Enterprise Mail Infrastructure & 10/10 Deliverability

Achieving flawless inbox placement on Gmail, Outlook, and Yahoo requires strict cryptographic alignment between DNS records and MTA configurations.

IMPORTANT

A reverse DNS (rDNS / PTR) record matching your mail hostname (mail.yourdomain.com) is strictly mandatory. Without PTR, major providers will reject emails immediately.

1. DNS Authentication Records Checklist

A. SPF (Sender Policy Framework)

txt

v=spf1 ip4:YOUR_SERVER_IP -all

B. DKIM (DomainKeys Identified Mail)

Generated via opendkim-genkey:

txt

mail._domainkey.yourdomain.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAQ8AMIIBCgKCAQEA..."

C. DMARC Policy Record

txt

_dmarc.yourdomain.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100; sp=quarantine"

2. Postfix Configuration (`/etc/postfix/main.cf`)

ini

myhostname = mail.yourdomain.com
mydomain = yourdomain.com
myorigin = $mydomain
inet_interfaces = all
inet_protocols = ipv4

# Milter settings for OpenDKIM
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = inet:127.0.0.1:8891

# Modern TLS Ciphers
smtpd_tls_security_level = may
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_security_level = may
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.yourdomain.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.yourdomain.com/privkey.pem

Testing Verification

bash

# Verify DKIM key syntax
sudo opendkim-testkey -d yourdomain.com -s mail -vvv

# Output should show:
# opendkim-testkey: key OK