OpenSMTPD

OpenSMTPD is a free mail transfer agent, developed as part of the OpenBSD project. This article builds upon Mail server.

Installation

Install the opensmtpd package.

Configuration

OpenSMTPD is configured in /etc/smtpd/.

Note: Starting with OpenSMTPD version 6.4.0 the configuration file syntax has been completely reworked, breaking compatibility with previous configuration files. For instruction on migrating the configuration to the new syntax see https://poolp.org/posts/2018-05-21/switching-to-opensmtpd-new-config/.

Local mail

To have local mail working, for example for cron mails, it is enough to simply start smtpd.service.

The default configuration of OpenSMTPD is to do local retrieval and delivery of mail, and also relay outgoing mail. See smtpd.conf(5).

Local mail only

To do only local mail, the following is enough:

/etc/smtpd/smtpd.conf

listen on localhost
action "local" mbox alias <aliases>
match for local action "local"

Hybrid : local mail and relay

These two lines in /etc/smtpd/smtpd.conf :

action "local" mbox alias <aliases>
action "relay" relay host "smtp://smtp.foo.bar" mail-from "@foo.bar"
match for local action "local"
match for any action "relay"

configure OpenSMTPD to :

send local email locally, without going through a relay (useful for cron & at mail notifications)

use a relay to send a mail outside of localhost

Simply replace smtp.foo.bar by your ISP mail server, or another server at your convenience.

Relay only

To send all local emails through a relay invoke procmail:

The aliases option is used for the local user mapping, for a simplified mapping you can use virtual aliases with a catch all:

TLS

To obtain a certificate, see OpenSSL#Usage.

Create user accounts

Create a user account on the mail server for each desired mailbox.

# useradd -m -s /bin/bash roger
# useradd -m -s /bin/bash shirley

OpenSMTPD will deliver messages to the user account's mbox file at
Multiple SMTP email addresses can be routed to a given mbox if desired.

Craft a simple smtpd.conf setup

A working configuration can be had in as little as nine lines!

/etc/smtpd/smtpd.conf

pki mx.domain.tld cert         "/etc/smtpd/tls/smtpd.crt"
pki mx.domain.tld key          "/etc/smtpd/tls/smtpd.key"

table creds                    "/etc/smtpd/creds"
table vdoms                    "/etc/smtpd/vdoms"
table vusers                   "/etc/smtpd/vusers"

listen on eth0 tls pki mx.domain.tld
listen on eth0 port 465 smtps pki mx.domain.tld auth <creds>
listen on eth0 port 587 tls-require pki mx.domain.tld auth <creds>

action receive	mbox virtual <vusers>
action send relay

match from any for domain <vdoms> action receive
match for any action send

Create tables

For the domain table file; simply put one domain per line

/etc/smtpd/vdoms

personaldomain.org
businessname.com

For the user table file; list one inbound SMTP email address per line and then map it to an mbox user account name, SMTP email address, or any combination of the two on the right, separated by commas.

For the creds table file; put the user name in the 1st column and the password hash in the 2nd column

Test the configuration

# smtpd -n

If you get a message that says 'configuration OK' - you are ready to rock and roll. If not, work on any configuration errors and try again.

Troubleshooting

Console debugging

If you are having problems with mail delivery, try stopping the smtpd.service and launching the daemon manually with the 'do not daemonize' and 'verbose output' options. Then watch the console for errors.

# smtpd -dv

Subsystem tracing

Add the flag to get real-time subsystem tracing

# smtpd -dv -T smtp

Alternately, use the command if the daemon is already running. The trace output will appear in the console output above as well as the journalctl output for the smtpd.service. For example:

# smtpctl trace expand && smtpctl trace lookup

...will trace both aliases/virtual/forward expansion and user/credentials lookups

Manual Submission port authentication

Encode username and password in base64

Connect to submission port using command, using one of the following commands:
- To connect via port 465 (implicit TLS):
- To connect via port 587 (STARTTLS):

enter EHLO myhostname followed by . Paste in the base64 string from step above after 334 response.

250 HELP
EHLO test.domain.tld
250-mx.hostname.tld Hello test.domain.tld [5.5.5.5], pleased to meet you
250-8BITMIME
250-ENHANCEDSTATUSCODES
250-SIZE 36700160
250-DSN
250-AUTH PLAIN LOGIN
250 HELP
AUTH PLAIN
334 
dXNlcm5hbWUAdXNlcm5hbWUAcGFzc3dvcmQ=
235 2.0.0: Authentication succeeded

"Helo command rejected: need fully-qualified hostname"

When sending email, if you get this kind of messages, set your FQDN in the file . Otherwise, the server name is derived from the local hostname returned by , either directly if it is a fully qualified domain name, or by retrieving the associated canonical name through .

System users authentication failure

If you are using the system users and the authentication with valid credentials fails, you have to configure PAM:

gollark: ... privacy?

gollark: > if you don't want to give Discord your ID now

gollark: I mean, there's a 100-server limit if you don't want to give Discord your ID now. Also, we may not actually use most of them usefully.

gollark: * reasons

gollark: Unfathomable reaosns.