Posted inFedora

Self-Hosting a Postfix & Dovecot Mail Server on Fedora: Maximum Security with SSL and SELinux

Fedora tutorial - IT technology blog
Fedora tutorial - IT technology blog

Building a Mail Server on Fedora: From Zero to Hero

I’ve been using Fedora as my primary development machine for over 2 years. The package update speed here is truly satisfying. However, self-hosting a Mail Server is a different story. Much like building a storage ‘Fortress’, many juniors are often hesitant because this system has too many moving parts. You have to handle everything from sending mail (MTA) and receiving mail (MDA) to strict SELinux policies.

Don’t worry too much. If you grasp the data flow, this deployment will be an excellent exercise to level up your sysadmin skills. This article focuses on the classic duo: Postfix and Dovecot.

Which deployment method is optimal?

Before typing any commands, let’s look at 3 popular approaches today:

1. All-in-one Installers

iRedMail or Mail-in-a-Box are typical examples. You get a fully functional system in just a few clicks.

  • Pros: Extremely fast, pre-integrated with SpamAssassin and Roundcube.
  • Cons: Hard to customize. It installs too many redundant packages, making it difficult to control when issues arise.

2. Using Docker

Docker-mailserver is a modern, clean choice.

  • Pros: Easy to back up and migrate between servers.
  • Cons: Networking configuration is quite messy and prone to conflicts with SELinux on Fedora.

3. Manual Installation (The Hard Way)

This is the method I recommend because it offers absolute control.

  • Pros: Best performance optimization, clear understanding of how each service communicates.
  • Cons: Takes about 30-60 minutes for a precise configuration.

By understanding the essence of the third method, you’ll be able to handle any issues on any other distro.

Step 1: DNS Infrastructure – The Key to Avoiding Spam

Updating the system is the first thing to do:

sudo dnf update -y
sudo hostnamectl set-hostname mail.yourdomain.com

To score 10/10 on mail-tester sites, you must have these 3 records:

  • A Record: mail.yourdomain.com pointing to the server IP.
  • MX Record: Points to mail.yourdomain.com with the highest priority (usually 10).
  • PTR Record (Reverse DNS): Extremely important. Contact your VPS provider to map the IP to your domain. Without this, Gmail will reject your emails immediately.

Step 2: Postfix – The Diligent “Mailman”

Postfix is responsible for sending and receiving mail over the Internet. Installing it is simple:

sudo dnf install postfix -y

Open the /etc/postfix/main.cf file and adjust the following lines. Replace yourdomain.com with your actual domain name:

myhostname = mail.yourdomain.com
mydomain = yourdomain.com
myorigin = $mydomain
inet_interfaces = all
inet_protocols = all
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
home_mailbox = Maildir/

I choose Maildir/ instead of mbox. This method saves each email as a separate file, avoiding file-locking errors when receiving thousands of emails simultaneously.

Step 3: Dovecot – The Smart “Mailbox”

Dovecot allows users to retrieve mail to their phones or computers via IMAP/POP3 protocols.

sudo dnf install dovecot -y

You need to handle 3 critical configuration files:

1. Protocols: In /etc/dovecot/dovecot.conf, enable the necessary services:

protocols = imap pop3 lmtp

2. Storage Location: In /etc/dovecot/conf.d/10-mail.conf, point to the correct Maildir format:

mail_location = maildir:~/Maildir

3. Authentication: In /etc/dovecot/conf.d/10-auth.conf, disable unencrypted logins for security:

disable_plaintext_auth = yes
auth_mechanisms = plain login

Step 4: SSL/TLS Encryption – Don’t Let Your Mail Run “Naked”

Sending unencrypted mail is like sending a public postcard. Anyone can eavesdrop on it in transit. If you don’t have a Let’s Encrypt certificate yet, you can temporarily use Fedora’s self-signed certificate.

Configure Dovecot (/etc/dovecot/conf.d/10-ssl.conf):

ssl = required
ssl_cert = </etc/pki/dovecot/certs/dovecot.pem
ssl_key = </etc/pki/dovecot/private/dovecot.pem

Then, force Postfix to use the same certificate in /etc/postfix/main.cf:

smtpd_tls_cert_file = /etc/pki/dovecot/certs/dovecot.pem
smptd_tls_key_file = /etc/pki/dovecot/private/dovecot.pem
smtpd_use_tls = yes

Step 5: Conquering SELinux and the Firewall

This is where 80% of you will encounter errors. Fedora is very security-conscious. If you don’t configure SELinux, Dovecot will be blocked even if you use chmod 777.

Open the service ports on the Firewall (Ports 25, 587, 993, 995):

sudo firewall-cmd --permanent --add-service={smtp,smtps,submission,imap,imaps,pop3,pop3s}
sudo firewall-cmd --reload

Teach SELinux that Postfix and Dovecot are “trusted”:

sudo setsebool -P dovecot_deliver_wildcard_python 1
sudo setsebool -P mail_privileged_view_content 1

Pro tip: If you see a “Permission denied” error, immediately run sealert -a /var/log/audit/audit.log. It will pinpoint exactly why SELinux is unhappy with you.

Step 6: Operation and Testing

Enable the services so they start automatically whenever the server reboots:

sudo systemctl enable --now postfix dovecot

Create a real user for testing:

sudo useradd -m kithuat_pro
sudo passwd kithuat_pro

Now, open Thunderbird, enter the server IP and port 993 (IMAP). If the login is successful, congratulations—you now own a professional Mail Server.

Summary

Building your own Mail Server isn’t just about installing software. It helps you deeply understand security and network data flows. Fedora Server is an extremely solid foundation for this. Don’t forget to monitor the logs at /var/log/maillog daily. You’ll see dozens of brute-force attacks—that’s when you’ll need to learn about Fail2Ban!

Share:
Tags: