Mail — Server Stacks | AKADATA LIMITED

Mail

Postfix, Dovecot, and rspamd — a complete mail stack

Every Saphira machine has a mail server installed. Postfix handles SMTP (sending and receiving mail). Dovecot handles IMAP and POP3 (storing and retrieving mail). rspamd handles anti‑spam (filtering unwanted mail before it reaches the user's inbox). They are three independent daemons chained together by the protocol, not by a monolithic supervisor. Turn them on when you are ready.

Generate unique secrets. Placeholder credentials such as <alice-password> and <rspamd-encrypted-password> appear in code blocks below. Replace every placeholder with a value you generate yourself. Use openssl rand -base64 32 for strong random passwords. Even a placeholder in documentation must never become a real credential.

Postfix — SMTP

Mail Transfer Agent

Start the service

rc-service postfix start
rc-update add postfix

Main configuration — /etc/postfix/main.cf

The essential parameters every mail server needs:

# /etc/postfix/main.cf
myhostname = mail.akadata.ltd
mydomain = akadata.ltd
myorigin = $mydomain

# Interfaces to listen on — localhost only, or all
inet_interfaces = all
inet_protocols = ipv4

# Networks to relay for — localhost and your private subnet
mynetworks = 127.0.0.0/8, 10.0.0.0/24

# Mailbox format — Maildir is the modern standard
home_mailbox = Maildir/

# Recipient delimiter for address extensions (user+tag@domain)
recipient_delimiter = +

Submission service — port 587 with TLS

Uncomment and configure the submission entry in /etc/postfix/master.cf:

# /etc/postfix/master.cf
submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject

TLS certificates

# Point Postfix at your certificate and key
# /etc/postfix/main.cf
smtpd_tls_cert_file = /etc/ssl/akadata/mail.akadata.ltd.pem
smtpd_tls_key_file  = /etc/ssl/akadata/mail.akadata.ltd.key
smtpd_use_tls = yes
smtpd_tls_security_level = may

Generate certificates with Certbot (see the Web Server guide) or use a self‑signed certificate for testing.

Test the SMTP server

# Send a test email from the command line
echo "This is a test email from Akadata Linux." | \
    mail -s "SMTP test" user@example.com

# Check the mail queue
mailq

# Follow the log
rc-service syslog-ng status
tail -f /var/log/mail.log

DNS requirements for receiving mail

MX record: akadata.ltd. IN MX 10 mail.akadata.ltd. tells the world where to deliver mail for your domain.
SPF record: akadata.ltd. IN TXT "v=spf1 mx -all" authorises your mail server to send for this domain.
DKIM: generate a key pair with opendkim-genkey, publish the public key in DNS, configure Postfix to sign outgoing mail.
DMARC: _dmarc.akadata.ltd. IN TXT "v=DMARC1; p=quarantine; rua=mailto:postmaster@akadata.ltd" tells receivers what to do with mail that fails SPF or DKIM.

Man pages: man postfix, man postconf, man master. Full reference: postfix.org.

Dovecot — IMAP and POP3

Mail Delivery Agent

Start the service

rc-service dovecot start
rc-update add dovecot

Configuration — /etc/dovecot/dovecot.conf

# /etc/dovecot/dovecot.conf
protocols = imap
listen = *

# Mail location — Maildir in the user's home directory
mail_location = maildir:~/Maildir

# SSL — point at your certificate and key
ssl = yes
ssl_cert = </etc/ssl/akadata/mail.akadata.ltd.pem
ssl_key  = </etc/ssl/akadata/mail.akadata.ltd.key
ssl_min_protocol = TLSv1.2

# Disable plaintext authentication without SSL
disable_plaintext_auth = yes

Authentication

Dovecot authenticates against system users by default. Each mail user must be a local Unix account with a home directory:

# Create a mail user
useradd -m -s /sbin/nologin alice
passwd alice

# Dovecot will create the Maildir automatically on first login

Test IMAP access

# Telnet to the IMAP port to verify it responds
telnet localhost 143

a1 LOGIN alice <alice-password>
a2 LIST "" "*"
a3 SELECT INBOX
a4 LOGOUT

Man pages: man dovecot, man doveconf. Full reference: doc.dovecot.org.

rspamd — anti‑spam

Content filtering

rspamd is a fast, event‑driven spam‑filtering system. It sits between Postfix and Dovecot, inspecting every incoming message and scoring it for spam probability. Configured correctly, it catches most junk before the user ever sees it.

Start the service

rc-service rspamd start
rc-update add rspamd

Postfix integration — milter

Add to /etc/postfix/main.cf:

# rspamd milter integration
milter_protocol = 6
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_type}
milter_default_action = tempfail
smtpd_milters = inet:localhost:11332
non_smtpd_milters = inet:localhost:11332

rspamd web interface

# Set a password for the web UI
rspamadm pw --encrypt | tee /etc/rspamd/local.d/worker-controller.inc

# /etc/rspamd/local.d/worker-controller.inc
password = "<rspamd-encrypted-password>"

Browse to http://your-server:11334/ for the rspamd web dashboard, a real‑time view of scan results, statistics, and configuration.

Man page: man rspamd. Full reference: rspamd.com/doc.

End‑to‑end flow

How mail moves through the stack

Internet
  │   SMTP (port 25)
  ▼
Postfix (receives)
  │   milter protocol
  ▼
rspamd (filters)
  │   LMTP or local delivery
  ▼
Dovecot (stores in Maildir)
  │   IMAPS (port 993)
  ▼
Mail client (Thunderbird, mutt, phone)

Outbound mail goes the reverse direction: the client submits via SMTP on port 587 (authenticated), Postfix delivers to the destination server. The chain is modular. You can replace any component without rebuilding the others.

Web server Package catalogue