Take a clean Ubuntu 24.04 host to a working mail server for your domain. The stack is Postfix, Dovecot, OpenDKIM, rspamd and Fail2ban, with Let’s Encrypt certificates and the DNS records published on Cloudflare.
The problem
Self-hosted mail fails quietly: a missing DKIM key, a wrong reverse DNS or a drifted record, and messages land in spam. I wanted the whole setup to be declared once and checked by a command.
How it works
- SPF, DKIM, DMARC and MTA-STS records are generated from the same site file as the host configuration.
- plan is read-only and exits 2 on drift. apply converges the host and rolls back if any daemon rejects its configuration.
- verify checks daemons, ports, TLS, certificates, DNS, DKIM, MTA-STS and reverse DNS. dns apply creates and updates records but never deletes one.
- Each mailbox is a Unix user with a Maildir and no shell. backup pulls every Maildir, password hash and the DKIM key into an age-encrypted archive.
- The repository names no domain, address or account. Those live in an ignored site file.
Built with
- Bash
- Postfix
- Dovecot
- OpenDKIM
- rspamd
- Fail2ban
- Cloudflare DNS