## 1. DNS Records
First Find your public IP at [ifconfig.me](https://ifconfig.me/) or
```
curl ifconfig.me
```
---
- *tip: Set TTL to 60 seconds initially, to verify settings and mail sending/receiving, after that increase to 3600 or more.*
- later in Mail server security, we will also generate public key for DKIM record.
| Name | Type | Value | TTL | Priority | Comment |
| --------------- | ----- | ---------------------------------------------------- | --- | -------- | -------------------- |
| home | A | 111.222.33.44 | 60 | | My public IP at home |
| mail | CNAME | home.example.com. | 60 | | Synology mail |
| | MX | mail.example.com. | 60 | 10 | Synology mail |
| | TXT | v=spf1 mx -all | 60 | | Synology mail |
| dkim._domainkey | TXT | v=DKIM1; k=rsa; p=<public_key> | 60 | | Synology mail |
| _dmarc | TXT | v=DMARC1; p=none; rua=mailto:[email protected]; fo=1 | 60 | | Synology mail |
| _smtp._tls | TXT | v=TLSRPTv1; rua=mailto:[email protected] | 60 | | Synology mail |
## 2. Port forwarding on the Router
1. Log in to the administration (usually `192.168.0.1` or `tplinkwifi.net`).
2. Find the **NAT Forwarding → Virtual Servers** section (sometimes called **Port Forwarding**).
3. Add rules for **TCP ports**:
The ISP may block ports, so for a viability test, just map port 25 and verify immediately with the following. If it works, continue with rest.
```
PS> Test-NetConnection <your_public_ip> -Port 25
```
| Service Name | Device IP Address | External Port | Internal Port | Protocol |
| ---------------- | ----------------- | ------------- | ------------- | -------- |
| HTTP ** | 192.168.x.x * | 80 | 80 | TCP |
| Mail: SMTP | 192.168.x.x | 25 | 25 | TCP |
| Mail: Submission | 192.168.x.x | 587 | 587 | TCP |
| Mail: POP3S | 192.168.x.x | 995 | 995 | TCP |
- *Note, SMTPS 465 (Submission) and IMAP 993 are optional and for different use case.*
- *POP3 downloads the email from server (keep or remove)*
- *IMAP operates remotely on the server*
\* Replace `192.168.x.x` with the actual internal IP address of the NAS (found in DSM → **Control Panel → Network → Network Interface**), or in Router.
\*\* Keep 80 disabled for security and only enable it for Certificate acquisition.
## Synology NAS
### 3. MailPlus Server
1. Open **Package Center**
- Install **Synology Mail Server**
- After installation proceed to set up a [[#Certificate]], then continue
- Launch the mail server app:
2. **SMTP**
- *Enable* **SMTP**
- **Account type: Enable SMTP Authentication**
- **Hostname (FQDN):** `mail.example.com`
- *note: needs to match PTR (reverse DNS)*
- **Additional Domain:** *(optional)*
- **Port:** 25
- **Maximum size per email (MB):** 25 MB
- *Enable* **SMTP-SSL (port 465)**
- *Enable* **SMTP-TLS (port 587)**
- **SMTP Relay:** *(optional, recommended)*
- Necessary when port 25 is blocked
- Recommended to solve outbound messages flagged as spam or rejected
- Use for example https://www.smtp2go.com/, which has generous free tier and best on the market deliverability (98%). You must use your custom domain mail to apply, so you first need to make receiving emails working.
- ***Note***: When you use Forwarding and a Relay, all inbound emails: 1) will also get forwarded via the Relay and not from the NAS itself any more, which will count towards your usage limit, 2) or potentially even get blocked altogether, because of spf mismatch. When you use Relay, **you must switch from Forwarding to POP3** to fetch your emails. This has an added benefit, that the pop3 fetched emails won't have any changes to their headers, unlike forwarded emails.
3. **Security**
1. **SPF** *(optional)*
- *inbound, verify sender identity and detect forged sender address*
- because we are forwarding mails, the receiving service will do their own SPF validation
- Disable **Reject SPF softfail**
2. *Enable* **DKIM**
- *sign outbound messages and validate inbound messages signatures*
- **selector prefix**: `dkim`
- press `[Generate]` and put the generated **Public Key** into [[#DNS Records]]
3. **DMARC** *(optional)*
- *inbound, validate senders' email domains*
- because we are forwarding mails, the receiving service will do their own DMARC validation
4. Proceed to section [[#Verify settings]] and then continue
5. **Alias**
Configure receiving and sending identities, their aliases and forwarding addresses.
- note: Make sure that in **Personal**, this setting is disabled
- turn ***OFF*** "**Enable Auto-Forwarding**"
- This is because this option forwards **everything** to one mailbox.
1. Create your "*master*" alias
- **Alias name**: `qwerty`
- This is the main mailbox e.g. `[email protected]`
- Configure this when **forwarding**
- **External mailbox**: `[email protected]`
- This is the mailbox that receives the forwarded inbound messages
- **User / Group**: (*optional*)
- Choose which DSM users or groups can send from this identity, leave for all
- Configure this when **fetching** mail with **POP3** or IMAP
- **External mailbox**: ***empty***
- **User / Group**: `Qwerty`
- Choose which DSM users or groups can send AND fetch from this identity
2. Create the other aliases
- **Alias name**: `me`
- **External mailbox**: ***empty***
- **Alias**: qwerty
3. Repeat 2) for other aliases
4. Repeat from 1) for other mailboxes (POP3) or forwarding targets; e.g. second mailbox, wife, kids, etc.
5. Create a "*master*" service account `[email protected]` with aliases `dmarc`, `abuse` and `tlsrpt`
- *dmarc*: receives aggregated reports (xml), who sends from your domain
- *tlsrpt*: report of problems with encrypted communication - quick detection of misconfiguration and regulatory compliance
- *abuse*: domain credibility and abuse/spam complaints
### 4. Certificate
1. Open **Control Panel → Security → Certificate**
2. `[Add]` → Add a new certificate → Get a certificate from Let's Encrypt
- **Domain name**: `mail.example.com`
- *Note: You will need to forward port 80 for the acquisition.*
3. `[Settings]` → **Configure**
- Assign the certificate to Mail services
### 5. Verify settings
1. DNS
- Use https://toolbox.googleapps.com/apps/dig/ to verify DNS records
```
dig MX example.com
dig TXT example.com # SPF
dig TXT dkim._domainkey.example.com
dig TXT _dmarc.example.com
```
1. SMTP reply
- test from outside of your network
```
openssl s_client -starttls smtp -connect mail.example.com:587
```
3. Forwarding emails
1. Send mail from "outside" mail to your email `[email protected]`.
2. Verify
- NAS log for a received mail
## 6. Mail client
You have three options:
1) Use forwarding to `[email protected]` and only add SMTP server to be able to "Send as" from your domain. No emails are retained on the NAS.
2) Use SMTP AND POP3 on `[email protected]` to fetch emails and "Send as". No emails are retained on the NAS.
3) Keep the mails on your NAS and use web interface on the NAS
- You can also connect via IMAP/POP3 with your favorite mail client
#### Thunderbird *(sending)*
Add new Outgoing Server (SMTP) / Identity
- **Server**: `mail.example.com`
- **Port**: 587
- **Connection security**: STARTTLS
- **Authentication method**: Normal password
- This will be your DSM password
- **Username**: `Qwerty`
- Your DSM user login
#### Gmail *(sending and receiving)*
Settings → See all settings → Accounts and Import → Check email from other accounts → Add an email account
1. **Email address**: `[email protected]`
2. Import emails from my other account (POP3)
3. - **Username**: `Qwerty` *- your DSM account*
- **Password**: *your DSM account*
- **POP Server**: `mail.example.com`
- **Port**: 995
- *Enable*: **Always use a secure connection**
- *\*don't Leave a copy on the server, don't Label, don't Archive*
4. Yes, I want to be able to send mail as [email protected]
5. *Enable* **Treat as an alias**
6. - **SMTP Server**: `mail.example.com`
- **Port**: 587
- **Username**: `Qwerty` *- your DSM account*
- **Password**: *your DSM account*
- *Enable*: **Secure connection using TLS**
7. Confirm email via link
8. When confirmed, go to *Accounts and Import → Send mail as*
- Make **default**
- *Enable*: **Reply from the same address to which the message was sent**
*Note, fetch frequency depends on usage, however, clicking the Refresh button at the top of the inbox will also fetch messages from any POP accounts.*
## TODO
- Change `_dmarc.` record value from `p=none` to `p=quarantine` and then `p=reject`
- **MTA-STS** (`mta-sts.example.com` + TXT + HTTPS policy file) = policy enforcement.
- Tells other MTAs _“you must deliver with TLS to these MX hosts”_.
- If misconfigured, and the sending MTA respects MTA-STS, it may defer or bounce mail.
- first in `mode=testing`, then `mode=enforce`
