How to start? I’m new here!!

Hi,

Do you accept writers from outside the US? What kind of additional paperwork would be needed in addition to me reporting any income to my country’s taxation authority?

Kind regards

I’ve started writing the tutorial below on getting email to work on a droplet on account of the existing documentation and technical support being beyond awful. I don’t want payment, just a way to get this online to help others:

<h1>Setting up an email server with Postfix on Centos 7</h1>

I've written these notes following hours of frustration getting email working on my Digital Ocean droplet using Centos 7 and Postfix. 
Most of the documentation I could find via Google was obsolete, and I had to discover much of this stuff through trial and error.

I'm far from an expert, and this howto is written for other novices. I do expect readers to know enough to get into a shell on their droplet via ssh. Most of the commands assume you are at the prompt of your droplet, but you'll also need to use <code>ping</code> and <code>telnet</code> from outside your server to test things. I also assume readers have a favourite text editor, so am only going to say which files need to be edited where.

I'm going to use <em>mydomainname.com</em> as a placeholder for whatever your domain name is, and <em>1.2.3.4</em> as a placeholder
for whatever IP number Digital Ocean allocated your droplet.

<h2>Use port 587, not 25</h2>

As an email server beginner, I don't know the history of why there are three mail ports associcated with different services,
and ended up wasting several hours trying to figure out the "open sesame" for port 25 since obsolete documentation 
gave me the misimpression it was still needed.

At time of writing, the most up-to-date information for port 587 and submission is 
<a href="https://tools.ietf.org/html/rfc6409">RFC 6409</a> while for port 465 and smtps it's
<a href="https://tools.ietf.org/html/rfc8314">RFC 8314</a>.

A command we'll need to check our progress with is <a href="https://linux.die.net/man/1/nmap">nmap</a>, which Centos 7 
doesn't include by default, so you'll probably need to <code>sudo yum install nmap</code> before running this command 
and then seeing something like:

<pre><code>
nmap -p 25,465,587 localhost

Starting Nmap 6.40 ( http://nmap.org ) at 2020-12-13 09:50 SAST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000063s latency).
Other addresses for localhost (not scanned): 127.0.0.1
rDNS record for 127.0.0.1: centos-s-2vcpu-4gb-ams3-01
PORT    STATE  SERVICE
25/tcp  closed smtp
465/tcp closed smtps
587/tcp closed submission

Nmap done: 1 IP address (1 host up) scanned in 0.25 seconds
</code></pre>

When nmap says a port is closed, it unfortunately provides little clue as to whether the problem is:

<ol>
<li>Whatever server is supposed to be listening to it &mdash; Postfix here &mdash; isn't 
    running or hasn't been configured correctly.</li>
<li>Though the port is open on localhost with an associated server listening, a firewall is blocking access to it 
    from outside computers. Note I've called nmap with localhost at this stage since making open ports publically available 
    to the Internet takes several steps I'll do below.</li>
<li>The port is blocked by either the hosting company or default Linux configuration.
    (Spoiler alert, even if Digital Ocean has opened port 25 for your droplet, Centos 7 along with other "newish" 
    Linux distributions discourage using it by not making it available by default).</li>
</ol>

At this stage we know Postfix isn't listening because we haven't installed it yet, and also that calling
<code>nmap -p 25,465,587 1.2.3.4</code> won't show anything open since the required changes to the DNS record and
firewall haven't been done yet.

Lets quickly install postfix and fire it up, wich on Centos 7 involves the commands
<code>yum install postfix</code>, followed by <code>systemctl start postfix.service</code>
and also <code>systemctl enable postfix.service</code> for future reboots.

Before diving into the horrors of Postfix configuration, lets test the default installation by running 
<code>nmap -p 25,465,587 localhost</code> which should show that our Postfix server without any 
configuration is now listening to port 587. 

Contrary to what nmap says, only smtp, not submission, runs "out-the-box". This is because the 
unedited <code>/etc/postfix/master.cf</code>  configuration file only has the line for smtp uncommented, 
with the section for submission and its many options commented out.

The reason why Postfix running an smtp service doesn't open port 25 as it would have historically is revealed in 
Centos 7's default <code>/etc/services</code> file. I'll quote the relevant parts below:

<pre><code>
# service-name  port/protocol  [aliases ...]   [# comment]
...
urd             465/tcp         smtps   # URL Rendesvous Directory for SSM / SMTP over SSL (TLS)
...
smtp            587/tcp          mail
...
submission      587/tcp         msa             # mail message submission
...
</code></pre>

Centos 7's <code>/etc/services</code> file has no entry for 25/tcp, instead associating port 587 with both smtp and submission. 
A keyword STARTTLS is used for the email server (Postfix) to know which of these two protocols is being used.

Another handy utility not installed by default in Centos 7 is <a href="https://linux.die.net/man/8/netstat">netstat</a>.
Running <code>netstat -tulpen</code> prints a table showing what ports are open with which servers
attached. Postfix confusingly appears on this list as <code>master</code>.

Before returning to configuring Postfix, we need to broaden our horizon from localhost to the world with these steps:

<h2>Updating DNS records</h2>

Assuming you've already got an A record set to mydomainname.com, CNAME www.mydomainname.com, NS records ns1.digitalocean.com ..., 
after logging into Digital Ocean's control panel you'll need to make the following modifications:

<ol>
  <li>Add a second A record to mydomain.com's DNS record, say mail.mydomainname.com, or smtp.mydomainname.com, or whatever.</li>
  <li>Create an MX record saying mail.mydomainname.com is the mail server for mydomainname.com. (If, like me, you have several
  domain names, Postfix can be set up to send and receive emails for all of them. Add this stage, you can add an MX record
  pointing to mail.<em>mydomainname</em>.com for each of the other domains you have)</li>
  <li>Rename your droplet to <em>mail.mydomainname.com</em>. This is done by clicking on <em>Droplets</em>, and then on
  the existing droplet name to bring up a cursor allowing you to edit it and save it. The reason you need
  to rename the droplet is it activates reverse DNS for the IP address Digital Ocean allocated to you, which in turn is
  required by many of the service providers of whoever you send email to.</li>
</ol> 

<h2>Opening port 587</h2>

Modifying the instructions at
<a href="https://www.digitalocean.com/community/tutorials/iptables-essentials-common-firewall-rules-and-commands#service-mail">
https://www.digitalocean.com/community/tutorials/iptables-essentials-common-firewall-rules-and-commands#service-mail</a> for
port 587 instead of 25, run:

<pre><code>
sudo iptables -A INPUT -p tcp --dport 587 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 587 -m conntrack --ctstate ESTABLISHED -j ACCEPT
</code></pre>

If your are using Centos's firewalld, you'll also want to run 
<code>sudo firewall-cmd --permanent --add-service=smtp-submission</code> and then
<code>sudo systemctl restart firewalld</code>.

(If you want to use port 465 with smtps instead of or alongside port 587 and submission, do the 
above with the different port number and service name).

Testing with the command
<code>nmap -p 25,465,587 localhost</code> and then
<code>nmap -p 25,465,587 1.2.3.4</code> shows that while Postfix is listening to port 587 on localhost,
changes to the default configuration are needed for it to also listen on the public IP number.

<h2>Configuring Postfix</h2>

Step 1: make backup copies of the two configuration files, 
<code>/etc/postfix/main.cf</code> and <code>/etc/postfix/master.cf</code>.

<em>When in doubt, use the default</em> doesn't quite rhyme, but I find it a handy rule of thumb. Given how fiddly
getting an email server to work is, my strategy was to change as little as possible and 
run <code>systemctl restart postfix.service</code> a lot to try figure out what each change did.

Other handy commands are <code>postfix check</code> which ideally produces no output, and <code>postconf -n</code>
which alphabetically lists which configuration variables have been set to what.

Besides opening <code>/etc/postfix/main.cf</code> with your favourite text editor, its a good idea to have the official
documentation's <a href="http://www.postfix.org/BASIC_CONFIGURATION_README.html">Basic Configuration</a> page open as
reference.

General advice in the howtos I've seen is to uncomment <code>#myhostname = host.domain.tld</code> and edit it
to <code>myhostname = mail.mydomainname.com</code>. But personally, I left it commented and set my hostname environment
variable to mail.mydomainname.com, which is read from /etc/hostname and can be set on Centos with the command 
<code>hostnamectl set-hostname mail.mydomainname.com</code>. If myhostname is left unset, Postfix defaults to the system's 
hostname value, which in turn becomes the default for various other configuration
variables which needn't concern us since our main worry is virtual names which I'll get to soon.

An important edit to make is to comment out the default <code>inet_interfaces = localhost</code> and uncomment
either <code>inet_interfaces = all</code> or <code>inet_interfaces = $myhostname, localhost</code>
(the two are synonymous as far as I understand, but I prefer the latter since "all" could mean anything).

An important step after every configuration edit is to run <code>systemctl restart postfix</code>.

Now when you enter <code>nmap -p 25,465,587 1.2.3.4</code>, you'll hopefully see
<code>587/tcp open   submission</code>.

This means our mail server is on the Internet, which we can test from outside the server with
<code>ping mail.mydomainname.com</code> and more importantly
<code>telnet mail.mydomainname.com 587</code> should produce something like:

<pre><code>
Trying 1.2.3.4...
Connected to mail.mydomainname.com.
Escape character is '^]'.
220 mail.mydomainname.com ESMTP Postfix
^]
telnet> close
Connection closed.
</code></pre>

<hr>

<h3>SSL/TLS</h3>

Assuming you use <a href="https://letsencrypt.org/">Let's Encrypt</a> get a free SSL/TLS certificate for mail.mydomainname.com
by running <code>sudo certbot certonly --standalone -d mail.mydomainname.com</code>

Something that tripped me up was I discovered I needed to switch off my web server (nginx) to avoid a
"Problem binding to port 80: Could not bind to IPv4 or IPv6." error.

If the above works, the required files will be in the subdirectory <code>/etc/letsencrypt/live/mail.mydomainname.com/</code>

Postfix's official documentation is at <a href="http://www.postfix.org/TLS_README.html">TLS Support</a>. The provided
main.cf file doesn't include an example, so what I added to the end of configuration file looks like this:

<pre><code>
# SSL
smtpd_tls_cert_file=/etc/letsencrypt/live/mail.mydomainname.com/fullchain.pem
smtpd_tls_key_file=/etc/letsencrypt/live/mail.mydomainname.com/privkey.pem
smtpd_use_tls=yes
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_security_level=may
smtpd_tls_protocols = !SSLv2, !SSLv3
</code></pre>

The next test is from a command line not on the server, run <code>telnet mail.mydomainname.com 587</code>,
which at this stage results in something like:

<pre><code>
Trying 1.2.3.4...
telnet: Unable to connect to remote host: No route to host
</code></pre>

In /etc/postfix/master.cf, we need to uncomment submission (and may as well comment out smtp)

<pre><code>
#smtp      inet  n       -       n       -       -       smtpd
...
submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_wrappermode=no                 ??? need to check if this should be added
  -o smtpd_tls_security_level=encrypt
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=permit_mynetworks,reject
  -o milter_macro_daemon_name=ORIGINATING
</code></pre>

Hello,

I writing this comment in concern to become a part of the DOnation community, And I got to know that, alligator.io has joined the DOnation community, And I am already a contributor in alligator.io, And since it has joined Digital Ocean Community, My Article is also published here with 48.9k views.

Link to the article: https://www.digitalocean.com/community/tutorials/angular-drag-drop

So, Do I need to apply separately for becoming the author in DOnation community? Or since my article is already published, I am directly eligible as an author, If this is the case. I have already registered myself on the platform: https://www.digitalocean.com/community/users/sarkazein7

Please let me know the next steps.

Thanks & Regards.

Hello, I am very pleased to have an account at digitalocean, a company that in addition to offering an excellent service, also appreciates the effort in the writing of articles and technical tutorials. For my part, I hope to write soon for you and for the community in general.

regards