emailwiz for OpenBSD

This script installs an email server with all the features required in the modern web, ported to OpenBSD.

This is an OpenBSD port based on flandre5's FreeBSD adaptation of LukeSmithxyz's original emailwiz for Debian-based systems. If you're not on OpenBSD, check those out.

Warning

THIS ONLY SUPPORTS DOVECOT <=2.3, NOT THE 2.4 FILE CONFIGURATION SYNTAX. This will be patched as soon as Dovecot 2.4 lands in OpenBSD ports.

This script installs

• OpenSMTPD to send and receive mail.
• Dovecot to get mail to your email client (mutt, Thunderbird, etc.).
• Config files that link the two above securely with native bsdauth log-ins.
• rspamd to prevent spam, make custom filters, and handle DKIM signing directly — no opendkim needed on OpenBSD.
• opensmtpd-filter-rspamd to connect OpenSMTPD and rspamd.

This script does not...

• use a SQL database or anything like that. We keep it simple and use normal Unix system users for accounts and passwords.
• set up a graphical web interface for mail like Roundcube or Squirrel Mail. You are expected to use a normal mail client like Thunderbird or K-9 for Android or good old mutt with mutt-wizard. Note that there is a guide for Rainloop on LandChad.net for those that want such a web interface.
• generate certificates for your mail server. Use acme-client(1), which is built into OpenBSD base. Bring fullchain.pem and privkey.pem — the same layout certbot produces. You will be prompted for the directory.

Prerequisites for Installation

1. OpenBSD server with a static IP.
2. DNS records that point at least your domain's mail. subdomain to your server's IP (IPv4). This is required before running the script.
3. Your TLS certificate files already generated. You must have fullchain.pem and privkey.pem ready in a directory you can provide when prompted.

Mandatory Finishing Touches

Unblock your ports

While the script enables your mail ports on your server, it is common practice for all VPS providers to block mail ports on their end by default. Open a help ticket with your VPS provider asking them to open your mail ports and they will do it in short order.

You may also need to allow them in /etc/pf.conf:

pass in on egress proto tcp to port { 25 465 587 993 }

DNS records

At the end of the script, you will be given some DNS records to add to your DNS server/registrar's website. These are mostly for authenticating your emails as non-spam. The 4 records are:

1. An MX record directing to mail.yourdomain.tld.
2. A TXT record for SPF (to reduce mail spoofing).
3. A TXT record for DMARC policies.
4. A TXT record with your public DKIM key. This record is long and uniquely generated while running emailwiz-openbsd.sh and thus must be added after installation.

They will look something like this:

mail.example.org              MX   10  mail.example.org
mail._domainkey.example.org   TXT  v=DKIM1; k=rsa; p=anextremelylongsequenceofcharacters
_dmarc.example.org            TXT  v=DMARC1; p=reject; rua=mailto:postmaster@example.org; fo=1
example.org                   TXT  v=spf1 mx a:mail.example.org ip4:<yourip> -all

The script will create a file ~/dns_emailwizard that will list out the records for your convenience, and also prints them at the end of the script.

Add a rDNS/PTR record as well!

Set a reverse DNS or PTR record to avoid getting marked as spam. You can do this at your VPS provider, and should set it to mail.yourdomain.tld. Note that you should set this for both IPv4 and IPv6.

Making new users/mail accounts

Mail accounts are plain system users. To add one:

useradd -m -s /sbin/nologin username
passwd username

A user's mail will appear in ~/Mail/. If you want to see your mail while ssh'd into the server, you could install mutt, add set spoolfile="+Inbox" to your ~/.muttrc and use mutt to view and reply to mail. You'll probably want to log in remotely though.

Logging in from email clients (Thunderbird/mutt/etc)

Let's say you want to access your mail with Thunderbird or mutt or another email program. For your domain, the server information will be as follows:

• SMTP server: mail.example.org
• SMTP port: 465
• IMAP server: mail.example.org
• IMAP port: 993

Sites for Troubleshooting

Can't send or receive mail? Getting marked as spam? There are tools to double-check your DNS records and more:

• Always check /var/log/maillog first for specific errors.
• Check your DNS
• Test your TXT records via mail
• Is your IP blacklisted?
• mxtoolbox
• Solène's OpenBSD mail guide

Other versions

• flandre5/freebsd-emailwiz — FreeBSD port, direct base for this script
• LukeSmithxyz/emailwiz — the original, for Debian/Ubuntu