encoding from different mail clients using mailcow as mail server

esackbauer What is the receiving side using?

Do you mean where I sent the email to?

1. kabelbw.de
2. mailbox.org

During several investigations I’m facing another problem with the DKIM key. No matter if composing email form build-in sogo or any desktop email client, any email I send does not pass the DKIM check.

Messages are:

User-Agent: Mozilla Thunderbird:
dkim=fail (2048-bit key) reason=“fail (message has been altered)”

or:
User-Agent: SOGoMail 5.9.0
dkim=fail (2048-bit key) reason=“fail (message has been altered)”

Hmm. Don’t know this from my other mail servers…? What’s wrong?

Here’s an email from nethserver:

dkim=pass (2048-bit key)
From: =?utf-8?q?x=2E_y?= <x@y>
Content-Type: text/plain; charset=“utf-8”
Reply-To: x@y.de
X-Forward: 10.0.0.3 <– VPN wireguard / did all tests through VPN
Date: Sat, 11 Nov 2023 00:15:50 +0100
To: x@mailbox.org
MIME-Version: 1.0
Message-ID: <67de-654eb980-3-4e050400@215156844>
Subject: test
User-Agent: SOGoMail 5.9.0
Content-Transfer-Encoding: quoted-printable

Looks clean. I’m pretty sure that I followed the mailcow-dockerized how-to setup. I’m able to send and receive emails. BUT - character encoding does not work, AND DKIM fails.

So?

Resume:

In a VM, debian 12, hosted on proxmox, no firewall on proxmox, VM in a company LAN behind OPNsense, german umlaute are not processed from mailcow-dockerized, and DKIM is false. Receiving and sending emails is working. On the OPNsense no reverse proxy is configured. Let’s encrypt certs are handled by acme-plugin from the OPNsense and are copied via cron job to the VM. Access to mailcow-dockerized via FQHN in LAN is working flawless. Only open port(s) redirected from LAN to WAN are 80 and 443. The mailcow is not intended to be accessable from WAN. Only via wireguard VPN.

From a laptop at home, on top of archlinux, no issues.

As I intend to substitute a company email server (nethserver 7) with mailcow-dockerized, I need help where to investigate.

Any help would be greatly appreciated.

Every DNS (port 53) request from the VM with mailcow (the whole LAN) is redirected to the OPNsense unbound. BTW unbound-mailcow shows healthy status. And port 53 is open.

For email the only open port is 25. All other ports (as in the docs described) are only allowed in the LAN. The mailserver is meant for internal access. No public access at all.

May I ask if you have mailcow-dockerized running in a VM? If so, qemu, virtualbox, proxmox, …? What host OS?

For the prerequisites, what could be wrong? I mean, on my laptop at home I did the same as in the VM. Except that at home the host in archlinux and not a VM based on debian 12.

Well, I can try with another host OS for the VM. Have you got a special recommendation?

Thanks to anybody following.

The last 4 days I took time for some tests and investigations. All tests are based on proxmox 7.4.-17. Proxmox is running on a HP Proliant ML30, enough cpu and ram for any test.

First try was to build a VM based on debian 12, minimal net-install as a server. HD 60 GB, RAM 8 GB, rest default hardware, network bridged. No firewall on the proxmox enabled. In front of the network is an OPNsense, the debian VM got a static IP with ARP mapping. The OPNsense nor proxmox is configured as MTA. No reverse proxy is running on the OPNsense. The mailserver is not intended to be accessable from the WAN, only via VPN or LAN. I created the records in the DNS. On the OPNsense itself is running unbound as DNS. All DNS traffic in the LAN is routed through the OPNsense. As pre-requisites on the OPNsense, I opened the port 80 (acme challenge) for the VM in the OPNsense, and created also a rule for all needed ports in the LAN for the VM.

I followed the install instructions, mailcow came up and was running. The acme challenge didn’t work, I assume a reverse proxy would be needed. The workaround was to disable the letsencrypt part in mailcow, get the cert via OPNsense and copy and rename the certs to the given path from the docs to the mailcow.

I configured a domain a few mailboxes, an alias, copied the dkim key to the DNS, and made a backup the the helper script. I started to send a few emails from sogo to kabelbw.de and mailbox.org, and vice versa. That seemed to work with no errors. The test emails had no signature or system wide footer. Emails ALWAYS sent as PLAIN TEXT, NO html email.

I created an account in thunderbird, now with signature and german umlaute äüöß, … Did the same in sogo. This leads to: dkim=fail (2048-bit key) reason=“fail (message has been altered)”

I deleted the signatures and resent a simple test email. Still dkim fails. I double checked with DKIM, SPF, and Spam Assassin Validator - dkimvalidator.com

dkimvalidator.com

DKIM, SPF, and Spam Assassin Validator - dkimvalidator.com

I created a signature in sogo and a system wide footer. DKIM went false.

I started over with a second VM based on Rocky linux DVD. Configuration in proxmox mainly the same, except the CPU. I tried to restore the mailcow backup I made from the debian VM to save some time. That did not work. Emails stayed encrypted. I did a full restore. Nevertheless I started over to configure mailcow in Rocky linux, at this point I cut it down. Same behaviour and results as in the debian VM.

As I already wrote, I installed mailcow-dockerized also on my laptop, based OS archlinux. In my home-network there’s a consumer asus router/firewall. For the test I configured a port forwarding for the acme challenge in the router. I took another domain name, configured the DNS, so far mailcow is working with no errors.

I’ve another email-server in a network. Also running on proxmox in a VM, bridged network. This server (Nethserver 7) is not containerized. Also an OPNsense as FW in front. Email is working for years flawlessly. No dkim errors. This server even completes the acme challenge every 90 days. Same with an koozali (formerly mitel e-smith) server. No errors at all.

Therefore my questions:

• is mailcow intended for production use in a company network (LAN, centralized/redirected DNS, ActiveDirectory), NOT intended to be accessable from WAN?
• anybody with a similar setup as from me described (signature/domain wide footer with german UMLAUTE, plain text) where dkim passes?
• where could I possibly have made a mistake?

I’d like to seperate my email-servers from the file servers, therefore I’m looking for a suitable solution for production use.

Is an already proper installed and running opendkim service a prerequisite before installing mailcow-dockerized?

More or less a guess. What else can I do as to copy’n paste the dkim key from mailcow to my DNS? I think there is no mistake. I’d like to know, what causes the dkim failure in DKIM, SPF, and Spam Assassin Validator - dkimvalidator.com

dkimvalidator.com

DKIM, SPF, and Spam Assassin Validator - dkimvalidator.com

Validating Signature

result = fail
Details: bad RSA signature

To the question of running filters on the OPNsense. No, not for outgoing email, afaik.

Getting closer. Your guess might lead in the right direction. Thank you for pointing to the records.

I did a dkim check in another tool. mxtoolbox does indeed show a different record as dkimvalidator.com. And here we go - mail-tester.com and mxtoolbox are identical. And correct.

So, for the DKIM it’s a dkimvalidator and cache/update problem. Thank you so far.

Now I will try to find the error with the umlaute problem. I’ll keep investigating.