Hacker News Reader

Comment by peller | Hacker News Reader

If you're comfortable with command-line Linux, and have a basic understanding of DNS, setting this up from scratch is actually not all that hard. After researching the hell out of this a few weekends ago, the best guide I found on the subject is: https://workaround.org/ispmail/jessie

Sure, it's technically for Debian, but if you're comfortable with Linux it's easily adaptable to other distributions. In order to get Gmail to accept your email without it going to spam, you need SPF/DKIM and a SSL cert. Let's Encrypt works, and is a cinch to set up.

View on HN

I thought let's encrypt was only for domain names and not for email encryption. I'm a beginner in self hosted email.

I'm using spf and dkim, ip is not blacklisted, and the domain I'm sending from has a let's encrypt cert, but my emails still go to gmail spam. (Outlook also, but yahoo goes to the inbox)

Now that I'm thinking, the emails are sent using postfix through the fqdn (subdomain.example.com) which is not served by http and hasn't hot a cert.

If this is the case should sending the emails through example.com or add a cert to host.example.com work?

Or is there another mechanism to use let's encrypt certs for email?

One of the things that tripped me up at first was the postfix settings. smtpd_* options are for receiving mail, and smtp_* (no d) are for sending. So you need

smtp_tls_cert_file = /etc/letsencrypt/live/$domain/fullchain.pem

smtp_tls_key_file = /etc/letsencrypt/live/$domain/privkey.pem

smtp_tls_security_level = may # or encrypt, to force TLS

Also, yes, if I understand you correctly your cert should include subdomain.example.com even if the web-facing content there doesn't use HTTPS.

Thank you, I've added a le cert for the fqdn and updated the postfix config and a test email went straight to gmail inbox!

No problem, glad to hear you got it working!

If you don't and are rather a windows guy, I strongly recommand Smartermail. They have a free edition. Very easy to setup, all in one solution with a good webmail. Supports ActiveSync (not free though), SPF, DKIM. But not let's encrypt.

One thing to know, you need to activate the option to use TLS for outgoing email. A bit of a stupid default in my opinion.

> If you're comfortable with command-line Linux, and have a basic understanding of DNS, setting this up from scratch is actually not all that hard. After researching the h... out of this a few weekends ago, ...

You make it sound hard, just there, or do I misunderstand?

Ah that wasn't my intention :) Personally, I had just kept hearing all these nightmare stories about self-hosted email and never really looked into it further. Until I went from zero familiarity with the options to having a working setup in a weekend. But it probably took me longer than it needed to, because I've been learning BASH at the same time and wanted a fully scriptable install process. And some time spent wrestling with nginx (for https webmail), which I was also new to.

Ok, I see, thanks for the honesty!

Reply on news.ycombinator.com