How to Configure Postfix with Opendkim, SPF, and DMARC on Ubuntu for Reliable Transactional Email Delivery

ByAkensai

Learning how to configure Postfix with OpenDKIM, SPF, and DMARC on Ubuntu for reliable transactional email delivery is one of the most valuable skills a server administrator can have. Without proper email authentication, your transactional emails , password resets, order confirmations, notifications , end up in spam folders. That costs you users and revenue. This tutorial walks you through the entire setup on Ubuntu 22.04. You’ll install and configure Postfix as your mail transfer agent, sign outgoing mail with OpenDKIM, publish SPF and DMARC DNS records, and verify everything works. By the end, your server will send authenticated email that major providers like Gmail and Outlook actually trust.

Prerequisites for Configuring Postfix with OpenDKIM, SPF, and DMARC

Before you start, make sure you have the following in place.

Required access and software:

  • A Ubuntu 22.04 server (20.04 also works)
  • Root or sudo access
  • A fully qualified domain name (FQDN) pointed at your server
  • Access to your domain’s DNS records
  • A static public IP address
  • Port 25 open outbound (check with your VPS provider)

Assumed knowledge: You should be comfortable with the Linux command line and basic DNS concepts like A records and TXT records.

Estimated time: 45–60 minutes.

One important note before you begin. Many cloud providers block port 25 by default. AWS, Google Cloud, and Oracle all do this. You may need to request that restriction be lifted before your server can send mail. Check your provider’s documentation before proceeding.

Also make sure your server’s hostname is set correctly. Run hostname -f and confirm it returns your full domain, like mail.yourdomain.com.

Step-by-Step Guide to Setting Up Postfix, OpenDKIM, SPF, and DMARC on Ubuntu

For a related walkthrough, see: How to Set Up Grafana Loki for Centralized Log Aggregation on Ubuntu Server

Follow each step carefully. Don’t skip ahead , the order matters here.

Step 1: Update your system and install Postfix

Start with a clean package list. Then install Postfix and the mailutils package.

sudo apt update && sudo apt upgrade -y
sudo apt install postfix mailutils -y

During installation, a dialog box appears. Select Internet Site and enter your domain name when prompted.

Step 2: Configure Postfix

Open the main Postfix configuration file.

sudo nano /etc/postfix/main.cf

Update or add these lines. Replace yourdomain.com with your actual domain.

myhostname = mail.yourdomain.com
mydomain = yourdomain.com
myorigin = $mydomain
inet_interfaces = all
inet_protocols = ipv4
mydestination = $myhostname, localhost.$mydomain, localhost
relayhost =
mynetworks = 127.0.0.0/8
smtpd_banner = $myhostname ESMTP
biff = no
append_dot_mydomain = no
milter_protocol = 2
milter_default_action = accept
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

Save and close the file. The last two lines connect Postfix to OpenDKIM, which you’ll set up next.

Step 3: Install and configure OpenDKIM

Install OpenDKIM and its tools.

sudo apt install opendkim opendkim-tools -y

Now edit the OpenDKIM configuration file.

sudo nano /etc/opendkim.conf

Replace the contents with this configuration.

Syslog                  yes
SyslogSuccess           yes
LogWhy                  yes
Canonicalization        relaxed/simple
Domain                  yourdomain.com
Selector                mail
MinimumKeyBits          1024
KeyFile                 /etc/opendkim/keys/yourdomain.com/mail.private
KeyTable                /etc/opendkim/KeyTable
SigningTable            refile:/etc/opendkim/SigningTable
ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts           refile:/etc/opendkim/TrustedHosts
Mode                    sv
PidFile                 /run/opendkim/opendkim.pid
SignatureAlgorithm      rsa-sha256
UserID                  opendkim
Socket                  inet:8891@localhost

Step 4: Create DKIM keys and supporting files

Create the directory for your keys.

sudo mkdir -p /etc/opendkim/keys/yourdomain.com
sudo chown -R opendkim:opendkim /etc/opendkim
sudo chmod go-rw /etc/opendkim/keys

Generate your DKIM key pair.

sudo opendkim-genkey -b 2048 -d yourdomain.com -D /etc/opendkim/keys/yourdomain.com -s mail -v

Fix ownership on the private key.

sudo chown opendkim:opendkim /etc/opendkim/keys/yourdomain.com/mail.private

Now create the KeyTable file.

sudo nano /etc/opendkim/KeyTable

Add this line.

mail._domainkey.yourdomain.com yourdomain.com:mail:/etc/opendkim/keys/yourdomain.com/mail.private

Create the SigningTable file.

sudo nano /etc/opendkim/SigningTable

Add this line.

@yourdomain.com mail._domainkey.yourdomain.com

Create the TrustedHosts file.

sudo nano /etc/opendkim/TrustedHosts

Add these entries.

127.0.0.1
localhost
yourdomain.com

Step 5: Add your DNS records for SPF, DKIM, and DMARC

This is where email authentication actually happens. Log into your DNS provider and add three TXT records.

SPF record , Add this to your root domain (@):

v=spf1 ip4:YOUR_SERVER_IP ~all

Replace YOUR_SERVER_IP with your server’s actual public IP. The ~all means soft fail for anything not listed. You can use -all for a strict hard fail once you’re confident everything is working.

DKIM record , Get your public key first.

sudo cat /etc/opendkim/keys/yourdomain.com/mail.txt

The output shows your DNS TXT record. Add it under the name mail._domainkey.yourdomain.com. Copy the value between the quotes carefully , it’s long.

DMARC record , Add a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Start with p=none to monitor without rejecting mail. You can tighten this to p=quarantine or p=reject later. For a deeper understanding of DMARC policies, see the official DMARC overview at dmarc.org.

Step 6: Restart services and test

Restart OpenDKIM and Postfix to apply all changes.

sudo systemctl restart opendkim
sudo systemctl restart postfix
sudo systemctl enable opendkim
sudo systemctl enable postfix

Send a test email to check your setup. Use a service like mail-tester.com for a quick score and detailed breakdown.

echo "Test email body" | mail -s "Test Subject" [email protected]

A score of 9 or 10 out of 10 means your authentication is working correctly.

Troubleshooting Common Postfix and OpenDKIM Problems

Things don’t always go smoothly. Here are the most common issues and how to fix them.

Emails still going to spam: DNS changes take time to propagate. Wait up to 48 hours before concluding something is broken. Use dig TXT mail._domainkey.yourdomain.com to check if your DKIM record is live.

OpenDKIM not signing mail: Check the logs with sudo journalctl -u opendkim -n 50. A common cause is wrong file permissions on the private key. Run sudo chown opendkim:opendkim /etc/

Similar Posts