Fork me on GitHub

Part 3: How to Set up SPF and DKIM with Postfix on Ubuntu Server

After completing part 1 and part 2, we have a working Postfix SMTP server and Dovecot IMAP server. We can send and receive email using a desktop email client. Although I have correct MXA and PTR record, my emails were flagged as spam by Gmail and Outlook mail. So in part 3, we are going to look at how to improve email delivery to recipient’s inbox by setting up SPF and DKIM on Ubuntu server.

What are SPF and DKIM Records?

SPF and DKIM are two types of TXT records in DNS that can help prevent email spoofing and ensure legitimate emails are delivered into the recipient’s inbox instead of spam folder. If your domain is abused by email spoofing, then your emails are likely to landed in recipient’s spam folder if they didn’t add you in address book.

SPF (Sender Policy Framework) record specifies which hosts or IP addresses are allowed to send emails on behalf of a domain. You should allow only your own email server or your ISP’s server to send emails for your domain.

DKIM (DomainKeys Identified Mail) uses a private key to add a signature to emails sent from your domain. Receiving SMTP servers verify the signature by using the corresponding public key, which is published in your DNS manager.

Create an SPF Record in DNS

In your DNS management interface, create a new TXT record like below.

create spf record in DNS


  • TXT indicates this is a TXT record.
  • Enter @ in the name field.
  • v=spf1 indicates this is a SPF record and the SPF record version is SPF1.
  • mx means all hosts listed in the MX records are allowed to send emails for your domain and all other hosts are disallowed.
  • ~all indicates that emails from your domain should only come from hosts specified in the SPF record. Emails that are from other hosts will be flagged as forged. Possible alternatives are +all-all?all, but they are rarely used.

Note that some DNS managers require you to wrap the SPF record with quotes like below.

To check if your SPF record is propagated to the public Internet, you can use the dig utility on your Linux machine like below:

The txt option tells dig that we only want to query TXT records.

use dig utility to query spf record

You can also use online SPF validator such as to see which hosts are allowed to send emails for your domain and debug your SPF record if any error occurs. The dmarcian SPF surveyor can help test your SPF record syntax.

Configuring SPF Policy Agent

We also need to tell our Postfix SMTP server to check for SPF record of incoming emails. This doesn’t help ensure outgoing email delivery but help with detecting forged incoming emails.

First install required packages:

Then edit the Postfix master process configuration file.

Add the following lines at the end of the file, which tells Postfix to start the SPF policy daemon when it’s starting itself.

Save and close the file. Next, edit Postfix main configuration file.

Append the following lines at the end of the file. The first line specifies the Postfix policy agent timeout setting. The following lines will impose restriction on incoming emails by rejecting unauthorized email and checking SPF record.

Save and close the file. Then restart Postfix.


Next time, when you receive an email from a domain that has an SPF record, you can see the SPF check results in the raw email header. The following header indicates a successful check against SPF.

Setting up DKIM

First install OpenDKIM which is an open source implementation of the DKIM sender authentication system.

Then add postfix user to opendkim group.

Edit OpenDKIM main configuration file.

Uncomment the following lines. Replace simple with relaxed/simple.

Then add the following lines below #ADSPAction continue line. If your file doesn’t have #ADSPAction continue line, then just add them below SubDomains  no.


Add the following lines at the end of this file. (On Ubuntu 18.04, the UserID is already set to opendkim)

The final configuration file is as follows:

Save and close the file.

Create Signing Table, Key Table and Trusted Hosts File

Create a directory structure for OpenDKIM

Change owner from root to opendkim and make sure only opendkim user can read and write to the keys directory.

Create the signing table.

Add this line to the file.

Save and close the file. Then create the key table.

Add the following line.

Save and close the file. Next, create the trusted hosts file.

Add the following lines to the newly created file.

The above means that messages coming from the above IP addresses and domains will be trusted and signed.

Generate Private/Public Keypair

Since DKIM is used to sign outgoing messages and verify incoming messages, we need to generate a private key for signing and a public key for remote verifier. Public key will be published in DNS.

Create a separate folder for the domain.

Generate keys using opendkim-genkey tool.

The above command will create 2048 bits keys. -d (domain) specifies the domain. -D (directory) specifies the directory where the keys will be stored and we use default as the selector (-s), also known as the name. Once the command is executed, the private key will be default.private and default.txt will be the TXT record that contains public key.

Make opendkim as the owner of the private key.

Add Public Key in DNS Records

Display the public key

The string after the p parameter is the public key.

add dkim record

In you DNS manager, create a TXT record, enter default._domainkey in the name field. Then copy everything in the parentheses and paste it into the value field. Delete all double quotes and white spaces. If you don’t delete them, then the key test in the next step will fail.

dkim record

Test your configuration

Enter the following command on Ubuntu 16.04 server to test your key.

If everything is OK, you will see

Connect Postfix to OpenDKIM

Postfix can talk to OpenDKIM via a Unix socket file. The default socket file used by OpenDKIM is /var/run/opendkim/opendkim.sock. But the postfix SMTP daemon shipped with Ubuntu runs in a chroot jail, which means that the SMTP daemon resolves all filenames relative to the Postfix queue directory (/var/spool/postfix). So we need to change the socket file.

Create a directory to hold the OpenDKIM socket file and only allow opendkim user and postfix group to access it.

Then edit the socket configuration file.

Find the following line:

Replace it with:

opendkim socket

Save and close the file.

Note: On Ubuntu 18.04, the opendkim systemd service doesn’t use /etc/default/opendkim file. You need to change the socket file in /etc/opendkim.conf file.

Find the following line:

Replace it with:

Next, we need to edit Postfix main configuration file.

Add the following lines after smtpd_recipient_restriction section.

Save and close the file. Then restart opendkim and postfix service.


SPF and DKIM Check

Now you can use your desktop email client or webmail client to send a test email to and get a free email authentication report. Here’s the report I got from

postfix spf dkim ubuntu

You can see that my email passed both SPF and DKIM check. iprev check is used to see if the reverse (IP to hostname) and forward (hostname to IP) lookup results were returned and were in agreement. Ham is a terminology used by Apache SpamAssassin to indicate that this is not spam.

You can also send a test email to your Gmail account to see if SPF and DKIM checks are passed. On the right side of an opened email message in Gmail, if you click the show original button from the drop-down menu, you can see the authentication results.

postfix setup spf dkim

If your message is not signed and DKIM check failed, you may want to check postfix log (/var/log/mail.log) to see what’s wrong in your configuration. If you see the following message in the mail log, you may want to check if the opendkim systemd service is actually running.

If opendkim is running and you still see the above error, you might need to change smtpd_milters = local:/opendkim/opendkim.sock to smtpd_milters = local:opendkim/opendkim.sock in /etc/postfix/ file.

Your email server will also perform SPF and DKIM check on sender’s domain. You can see the results in the email headers. The following is SPF and DKIM check on a sender using Gmail.

The Struggle with Microsoft Mailboxes

In my test, the email landed in my Gmail inbox. However, it’s stilled labeled as spam in my email although both SPF and DKIM are passed. Microsoft seems to be using an internal blacklist that block many legitimate IP addresses. If your emails are rejected by outlook or hotmail, you need to submit the sender information form. After that, your email will be accepted by outlook/hotmail, but may still be labeled as spam.

In part 4, we will see how to create DMARC record to protect your domain from email spoofing. As always, if you found this post useful, please subscribe to our free newsletter or follow us on Google+, Twitter or like our Facebook page

转载至:How to Set up SPF and DKIM with Postfix on Ubuntu Server



您的电子邮箱地址不会被公开。 必填项已用*标注