Mail server self-hosted: Postfix + Dovecot enterprise

Migrarea de la Google Workspace sau Microsoft 365 la mail self-hosted nu mai e nebunie. Pentru cerinte GDPR stricte sau cost-constient — decizie rationala.

De ce self-hosted

Suveranitate date — toate email-urile in jurisdictia ta (RO, UE)
Cost predictibil — VPS €30/luna suporta 100-500 mailbox-uri (Google echivalent: €500-2500/luna)
Control complet — DLP custom, retention specifica, audit complete
Zero vendor lock-in — protocoale standard IMAP/SMTP

Stack tehnic

Postfix MTA cu backend PostgreSQL/MySQL pentru virtual mailboxes. Dovecot IMAP/POP3 cu filtering Sieve. Rspamd anti-spam (modern, rapid). ClamAV antivirus. Roundcube sau SOGo webmail. Postscreen prima linie anti-bot.

Securitate email moderna

DKIM — semnatura criptografica outbound
SPF — autorizare SMTP outbound
DMARC — policy enforcement + raportare
MTA-STS — incriptare obligatorie SMTP
TLSA / DANE — verificare cert via DNSSEC
Greylisting — reducere spam 90%

Provocari reale

IP reputation — un IP nou are reputatie zero. Warm-up gradual zile-saptamani. Microsoft 365 / Gmail whitelisting necesita JMRP/SNDS enrollment. Reverse DNS (PTR) obligatoriu, configurat de ISP.

Pentru cine NU recomandam

Sub 20 mailbox-uri sau organizatie fara capacitate operationala permanenta — better stick with Google Workspace. Self-hosted necesita maintenance proactiva.

Ce livram

Mail server full operational cu webmail, anti-spam tuned, DKIM/SPF/DMARC validate la mxtoolbox, backup automat, monitoring deliverability, training echipa.

Exemplu: Postfix main.cf

Setarile esentiale din main.cf (TLS, DKIM, anti-spam RBL):

# /etc/postfix/main.cf — esential
myhostname = mail.example.com
smtpd_tls_security_level = may
smtpd_milters = inet:localhost:8891      # OpenDKIM
smtpd_recipient_restrictions =
    permit_mynetworks,
    reject_unauth_destination,
    reject_rbl_client zen.spamhaus.org

DKIM cu OpenDKIM

Generezi cheia DKIM si o legi de Postfix:

apt -y install opendkim opendkim-tools
opendkim-genkey -b 2048 -d example.com -s mail -D /etc/opendkim/keys/
cat /etc/opendkim/keys/mail.txt    # cheia publica -> DNS TXT mail._domainkey
# /etc/postfix/main.cf
smtpd_milters = inet:localhost:8891
non_smtpd_milters = $smtpd_milters
systemctl restart opendkim postfix

Dovecot + anti-spam de baza

Configurezi IMAP securizat si prima linie anti-bot:

apt -y install dovecot-imapd rspamd
# /etc/dovecot/conf.d/10-ssl.conf
ssl = required
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key  = </etc/letsencrypt/live/mail.example.com/privkey.pem
# Postfix: postscreen respinge botii inainte de SMTP
postconf -e 'postscreen_greet_action = enforce'

SPF + DMARC + MTA-STS (DNS)

Inregistrarile DNS care scot mailul din Spam si opresc spoofing-ul:

example.com.            IN TXT "v=spf1 mx -all"
_dmarc.example.com.     IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
_mta-sts.example.com.   IN TXT "v=STSv1; id=2026"
# https://mta-sts.example.com/.well-known/mta-sts.txt:
#   version: STSv1 / mode: enforce / mx: mail.example.com / max_age: 604800

Anti-spam: Rspamd + greylisting

Reduci spam-ul cu scoring si greylisting:

apt -y install rspamd redis-server
rspamadm configwizard                 # DKIM, greylist, scoring
# greylisting (intarzie prima livrare -> botii renunta)
echo 'enabled = true;' > /etc/rspamd/local.d/greylist.conf
rspamadm control reload; rspamc stat