karti-ai
551739baa3
- Confirmed core bet via spike/mimecheck: mox/message parses a messy multipart message standalone (envelope, MIME tree, attachment, body) with only an io.ReaderAt — no mox store/config. Option B is viable. - cmd/openmail single binary: serve|migrate|smtpd|sender|version subcommands. - internal/api: chi router, constant-time bearer auth, /healthz, stubbed v0 AgentMail-shaped routes (501 until core services land). - internal/store: pgxpool + embedded, idempotent, tracked SQL migrations. - internal/store/migrations/0001_init.sql: full native schema (pods, inboxes, threads, messages, attachments, drafts, api_keys, webhooks, outbox, events, domains) with FTS + GIN indexes. Validated end-to-end against Postgres 16. - deploy/: docker-compose (postgres+minio+openmail+caddy), Caddyfile, DNS.md (MX/SPF/DKIM/DMARC/DANE/MTA-STS). Makefile, .gitignore. - Verified: go vet clean; build OK; health/auth smoke tests; migrate idempotent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
50 lines
1.8 KiB
Markdown
50 lines
1.8 KiB
Markdown
# DNS for self-hosting OpenMail
|
|
|
|
Replace `example.com` with your domain and `<VPS_IP>` with the server's address.
|
|
OpenMail leans on Mox's `dkim`/`spf`/`dmarc`/`dane`/`mtasts` packages, but the
|
|
DNS records below are operational and must be published by you.
|
|
|
|
## Inbound (receive) — required for milestone 2
|
|
|
|
```
|
|
; route mail for the domain to this server
|
|
example.com. MX 10 mail.example.com.
|
|
mail.example.com. A <VPS_IP>
|
|
mail.example.com. AAAA <VPS_IPv6> ; if available
|
|
|
|
; reverse DNS (PTR) — set at your VPS provider, must resolve mail.example.com
|
|
<VPS_IP> -> mail.example.com
|
|
```
|
|
|
|
## Outbound (send) — deliverability, milestone 3/5
|
|
|
|
```
|
|
; SPF — authorize this server to send for the domain
|
|
example.com. TXT "v=spf1 ip4:<VPS_IP> -all"
|
|
|
|
; DKIM — publish the public key for the selector OpenMail signs with
|
|
<selector>._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=<BASE64_PUBLIC_KEY>"
|
|
|
|
; DMARC — start at quarantine, tighten to reject after monitoring
|
|
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=s; aspf=s"
|
|
```
|
|
|
|
## Secure transport — recommended (Mox supports both)
|
|
|
|
```
|
|
; MTA-STS — publish policy + serve https://mta-sts.example.com/.well-known/mta-sts.txt
|
|
_mta-sts.example.com. TXT "v=STSv1; id=20260621000000"
|
|
mta-sts.example.com. A <VPS_IP>
|
|
|
|
; DANE/TLSA — pin the TLS cert for port 25 (requires DNSSEC on the zone)
|
|
_25._tcp.mail.example.com. TLSA 3 1 1 <SHA256_OF_CERT_SPKI>
|
|
```
|
|
|
|
## Notes
|
|
|
|
- Many cloud providers block outbound port 25 by default — confirm your VPS allows
|
|
it (or request an unblock) before milestone 2/5.
|
|
- DANE/TLSA requires DNSSEC on the zone; skip it if your DNS host lacks DNSSEC and
|
|
rely on MTA-STS instead.
|
|
- Warm a new sending IP gradually; reputation is the real deliverability cost.
|