web browser. However, If I use dig to find the A or AAAA record, it seems there’s no such record for your domain.

      dig A thechristophercompany.com +short

      Doing a DNS propagation check on dnsmap.io also indicates there’s no A or AAAA record for this domain.

    • I can find the A record for www.thechristophercompany.com and mail.thechristophercompany.com.

      The A record and MX record for thechristophercompany.com can’t be found.

      • Marshall
        6 months ago

        Thank you. I will check that out again and see if I can add some records that might make a difference. I appreciate you looking into this for me. Your tutorials have been a great help to me.

        • Marshall
          6 months ago

          The problem was fixed by a support agent re-entering the DNS records. Thanks again for looking into the problem for me.

  • Hello Xiao
    when using multiple domain we have to have the second domain hosted on the same company? I mean mail.domain.com can be on, let’s say’ DigitalOcean and domain.com on Vultr?

    Thank You!

    • Your mail server (mail.domain.com) and your main website (domain.com) can run on different boxes. As a matter of fact, I don’t recommend running mail server and the main website on the same box, because if the main website is behind a CDN (content delivery network), the mail server will leak the website’s real IP address, and the mail server will slow down your website’s page loading speed.

  • Zeeshan Mustafa
    4 months ago

    one issue

    1- modoboa always uses first domain hostname

  • Zeeshan Mustafa
    4 months ago

    i have already follow this but issue is that

    example2.com is using example1.com hostname

    what abouot revrse dns

    • There is nothing wrong with that.

      Actually, you should use only one HELO/EHLO hostname in Postfix, and the PTR record should be associated with only one hostname.

  • i have done this but gmail is sending my email to spam
    if u say i can give you control or SSH

  • Hristo Karadzhov
    4 months ago

    Hello Xiao,
    Thank you for the easy to follow and well explained tutorial.
    Fantastic work! It helped me learn a lot.

    With regards to the hosting of multiple domains, is there method of hosting them on a different IPs so the rDNS-es resolve correctly on each domain.
    And also would it be necessary to point different SSL certificate at each domain, so the mail clients don’t scream every time we try to connect.

    Example:
    hostname = mail.example.com

    Domain IP MX SSL
    example.com 10.10.10.10 mail.example.com /etc/letsencrypt/live/example.com …
    example2.com 20.20.20.20 mail.example2.com /etc/letsencrypt/live/example2.com …
    example3.com 30.30.30.30 mail.example3.com /etc/letsencrypt/live/example3.com …

    Something like that may be if exists…

    Many thanks

    • rDNS is designed to associate one IP address to one hostname. The receiving SMTP server doesn’t care what From: domain is in your email, as long as your IP address has an rDNS record and that hostname can resolve back to the same IP address.

      The certificate in this tutorial is a multi-domain certificate, so mail clients won’t throw security warnings.

  • Cristian
    3 months ago

    Hello Xiao,

    First of all, thank you for your valuable articles, you make our live easier.
    I have successfully configured the email server on one box.
    On a different box I have a website which needs to send reset password emails to the users. Normally I use smtp configuration on the website, I indicate a dedicated email address with password. Well, my email server does not send the emails, most probably because they’re originated from another IP address than the email server’s.
    What would you recommend to make that work?

    Thank you,
    Cristian

    • Cristian
      3 months ago

      Please ignore my message. I discovered it was working, yet I had not configured correctly the smtp port. Thank you anyway.

  • Frederic
    3 months ago

    Hello Xiao, I’m getting an error after trying to update the certificate

    sudo certbot --apache --agree-tos --redirect --hsts --staple-ocsp -d mail.conseilscosmetiques.fr,vps.mapom.fr --cert-name vps.mapom.fr --email frederic@mapom.fr

    returns

    We were unable to find a vhost with a ServerName or Address of mail.conseilscosmetiques.fr.
    Which virtual host would you like to choose?

    it displays several apache conf file, I’ve selected the #5 but it failed (see the attached screenshot)

    Enhancement Strict-Transport-Security was already set.
    Enhancement Strict-Transport-Security was already set.
    Failed redirect for mail.conseilscosmetiques.fr
    Unable to set enhancement redirect for mail.conseilscosmetiques.fr
    Unable to find corresponding HTTP vhost; Unable to create one as intended addresses conflict; Current configuration does not support automated redirection

    I’ve 2 domains (mapom.fr and conseilscosmetiques.fr) both have been configured for running Apache and I’ve followed your Apache tutorial (part 1 & 2 about TLS)…no issue
    The initial mail server is called vps.mapom.fr (works fine here also) and the one I was trying to configure is named mail.conseilscosmetiques.fr

    Any idea what I might be missing ?

    Thank you

    • Frederic
      3 months ago

      Nevermin, you can ignore my message, I just missed the part 5 where I needed to configure the vhost for the secodn mail server !

      My bad !!

      Thanks anyway for your GREAT tutorial !

  • Hi, thanks for another great tutorial. I have a question about Let’s Encrypt and server configuration. Is it possible, with this configuration with PostfixAdmin, to assign a different certificate to each domain ?

  • Hi Xiao, I have been folowing your guides, first setting up a single domain mail server and all is fine and it works, however, after this guide, I get a “An error occurred while sending mail. The mail server responded: 451 4.7.1 Service unavailable – try again later.” from thunderbird. I can recieve mail all fine but not send and I am at a loss to what to do.

    • Always check the mail log file (/var/log/mail.log) on the server.

      • Thanks for the replay Xiao Guoan,
        Yes indeed, so as I said, the first domain works.
        Servers name is mail.domain1.com
        David@domain1.com sends and receives mails via laptop client
        David@domain2.com receives fine but can’t send.

        # mail.log says:

        mail dovecot: imap-login: Login: user=, method=PLAIN, rip=xx.xx.xx.xx, lip=xx.xx.xx.xx, mpid=xxxxx, TLS, session=
        mail dovecot: imap(david@domain2.com): Logged out in=36 out=521 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
        mail postfix/smtpd[xxxxx]: connect from laptops.domain.com[xx.xx.xx.xx]
        mail postfix/smtpd[xxxxx]: Anonymous TLS connection established from laptops.domain.com[xx.xx.xx.xx]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
        mail postfix/smtpd[xxxxx]: NOQUEUE: reject: RCPT from laptops.domain.com[xx.xx.xx.xx]: 454 4.7.1 : Relay access denied; from= to= proto=ESMTP helo=
        mail postfix/smtpd[xxxxx]: disconnect from laptops.domain.com[xx.xx.xx.xx] ehlo=2 starttls=1 mail=1 rcpt=0/1 quit=1 commands=5/6
        

        I have been googling the NOQUEUE: reject & Relay access denied errors and I find a log of tips that what I can see is already in your great guides.

      • Hi Xiao Guoan,

        So I found a spelling error in my OpenDKIM signing table, for some reason this caused domain2.com to get that NOQUEUE: reject error.
        So for the sake of experiments, I tried to send a mail from domain2.com using domain1.com as smtp server and then I got a different error in mail.log saying that “defauld._domankey” did not exist, that’s when it hit me and I went looking and found my spelling error and now it all works.
        Weird that I did not get any error message about this in the first case, just a reject.
        If anyone else gets this error, here is a solution.

    • Apart from the spelling error, it seems you are using port 25 as the SMTP port in Thunderbird. The best practice is to use port 587 or 465.

  • Matoskah
    4 weeks ago

    Hi Xiao et thanks for your great tutorial.

    I followed all of your 4 parts and today I have a great mail server.
    I block on the other hand on a part. For the moment, I want the server to send my messages outside the domain it owns to reach the DNS zone of the domain name.

    Basically I don’t want it to check and go through the local transport for a particular domain, no matter how much I modify the “myhostname = ”
    it doesn’t change anything, it always tries to check the database to see if the user exists, how can I do this?

    Example, I have the name xyz.com I send an email to mto@xyz.com, it will tell me that the user does not exist in the virtual_mail table, I want the server to send its mail to mail. xyz.com, basically, this server is only used to send mails not to receive them.

    RCPT : Recipient address rejected: User unknown in virtual mailbox table

    And with Orange.fr, i have another problem :

    SSL_connect error to smtp-in.orange.fr[80.12.242.9]:25: -1
    sendmail postfix/smtp[94379]: warning: TLS library problem: error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol:../ssl/statem/statem_lib.c:1941:

    Because they seem to be using tls 1.0…

    How can I go about it please

    Thank you in advance !

    • Matoskah
      4 weeks ago

      While waiting for a more professional answer, I modified the SQL request so that:
      query = SELECT domain FROM domain WHERE domain = ‘% s’ AND active = ‘1’ AND domain NOT LIKE ‘xyz.com’;

      now the mails go out out but I have an error from my main mail server:
      said: 450 4.1.8 : Sender address rejected: Domain not found (in reply to RCPT TO command)

      • Matoskah
        4 weeks ago

        Hi,

        I had to lower the security to TLS v1 for Orange.fr.
        However, I still need help on one last topic:

         pam_authenticate() failed: Authentication failure (Password mismatch?)

        Any idea ? 🙂

    • You sent an email from xyz.com to mto@xyz.com, i.e, to your own domain. Since you have installed PostfixAdmin and enabled virtual mailbox, Postfix will surely check the database to see if mto@xyz.com exists on your mail server.

  • George P
    3 days ago

    Hi Xiao,

    Great article.
    I have a bit of an issue and not sure if you answered this in another reply, if so please point me to it.

    I have two domains. and everything is working, both can receive and send email, at this stage just using the one to login.

    In the second domains emails, when I view the source from that domain there is this error:

    Return-Path: 
    Received: from mail.xx.info (mail.xx.info. [27.xx.xx.xx])
            by mx.google.com with ESMTPS id y12si7290570pfm.287.2020.11.21.22.13.15
            for 
            (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
            Sat, 21 Nov 2020 22:13:16 -0800 (PST)
     Received-SPF: pass (google.com: domain of insfw@xxx.net designates 27.xx.xx.xx as permitted sender) client-ip=27.xx.xx.xx;
    Authentication-Results: mx.google.com;
           dkim=temperror (no key for signature) header.i=@xxxx.net header.s=dkim header.b=Cbi9sl4b;
           spf=pass (google.com: domain of insfw@xxx.net designates 27.xx.xx.xx as permitted sender) smtp.mailfrom=insfw@xxx.net;
           dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=xx.net
    Received: from mail.xx.info  (ip6-localhost [127.0.0.1]) by mail.xx.info (Postfix) with ESMTP id 4Cf0MW3qNszKnR1 for ; Sun, 22 Nov 2020 17:13:11 +1100 (AEDT)
    Authentication-Results: mail.xx.info; dkim=fail reason="key not found in DNS" header.d=xx.net header.i=@xx.net header.a=rsa-sha256 header.s=dkim header.b=Cbi9sl4b; dkim-atps=neutral
    

    postfix sections

    Most Useful General options
    What domain to use in outbound mail:	Use hostname    Use domainname   
       mail.xx.info 
    ----------------------------
    
    # hostname
    myhostname = mail.xx.info
    myorigin = mail.xx.info
    mydomain = xx.info
    
    
    # Accepted local emails
    mydestination = $myhostname, localhost, localhost.localdomain, mail.xx.info,  localhost.$mydomain, $mydomain, xx.net
    
    
    

    The issue is that all email from xx.net seem to be coming from mail.xx.info (which is the primary domain) and configured in postfix.

    how can this be resolve so the “mail.xx.info” is replaced with mail.xx.net or xx.net.

    This seem to be causing the dkim to fail

    • DKIM check has nothing to do with the Postfix hostname. The error displayed in the Gmail headers is self-explanatory: “key not found in DNS”. Gmail can’t find the DKIM record for the second domain. Perhaps the DKIM record isn’t propagated to the Internet yet. You can go to https://www.dmarcanalyzer.com/dkim/dkim-check/ to check if there are any errors with your DKIM record.

  • George P
    3 days ago

    Hi Xiao,

    Thanks for the quick response.

    I thought it did have something to do with it because the “Received: from mail.xx.info”, this is seems to be coming from host mail.xx.info and not the “mail.xx.net” domains. I will try again a little later.

    So is there a way to fix the “Received: from mail.xx.info” part of the header?

    • If the Postfix hostname can cause DKIM failure, who will use a hosted email service from G Suite or Microsoft Exchange Online to send emails?

      Emails sent from G Suite users all use google.com in the hostname and emails sent from Microsoft Exchange Online users all use outlook.com in the hostname.

      If the hostname can cause DKIM failure, who will use their services?

      The best way to use the same hostname for the same From: domain is to run a dedicate email server just for one domain, when you need a second domain, spin up another email server.

  • George P
    3 days ago

    Hi Xiao,

    Thanks, that make sense, just not thinking straight at the moments.

    But I might have narrowed down the issue, and it ha to do with the opendkim.

    It seem that when I add the second domain to the signing.table file I cannot send email from the second domain.

       *@xx.info    default._domainkey.xx.info
       *@xx.netdefault._domainkey.xx.net
    

    Error I et for the second domain is : “cannot send message: (smtp) failure when sending data”

    I have tested with both domains and followed the same instructions

    • You use default as the DKIM selector in OpenDKIM, but Gmail headers indicate you used dkim as the selector.

      Authentication-Results: mail.xx.info; dkim=fail reason="key not found in DNS" header.d=xx.net header.i=@xx.net header.a=rsa-sha256 header.s=dkim header.b=Cbi9sl4b; dkim-atps=neutral
      
  • George P
    3 days ago

    Hi Xiao,

    Thanks for the reply.

    I have found that as well but just does not make sense.
    My mail server is based on the iredmail, hence using opendkim with amavis.

    Something strange is going on, rebooted system and now things seem to be passing.
    This could alos be the result of a DNS propagation delays.

    Thanks again for your help.

    FYI, keys in DNS server are ( both domains the same format ) are like this.

     default._domainkey.xx.net
    v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtal4WvZDjdrN3ahdJ2S4AKXu6pzNusGek5rBjaAwmVqYXhp34YAprSzrpRFIbWAxUx8e6PZuJSizAdFBSfGqWD3+jQZ/t5T5zyMg+gyg5b1Kxlny2hqRdGsfd3BvJAeE4xVPySs1MRDIRQ3RCJzsbE/MCc5yj/Tu0ulo0b6Ut2kB19+asA/hZe9Y0naRnooc2lltqlSrGlyFz0N1kgvuQjiMzINYQZUvml4YlfNDVNsJAjZIfXax0gRUcFnByvTJBktGUFiEG06H7mDfljHsban/7JyWB5qA8ubwyS1w10sZQvcOjMKfaaCGUzEUcGHFIkFMtcGZ4PKHekpoRkbFrQIDAQXX
    
     dkim._domainkey.xx.net
    v=DKIM1; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtRn0BDuragKhZBxBd7CNqC5gc3bOBBrktcEALvKmE1SlSQhko3M/g3hQTnr3g/5Y6pdiZGZkeSLBg3jHmGG7UeqG4+wR2PMGj86EWvdmmzOzoEc1tl0XpwMREajLkXUkbmiyS7GchqEpLzHZWzqGBlVpKUyw1KDtAl8zK23jCajKs5aibIBeMfiKtl4xy6q5KDuCBoHOnXLNqw/T26cGZcNfCqUiNGlLVNnTPh8OgcrgvXGkfECNPHDfayy917OMjuCqGxmB1sVWjvL9ARqh+6La1WXhF3KabGCyHYVUyOqgzAJ72CEoEU/FrpfA3j6CwcPHG/vp6M8kXO5ixTNwawIDAQXX
    

Leave a Comment

  • Comments with links are moderated by admin before published.
  • Your email address will not be published.
  • Use <pre> ... </pre> HTML tag to quote the output from your terminal/console.
  • Please use the community (https://community.linuxbabe.com) for questions unrelated to this article.
  • I don't have time to answer every question. Making a donation would incentivize me to spend more time answering questions.


The maximum upload file size: 2 MB.
You can upload: image.