Server di posta: consigli per configurarlo a dovere

Capita sempre più spesso di ricevere segnalazioni per email rifiutate, email segnalate come sospette, email buona che vengono taggate come spam e la lista potrebbe continuare all’infinito.

In questo articolo vorrei fare solo una breve check list, su come andrebbe configurato un buon server di posta, non solo sulla configurazione dello stesso, ma anche su tutte le altre tecniche necessarie a far si che la nostra posta venga recapitata correttamente e senza intoppi al destinatario.

Mailserver

Chiaramente il nostro server di posta è il core su cui si basano i nostri controlli, in quanto è l’ultima difesa che rimane se tutti gli altri controlli vengono verificati con esito negativo.

In questo esempio analizziamo nello specifico postfix, uno dei server di posta linux based più diffusi del mondo. Ritengo che i seguenti parametri siano di fondamentale importanza per la lotta allo spam quando ricevete le mail.

Fra i vari parametri che vi consiglio di inserire nel vostro file main.cf vi riporto i seguenti

  • disable_vrfy_command = yes : Disabilita il cmoando SMTP VRFY. Questo parametro blocca alcune tecniche utilizzate per raccogliere indirizzi email presenti sul vostro server
  • smtpd_delay_reject = yes : Permette a postfix di loggare informazioni sugli indirizzi dei destinatari quando vengono bloccato un client o un indirizzo oppure l’indirizzo di un mittente, in tal modo è possibile capire quale mail è stata rifiutata.
  • smtpd_helo_required = yes : Richiede che l’SMTP remoto da cui stiamo ricevendo una mail, inizi una sessione con il comando HELO o EHLO. Gran parte dei bot presenti su internet infatti (utilizzati per inviare spam), non utilizzano questo comando in connessione. Di seguito riporto altri due comandi che si legano questo:
  • smtpd_helo_restrictions = permit_mynetworks (per disabilitare il check sulle nostre reti)
  • reject_non_fqdn_hostname : scarta la mail se l’hostname del mittente non ha un formato FQDN (vedi ad esempio un server che spedisce posta con hostname mx1.network.local…). Moltissimi bot non hanno un hostname con FQDN
  • reject_invalid_hostname : Rifiuta tutte le mail inviate da computer connessi via connessioni di dialup (vedi ADSL ad ip dinamico), questo tipo di computer infatti solitamente non hanno un hostname valido

Altri controlli utili, abbastanza autoesplicativi sono

smtpd_recipient_restrictions =
reject_invalid_hostname,
reject_non_fqdn_hostname,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_unknown_sender_domain,
reject_unknown_recipient_domain,
permit_mynetworks,
reject_rbl_client sbl.spamhaus.org,
reject_rbl_client cbl.abuseat.org,
reject_rbl_client dul.dnsbl.sorbs.net,
permit

Una menzione a parte va fatta per le RBL, configurate sopra con il parametro reject_rbl_client. RBL è l’acronimo di Real-Time Blackhole List o più comunemente noto come DNSBL (Dns Black List), ci sono degli organismi appositi che si occupano di tenere aggiornate queste liste (Spamhouse fra i più famosi), se l’ip del mittente fa parte di queste liste semplicemente verrà scartato.

In questo caso fate attenzione ai falsi positivi che potrebbero verificarsi.

Reverse DNS

Per migliorare ancora di più l’affidabilità dei nostri server, in questo caso riguardo la posta in uscita, quindi come ci presentiamo noi verso il mondo, parliamo di Reverse DNS (conosciuto come DNS inverso).

Tutti conosciamo il concetto di DNS, ovvero la traduzione di un hostname (www.temporini.net) in un indirizzo IP (104.27.134.122).

Il Reverse DNS altro non è che l’operazione inversa, ovvero dall’indirizzo ip all’hostname.

Per verificare se un indirizzo ip ha correttamente configurato il suo reverse ci basta usare questo semplice comando linux

host -n 212.83.178.52
52.178.83.212.in-addr.arpa domain name pointer mx.servisys.it.

In questo caso, il reverse è correttamente configurato in quanto a partire dell’indirizzo ip mi da il corretto hostname del server di posta.

SPF

Continuiamo a parlare di DNS e server di posta, e focalizziamoci ora sui record SPF acronimo di Sender Policy Framework.

Questo record servono a puntualizzare il fatto, di quali indirizzi ip sono riconosciuti come indirizzi autorevoli del nostro dominio per inviare posta a nostro nome.

Se facciamo un controllo su temporini.net con il comando dig txt temporini.net vederemo che il record txt apposito avrà la seguente configurazione

temporini.net.          300     IN      TXT     “v=spf1 a a:temporini.net ip4:37.59.120.54 ip6:2001:41d0:51:1::1745 include:spf.mandrillapp.com ~all”

In questo caso ho specificato come attendibili

  • Tutti i record di tipo A associati a temporini.net
  • gli indirizzi IPv4 37.59.120.54 e IPv6 2001:41d0:51:1::1745
  • l’indirizzo SPF per le mailing list di Mandrill spf.mandrillapp.com

A questo punto la domanda sorge spontanea: perchè dovrei usare SPF? Tanto per cominciare Google controlla il record SPF e declassa la vostra mail se non è correttamente cofigurata, se controllate il contenuto originale della mail e il controllo è passato correttamente vedrete qualcosa di simile a questo

Received-SPF: pass (google.com: domain of [email protected] designates 2607:f8b0:4003:c06::22b as permitted sender) client-ip=2607:f8b0:4003:c06::22b;

Altrimenti se il check fallisce vederete invece qualcosa di simile a questo

spf=neutral (google.com: 66.33.200.130 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received-SPF: neutral (google.com: 66.33.200.130 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=66.33.200.130;

In questo secondo caso come vedete il record SPF non è stato configurato e quindi Gmail lo considera Neutrale declassando di fatto il nostro messaggio che ha alta probabilità di finire nella cartella spam (cosa che in questo caso è avvenuta).

DKIM

Passiamo ora ad introdurre DKIM, di recente introdotto anche su Gmail e quindi da considerarsi ormai un must.

DKIM è l’acronimo di DomainKeys Identified, è un sistema di identificazione ed autoreferenziazione della propria posta elettronica. Se attivato il DKIM provvede a certificare il contenuto del messaggio. DKIM permette di conoscere il reale gestore del dominio da cui parte il messaggio, oltre che ad applicare una firma che certifica sia il contenuto che l’ intestazione del messaggio stesso.

A differenza di SPF, dkim non è di banalissima configurazione richiede conoscenze abbastanza approfondite per la sua configurazione, dipendente dal sistema di posta che volete utilizzare.

Ci sono alcuni sistemi (tra cui ISPconfig) che integrano già la parte di configurazione lato server, a cui andrà aggiunta anche la parte di configurazione lato DNS.

Per un implementazione su postfix vi consiglio l’ottima guida presente su Digital Ocean

https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-dkim-with-postfix-on-debian-wheezy

Crittografia TLS/SSL

Anche questa opzione sta diventando pressochè mandatoria, vi consiglio quindi vivamente l’attivazione. Anche questa feature è utilizzata da gmail per i controlli, per vedere se la vostra mail è criptata basta controllare in alto la vostra mail.

Se la mail non è criptata vedere una cosa simile a questo

 

 

Se invece è tutto regolare non ci sarà nulla.

Postgrey (Opzionale)

Postgrey è una tecnica utilizzata per le mail in ingresso, in cui il sistema simula un “fail” e chiede al mittente di rispedire la mail dopo un certo numero di minuti.

Quando una mail viene ricevuta, e rinviata dopo il numero di minuti richiesto, il sistema memorizza l’indirizzo ip per un certo periodo di tempo, in modo che le prossime mail che arrivano dallo stesso indirizzo passeranno subito senza ritardi.

Il sistema ad alcuni può non piacere a causa dei ritardi delle mail in arrivo, non essendo obbligatorio per il corretto recapito lo cito solo come opzione aggiuntiva.

Che provider scegliere?

Servisys da anni sul mercato è in grado di offrire soluzioni che rispondono a tutte queste caratteristiche con il servizio Servisys Collaboration Suite.


Pubblicato

in

, , , ,

da

Commenti

2.376 risposte a “Server di posta: consigli per configurarlo a dovere”

  1. Avatar Chinese Wife DEEPTHROAT_and FACEFUCK on her knees @Sukisukigirl

    Hi there, this weekend iis good iin favoor off me, aas this time i am reading thgis great educational piece of writing hdre at my
    house.

  2. Avatar roloflix.com

    Touche. Outstanding arguments. Keepp uup the great
    spirit.

  3. Avatar FRENCH arabica poilue

    Whhy visitrs stoll uuse tto read nrws papers when in this technologgical world alll iis presented on web?

  4. Avatar 502

    I have bwen explloring for a bbit forr anny high-quality articles or
    webllg posts iin this kin oof space . Expporing iin Yahoo I
    aat last stumbleed upon this site. Reading thiss information So i’m satyisfied to express that I’ve an incredibly exchellent uncannny fweling I found out xactly what I needed.
    I most ineisputably will maske certain tto do nott disregard this site andd provides it a look regularly.

    https://tinyurl.com/2zcyjyah

  5. Avatar tinyurl.com

    magnificent points altogether, yyou jst gasined a logo new
    reader. Whhat would youu suggest iin regards to youyr submit that youu made some days in thee past?

    Any positive?

  6. Avatar Upskirt

    Thiis is my irst time go to see at here and i amm actyually happy
    tto reaad alll aat alone place.

  7. Avatar 528

    I’m realy enjoying thee design and layout of your site.

    It’s a very easzy onn the eyes whuch makes it much more enjoyable for
    me to ome here and visit moore often. Did yoou
    hijre out a developerr too ccreate your theme?
    Great work!

  8. Avatar 805

    My bbrother suggestred I mmay like this web site.
    He was nce totlly right. Thiis puut uup actually made my day.
    You cann’t believe juzt how sso much timme I had spet ffor this
    information! Thannk you!

  9. Avatar 342

    Askingg questions are acually nic hing if you are noot underetanding anything totally, except this paragraoh presents goiod undertanding even.

  10. Avatar Les

    Heklo there, I found you web site by way of Google at the same
    timee as lolking for a relatedd topic, your wweb site came up, it appars to be like good.

    I have bookmarked it iin mmy google bookmarks.

    Hi there, simply turned into alert tto your
    blog via Google, and found that it’s truly informative.

    I’m goking to watch out for brussels. I’ll appreciate in the evenmt you
    proceed this inn future. Lots of othwr peopple can be benefited out off yourr writing.
    Cheers!

  11. Avatar vorbelutrioperbir

    I really appreciate this post. I’ve been looking everywhere for this! Thank goodness I found it on Bing. You’ve made my day! Thanks again!

  12. Avatar zoritoler imol

    Hmm it seems like your site ate my first comment (it was extremely long) so I guess I’ll just sum it up what I wrote and say, I’m thoroughly enjoying your blog. I too am an aspiring blog blogger but I’m still new to everything. Do you have any points for inexperienced blog writers? I’d definitely appreciate it.

  13. Avatar аудиокниги бесплатно

    Автор приводит примеры из различных источников, что позволяет получить более полное представление о теме. Статья является нейтральным и информативным ресурсом для тех, кто интересуется данной проблематикой.

  14. Avatar аудиокниги скачать бесплатно на телефон

    Эта статья – настоящий кладезь информации! Я оцениваю ее полноту и разнообразие представленных фактов. Автор сделал тщательное исследование и предоставил нам ценный ресурс для изучения темы. Большое спасибо за такое ценное содержание!

  15. Avatar метизы из китая оптом

    Я прочитал эту статью с большим удовольствием! Автор умело смешал факты и личные наблюдения, что придало ей уникальный характер. Я узнал много интересного и наслаждался каждым абзацем. Браво!

  16. Avatar катание в зорбе спб

    Эта статья является примером качественного исследования и профессионализма. Автор предоставил нам широкий обзор темы и представил информацию с точки зрения эксперта. Очень важный вклад в популяризацию знаний!

  17. Avatar Ahha4d Login Link Alternatif

    Ⅿy programmer іs trying to persuade mе to move to .net fгom PHP.
    I have always disliked tһe idea because off tһe costs.
    Вut he’s tryiong nonne thе leѕs. I’ve been using WordPress on a variety of websites fοr aƅout a year
    and am nervous abⲟut switching t᧐ another platform.
    I һave һeard verry ցood thіngs аbout blogengine.net.
    Is tһere a way Ι cɑn import ɑll mʏ wordpress posts іnto іt?
    Any help woᥙld be reаlly appreciated!

    Hеrе is my web рage; Ahha4d Login Link Alternatif

  18. Avatar pg slot demo
    pg slot demo

    pg slot demo Website to try playing slots for every camp for free. No need to apply, no deposit required. All slots players can Free trial of all slot games Update the latest games 2023, try playing slots, PG SLOT and many other camps. There are more than 1,000 games to choose from, open 24 hours a day.

  19. Avatar megagame
    megagame

    megagame website providing slot games, online slots, online casinos, fish shooting games from all slots camps. New slot games in one website!

  20. Avatar เกมปั่นสล็อตฟรี
    เกมปั่นสล็อตฟรี

    เกมปั่นสล็อตฟรี PG SLOT (PG Slots) 3D online video slots games, beautiful graphics, attractive to play, with many games to choose from PGSLOT, the main website that offers PG slots games, the latest in 2023, new open slots websites. Play slot games anywhere through the website.

  21. Avatar pgslot
    pgslot

    pgslot Many slots fans, easy to break 2023 slots, deposit, withdraw, no minimum, may think that introducing easy to break 2023 slots, slot games are easy to break, difficult to break. Web slots are the easiest to break. depending on each game Web slots often break But in fact, direct web slots do not pass agents, no minimum.

  22. Avatar สล็อตออนไลน์
    สล็อตออนไลน์

    สล็อตออนไลน์ try playing slots Free trial slot games website Including all famous websites Including all new camps Ready to update all the new games every day. Whether it is the latest game of the PG slots camp, the website has gathered all of them here. Let everyone try to experience 3D style slots, play for free, no registration required, apply for membership, play right away, no hassle.

  23. Avatar 1k followers tiktok buy

    Thanks for some other informative website.

    The place else may just I get that type of information written in such
    a perfect manner? I’ve a challenge that I’m simply now working on, and I’ve been on the glance out for such
    information.

  24. Avatar cheapest site to buy instagram followers

    Having read this I thought it was extremely informative.
    I appreciate you spending some time and energy to put this information together.
    I once again find myself personally spending a significant amount of time both reading and leaving comments.
    But so what, it was still worth it!

  25. Avatar مورد أنابيب HDPE في العراق

    With their extensive range of fittings, including elbows, tees, couplings, and more, Elitepipe Plastic Factory offers comprehensive solutions for various pipe systems and installations. Elitepipe Plastic Factory

  26. Avatar Pipe fittings solutions

    عندما يتعلق الأمر بأنابيب uPVC ، فإن مصنع إيليت بايب Elite Pipe يضع معايير عالية من خلال منتجاته المصممة بدقة والتي توفر حلول سباكة وري موثوقة وخالية من التسرب.

  27. Avatar بايب تركي

    With their extensive range of fittings, including elbows, tees, couplings, and more, Elitepipe Plastic Factory offers comprehensive solutions for various pipe systems and installations. Elitepipe Plastic Factory

  28. Avatar البولي إيثيلين pdf

    Customers can rely on Elitepipe Plastic Factory’s technical expertise and dedicated customer support to assist them in selecting the most suitable fittings for their specific needs. Elitepipe Plastic Factory

  29. Avatar تجهيزات أنابيب uPVC

    The uPVC fittings produced by Elitepipe Plastic Factory are highly resistant to corrosion, providing reliable and maintenance-free solutions for plumbing and irrigation systems. Elitepipe Plastic Factory

  30. Avatar جدول لحام hdpe

    The factory’s adherence to environmental sustainability is demonstrated through their use of eco-friendly materials and energy-efficient manufacturing practices. Elitepipe Plastic Factory

  31. Avatar https://www.cnru.su/

    Статья содержит ссылки на актуальные и авторитетные источники, что делает ее надежной и достоверной.

  32. Avatar cnru.su

    Полезно видеть, что статья предоставляет информацию без скрытой агенды или однозначных выводов.

  33. Avatar Перекладные фокусы

    For most up-to-date news you have to pay a visit internet and on world-wide-web I found this web site as a best website for most recent updates.

  34. Avatar Выведите свою компанию на мировую торговую площадку

    Я нашел эту статью чрезвычайно познавательной и вдохновляющей. Автор обладает уникальной способностью объединять различные идеи и концепции, что делает его работу по-настоящему ценной и полезной.

  35. Avatar Найдем покупателей, партнеров, инвесторов

    Я оцениваю тщательность и точность исследования, представленного в этой статье. Автор провел глубокий анализ и представил аргументированные выводы. Очень важная и полезная работа!

  36. Avatar https://tradesparq.su/

    Надеюсь, что эти комментарии добавят ещё больше позитива и поддержки к информационной статье!

  37. Avatar данные о международных торговых операциях из России, Китая, Индии, стран Азии и СНГ

    Эта статья – источник вдохновения и новых знаний! Я оцениваю уникальный подход автора и его способность представить информацию в увлекательной форме. Это действительно захватывающее чтение!

  38. Avatar разместить объявление бесплатно

    Статья помогла мне лучше понять сложные концепции, связанные с темой.

  39. Avatar gkwithfaisal.com

    The factory’s dedication to quality is evident in the superior performance of their HDPE pipes, which are known for their exceptional strength and durability. Elitepipe Plastic Factory

  40. Avatar اللحيم

    Elitepipe Plastic Factory’s commitment to customer satisfaction is evident in their prompt delivery schedules and exceptional after-sales service. Elitepipe Plastic Factory

  41. Avatar uPVC pipe solutions in Iraq

    مع مجموعة واسعة من التركيبات ، بما في ذلك الأكواع ، المحملات ، الوصلات ، وأكثر من ذلك ، يقدم مصنع إيليت بايب Elite Pipe حلولًا شاملة لأنظمة وتركيبات الأنابيب المختلفة.

  42. Avatar تترد

    تشتهر تجهيزات HDPE من إيليت بايب Elite Pipe بتعدد استخداماتها ، مما يسمح بوصلات آمنة وفعالة في تطبيقات متنوعة مثل إمدادات المياه وتوزيع الغاز وخطوط الأنابيب الصناعية.

  43. Avatar electrofusion fittings price list

    كمورد موثوق به في صناعة البلاستيك ، أنشأ إيليت بايب Elite Pipe شراكات طويلة الأمد مع العملاء الذين يقدرون منتجاتهم عالية الجودة وأدائهم الموثوق.

  44. Avatar Размещение Объявлений

    I’ve had positive experiences connecting with like-minded individuals and communities through the platform’s groups feature.

  45. Avatar https://candymail.org/ru/

    Вы также можете зашифровать свои сообщения и задать пароль для их расшифровки, если хотите дополнительной защиты.

  46. Avatar Анонимная почта

    Также вы можете зашифровать свои сообщения и задать пароль для их расшифровки. Это обеспечит дополнительную защиту вашей конфиденциальности и обеспечит безопасность ваших сообщений.

  47. Avatar vammebel.ru

    My relatives always say that I am wasting my time here at net, but I know I am getting familiarity everyday by reading such nice posts.

  48. Avatar 110mm pvc pipe price

    The Elitepipe Plastic Factory in Iraq is an industry leader known for its commitment to delivering high-quality plastic pipes and fittings. Elitepipe Plastic Factory

  49. Avatar تركيبات uPVC

    مع مجموعة واسعة من التركيبات ، بما في ذلك الأكواع ، المحملات ، الوصلات ، وأكثر من ذلك ، يقدم مصنع إيليت بايب Elite Pipe حلولًا شاملة لأنظمة وتركيبات الأنابيب المختلفة.

Lascia un commento

Il tuo indirizzo email non sarà pubblicato. I campi obbligatori sono contrassegnati *