Files

T

karti-ai 551739baa3 Milestone 1 scaffold: binary skeleton, schema, deploy, Mox spike

- Confirmed core bet via spike/mimecheck: mox/message parses a messy multipart
  message standalone (envelope, MIME tree, attachment, body) with only an
  io.ReaderAt — no mox store/config. Option B is viable.
- cmd/openmail single binary: serve|migrate|smtpd|sender|version subcommands.
- internal/api: chi router, constant-time bearer auth, /healthz, stubbed v0
  AgentMail-shaped routes (501 until core services land).
- internal/store: pgxpool + embedded, idempotent, tracked SQL migrations.
- internal/store/migrations/0001_init.sql: full native schema (pods, inboxes,
  threads, messages, attachments, drafts, api_keys, webhooks, outbox, events,
  domains) with FTS + GIN indexes. Validated end-to-end against Postgres 16.
- deploy/: docker-compose (postgres+minio+openmail+caddy), Caddyfile, DNS.md
  (MX/SPF/DKIM/DMARC/DANE/MTA-STS). Makefile, .gitignore.
- Verified: go vet clean; build OK; health/auth smoke tests; migrate idempotent.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-21 12:16:51 -07:00

1.8 KiB

Raw Blame History

DNS for self-hosting OpenMail

Replace example.com with your domain and <VPS_IP> with the server's address. OpenMail leans on Mox's dkim/spf/dmarc/dane/mtasts packages, but the DNS records below are operational and must be published by you.

Inbound (receive) — required for milestone 2

; route mail for the domain to this server
example.com.        MX   10 mail.example.com.
mail.example.com.   A    <VPS_IP>
mail.example.com.   AAAA <VPS_IPv6>        ; if available

; reverse DNS (PTR) — set at your VPS provider, must resolve mail.example.com
<VPS_IP>  ->  mail.example.com

Outbound (send) — deliverability, milestone 3/5

; SPF — authorize this server to send for the domain
example.com.   TXT   "v=spf1 ip4:<VPS_IP> -all"

; DKIM — publish the public key for the selector OpenMail signs with
<selector>._domainkey.example.com.   TXT   "v=DKIM1; k=rsa; p=<BASE64_PUBLIC_KEY>"

; DMARC — start at quarantine, tighten to reject after monitoring
_dmarc.example.com.   TXT   "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=s; aspf=s"

Secure transport — recommended (Mox supports both)

; MTA-STS — publish policy + serve https://mta-sts.example.com/.well-known/mta-sts.txt
_mta-sts.example.com.   TXT   "v=STSv1; id=20260621000000"
mta-sts.example.com.    A     <VPS_IP>

; DANE/TLSA — pin the TLS cert for port 25 (requires DNSSEC on the zone)
_25._tcp.mail.example.com.   TLSA   3 1 1 <SHA256_OF_CERT_SPKI>

Notes

Many cloud providers block outbound port 25 by default — confirm your VPS allows it (or request an unblock) before milestone 2/5.
DANE/TLSA requires DNSSEC on the zone; skip it if your DNS host lacks DNSSEC and rely on MTA-STS instead.
Warm a new sending IP gradually; reputation is the real deliverability cost.

1.8 KiB Raw Blame History