Remember The Chroot

Today I forgot that Postfix runs in a chroot by default on Debian. If you change files like /etc/resolv.conf or /etc/hosts, it has no effect on Postfix, unless you refresh the corresponding files in the chroot. Wasted quite a few minutes before the clue bat descended and gave me bruised ego. Stopping and starting Postfix (with postfix stop and postfix start respectively) provided the clue as the start command helpfully reminds you that the chroot is out of date.

It's good thing that this was on my own server so there was no customer watching me chase a problem caused by forgetfulness. Must be getting old. ^_^

Annoying Defaults

In the category of annoying defaults, I discovered that Postfix queries the DNS server directly and ignores /etc/hosts. Add the following to your /etc/postfix/main.cf to use the system defined look up order (in /etc/nsswitch.conf on Linux).

smtp_host_lookup = native

I discovered this because my new mail server has to relay mail to my old mail server while I migrate to the new one. The old server is on a private IP but is receiving mail for a sub-domain which resolves to a public IP. The simplest solution was to add the domain to /etc/hosts temporarily. Well, it would have been the simplest, if it had worked immediately. ^_^

DomainKeys Identified Mail

I configured my Postfix mail server to sign emails using the DomainKeys Identified Mail protocol. Postfix does not handle DKIM internally so additional software is needed. I tried dkim-milter and opendkim, which is a fork of the former. Both worked but opendkim seems to be a little more actively developed, so I choose it.

There are plenty of tutorials on the Web so set up is not very difficult. The problem was the signature would not verify. It's a good thing DKIM has a test mode!

I suspected that the signature was broken when the From: header on the outgoing email was rewritten with the my public email address. There were only two solutions: sign after rewriting or rewrite before signing. Because of where Postfix connects to the DKIM filter in the processing flow, the first solution requires a dual queue configuration which sounds complicated, although I have not investigated it.

The second solution uses a different Postfix mapping table which is much easier to configure. I moved the rewrite rules from the the generic map (examined for outgoing mail), to the canonical map (examined for incoming mail). Amazingly, it worked! Always use the simplest solution first. ^_^

(Note: Gmail and Yahoo support DKIM but Hotmail does not. Surprised? I'm not.)