System Architecture & Technical Guide

1. Active Directory (LDAP) Integration Model

Postfix and Dovecot communicate directly with Microsoft Windows Active Directory Domain Controllers over LDAP (Port 389) for recipient validation, user authentication, and alias resolution.

Active Directory Configuration Rules:

Account Casing: AD user logon names (sAMAccountName) MUST be lowercase (e.g. 520001 or john), as Dovecot queries in lowercase.
Email Address (mail attribute): Fill in the full email address in the user's mail attribute (e.g. john@example.com). Logon account and email can be different.
Group Aliases (ALIASES): Create an AD Group, set its mail attribute to the alias email address, and add member user accounts to this group.
Local Domain Only (local_only): Set the description attribute to local_only on an AD User or Group to restrict messaging to local domain only.

2. Mail Filtering & Security Pipeline

Every email is inspected by a coordinated milter pipeline comprising Rspamd, ClamAV antivirus, and OpenDKIM signing before local mailbox delivery.

Rspamd Web UI & Administration:

URL: http://<host-ip>:11334 (Default password: kafeiou.pw)
Change Password: Run docker exec -it mailserver rspamadm pw --encrypt -p <new_password> and update /etc/rspamd/local.d/worker-controller.inc.
Spam Redirection (SPAM_EMAIL): Quarantined spam is automatically rerouted to the configured admin spam mailbox.

3. SSL/TLS Certificate & Let's Encrypt Automation

Out-of-the-box readiness via self-signed fallback certificates, coupled with official Let's Encrypt DNS-01 host volume mapping.

Host Certbot DNS-01 Step-by-Step Guide:

# 1. Install Certbot on Host
sudo apt install certbot    # Debian / Ubuntu
sudo dnf install certbot    # RHEL / Rocky Linux

# 2. Issue Certificate via DNS-01 Challenge (No port 80 required)
sudo certbot certonly --manual --preferred-challenges dns -d mail.example.com -d example.com

# 3. Reload Container SSL Services
docker exec -it mailserver postfix reload
docker exec -it mailserver dovecot reload

4. DKIM & SPF Digital Signature Configuration

Ensure high email deliverability and combat spoofing by configuring OpenDKIM keys and public DNS TXT records.

Step 1: Enable OpenDKIM Milter in Container

# Enter container
docker exec -it mailserver bash

# Uncomment milter settings in /etc/postfix/main.cf:
smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = $smtpd_milters
milter_default_action = accept

# Reload Postfix
postfix reload

Step 2: Generate Multi-Domain Keys (/getOpenDKIM.sh)

# Edit /getOpenDKIM.sh to add your domains:
domains=( 'example.com' 'example2.com' )

# Run the script:
/getOpenDKIM.sh

Step 3: Add DNS TXT Records

Record Type	Host / Name	Value
SPF (TXT)	`@` (or domain)	`v=spf1 ip4:<YOUR_SERVER_PUBLIC_IP> mx ~all`
DKIM (TXT)	`default._domainkey`	`v=DKIM1; k=rsa; p=<PUBLIC_KEY_FROM_default.txt>`
DMARC (TXT)	`_dmarc`	`v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com`

5. Email-Driven Auto-Reply & Vacation Responder

For environments without Webmail, users can easily configure Vacation / Out of Office auto-replies simply by sending an email command to themselves.

How to Use Auto-Reply:

📅 Date Range Mode (UTC+8 / Asia/Taipei)

Send email to yourself with date range. Automatically expires when period ends.

To: your_email@example.com
Subject: #autoreply 2026-08-25 ~ 2026-08-30 Out of Office
Body: Hello, I am currently out of office until Aug 30.

⚡ Always On / Turn Off Mode

Turn on indefinitely or cancel immediately.

# Turn on:
Subject: #autoreply on Business Trip
Body: I am on business trip.

# Turn off immediately:
Subject: #autoreply off