Postfix with Rspamd on Debian 12 Bookworm

This is based on Thomas Pircher's 2021 DKIM setup with Postfix and Rspamd on Debian Linux

Install needed debs

sudo apt install postfix rspamd

Postix is gonna want configuration data

Internet Site
System mail name should have been guessed correctly

And

sudo systemctl reload postfix

of course

Get Private Keys

I generate all the DKIM keys elsewhere in my infrastructure. So I rsync the keys in a sub-dir dkim into /var/lib/rspamd. And

sudo chown -R _rspamd:_rspamd /var/lib/rspamd/dkim

Create Working Rspamd Spool

sudo mkdir /var/spool/postfix/rspamd
sudo chown postfix:_rspamd /var/spool/postfix/rspamd
sudo chmod g+w /var/spool/postfix/rspamd/

Configure Rspamd

cat > /etc/rspamd/local.d/worker-proxy.inc << EOF
# this worker will be used as postfix milter
milter = yes;

bind_socket = "/var/spool/postfix/rspamd/milter.sock mode=0666 owner=nobody";

# the following specifies self-scan mode, for when rspamd is on the same
# machine as postfix
timeout = 120s;
upstream "local" {
  default = yes;
  self_scan = yes;
}
EOF
chown _rspamd:_rspamd /etc/rspamd/local.d/worker-proxy.inc

And, beware your selector is probably not 'rgnet-mail'

cat >> /etc/rspamd/local.d/dkim_signing.conf << EOF
path = "/var/lib/rspamd/dkim/\$domain.public";
selector = "rgnet-mail";
### Enable DKIM signing for alias sender addresses
allow_username_mismatch = true;
EOF
chown _rspamd:_rspamd /etc/rspamd/local.d/dkim_signing.conf

cat > /etc/rspamd/whitelist << EOF
cat whitelist
127.0.0.2/32
147.28.0.0/23
198.180.150.0/24
198.180.152.0/24
::1/128
2001:418:1::0/64
2001:418:1:8006::0/64
2001:418:1:3807::0/64
EOF

cat > /etc/rspamd/local.d/greylist.conf << EOF
whitelisted_ip = /etc/rspamd/whitelist
EOF

cat > /etc/rspamd/local.d/worker-proxy.inc << EOF
bind_socket = "127.0.0.1:11332";
milter = yes;
timeout = 120s;
upstream "local" {
  default = yes;
  self_scan = yes;
}
EOF

Then

sudo systemctl restart rspamd

Postfix Configuration

Tell postfix to handle milter errors gracefully

cat >> /etc/postfix/main.cf << EOF
# Added to work with rspamd                                                     
milter_default_action = accept

# As the DKIM milter is the only in use
smtpd_milters = unix:/rspamd/milter.sock
non_smtpd_milters = unix:/rspamd/milter.sock

# Also set the milter_mail_macros and milter_protocol options:
milter_protocol = 6
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}

EOF

And restart postfix

systemctl restart postfix.service

And maybe check its status

systemctl status postfix.service

2024.12.28

2.7 KiB Raw Permalink Blame History