邮件系统配置资源

# ============================================================
# Postfix main.cf — 生产级邮件服务器配置模板
# 适用场景：单节点到万级并发 | 基于 Postfix 3.x
# ============================================================

# --- 基础设置 ---
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
inet_interfaces = all
inet_protocols = ipv4

# --- 域名与投递 ---
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mynetworks = 127.0.0.0/8
relay_domains =

# --- 邮箱与别名 ---
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
home_mailbox = Maildir/
mailbox_command =

# --- TLS 加密 (RFC 8446 TLS 1.3) ---
smtpd_tls_cert_file = /etc/ssl/certs/mail.example.com.pem
smtpd_tls_key_file = /etc/ssl/private/mail.example.com.key
smtpd_use_tls = yes
smtpd_tls_security_level = may
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_ciphers = high
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_eecdh_grade = auto
smtp_tls_security_level = may
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1

# --- SASL 认证 (Dovecot) ---
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = noanonymous
broken_sasl_auth_clients = yes

# --- 速率限制 ---
anvil_rate_time_unit = 60s
smtpd_client_connection_rate_limit = 30
smtpd_client_message_rate_limit = 20
smtpd_client_recipient_rate_limit = 50

# --- 反垃圾与反病毒 ---
smtpd_milters = inet:127.0.0.1:11332
milter_default_action = accept
milter_protocol = 6

# --- 消息大小限制 (RFC 5321 §4.5.3.1) ---
message_size_limit = 26214400
mailbox_size_limit = 0

# --- 队列管理 ---
queue_directory = /var/spool/postfix
bounce_queue_lifetime = 5d
maximal_queue_lifetime = 5d
maximal_backoff_time = 4000s
minimal_backoff_time = 300s

# --- 性能调优 ---
default_process_limit = 100
smtp_destination_concurrency_limit = 20
local_destination_concurrency_limit = 2
# 4GB+ 内存建议:
# default_process_limit = 200
# smtp_destination_concurrency_limit = 50

# ============================================================
# Dovecot 2.3.x — 高性能 IMAP/POP3/LMTP 配置
# 适用场景：万级用户并发 | 基于 Dovecot Wiki
# ============================================================

# --- 协议 ---
protocols = imap pop3 lmtp
listen = *

# --- 基础路径 ---
base_dir = /var/run/dovecot/
mail_location = maildir:~/Maildir

# --- SSL/TLS ---
ssl = required
ssl_cert = 

-- ============================================================
-- Rspamd 3.x — 反垃圾引擎核心配置 (local.d/)
-- 基于 Rspamd Official Documentation
-- ============================================================

-- Redis 后端
redis {
  servers = "127.0.0.1:6379";
  timeout = 1.0;
  password = "${REDIS_PASSWORD}";
}

-- Bayes 统计分类器
classifier "bayes" {
  tokenizer {
    name = "osb";
  }
  min_tokens = 11;
  min_learns = 50;
  autolearn = true;
  statfile {
    spam = true;
    symbol = "BAYES_SPAM";
  }
  statfile {
    spam = false;
    symbol = "BAYES_HAM";
  }
  per_language = true;
}

-- DKIM 验证模块
dkim {
  allow_unsigned = false;
  allow_bodyless = true;
}

-- DMARC 验证模块
dmarc {
  reporting = true;
  report_settings {
    rua = "dmarc@example.com";
  }
}

-- SPF 验证模块
spf {
  allow_tempfail = false;
}

-- Milter 设置
worker "rspamd_proxy" {
  bind_socket = "127.0.0.1:11332";
  milter = yes;
  timeout = 120s;
  upstream "local" {
    default = yes;
    self_scan = yes;
  }
  count = 2;
  max_requests = 200;
}

-- Normal worker
worker "normal" {
  bind_socket = "127.0.0.1:11333";
  count = 4;
  enabled = true;
}

-- Controller (Web UI)
worker "controller" {
  bind_socket = "127.0.0.1:11334";
  count = 1;
  secure_ip = "127.0.0.1";
  secure_ip = "::1";
  static_dir = "${WWWDIR}";
}

邮件 DNS 配置上线 Checklist
============================================================

[ ] A 记录 — 邮件服务器主机名 → IP
    验证: dig A mail.example.com
    标准: RFC 1035

[ ] MX 记录 — 域名 → 邮件服务器（≥2 条，不同优先级）
    验证: dig MX example.com
    标准: RFC 5321 §5, RFC 7505（null MX）

[ ] PTR 记录 — IP → 邮件服务器主机名（正向/反向一致）
    验证: dig -x 
    标准: RFC 1912 §2.1

[ ] SPF 记录 — TXT "v=spf1 ... ~all"
    验证: dig TXT example.com | grep spf
    标准: RFC 7208

[ ] DKIM 记录 — ._domainkey TXT 公钥
    验证: dig TXT default._domainkey.example.com
    标准: RFC 6376 §3.6.2.2

[ ] DMARC 记录 — _dmarc TXT "v=DMARC1; p=..."
    验证: dig TXT _dmarc.example.com
    标准: RFC 7489

[ ] BIMI 记录 — default._bimi TXT（可选，需 p=reject/quarantine）
    验证: dig TXT default._bimi.example.com
    标准: RFC 9608

[ ] MTA-STS — _mta-sts TXT + HTTPS 策略文件（推荐）
    验证: dig TXT _mta-sts.example.com
         curl https://mta-sts.example.com/.well-known/mta-sts.txt
    标准: RFC 8461

[ ] TLS-RPT — _smtp._tls TXT 报告地址
    验证: dig TXT _smtp._tls.example.com
    标准: RFC 8460

[ ] DNSSEC — 域名注册商处启用
    验证: dig DNSKEY example.com
    标准: RFC 9364 (BCP 237)

[ ] DANE — _25._tcp. TLSA 记录（需 DNSSEC）
    验证: dig TLSA _25._tcp.mail.example.com
    标准: RFC 7672 §3

上线后验证命令：
  echo | openssl s_client -starttls smtp -connect mail.example.com:25
  swaks --to check@example.com --server mail.example.com
  python3 -c "import smtplib; smtplib.SMTP('mail.example.com', 25).ehlo()"

邮件系统迁移 Checklist
============================================================

阶段 1: 准备 (迁移前 2 周)
[ ] 目标服务器操作系统安装与加固
[ ] Postfix + Dovecot + Rspamd 安装
[ ] 目标域 DNS 低优先级 MX 预配置（如 MX 20）
[ ] 防火墙规则（25/465/587/993/995 端口）
[ ] SSL 证书申请/导入
[ ] 用户账号同步（LDAP 或批量创建）

阶段 2: 数据迁移 (迁移前 1 周)
[ ] imapsync 测试迁移 5 个测试账号
    命令:
    imapsync --host1 source.example.com --user1 test@example.com \
             --password1 'SRC_PASS' \
             --host2 mail.example.com --user2 test@example.com \
             --password2 'DST_PASS' --ssl1 --ssl2

[ ] 验证：对比源/目标邮箱邮件数和文件夹结构
[ ] 全量用户批量迁移（imapsync 循环脚本）
[ ] 增量同步（迁移日当天重复执行）

阶段 3: 切换 (迁移日)
[ ] 暂停源服务器收发（维护窗口）
[ ] 最后增量同步
[ ] DNS 切换：MX 优先级调高（如 MX 10）
[ ] 等待 TTL 过期（通常 ≤1 小时）
[ ] 验证：发送测试邮件到外部邮箱
[ ] 验证：从外部发送到域名下新邮箱

阶段 4: 回滚预案
[ ] 保留源服务器 7 天
[ ] 如失败：DNS MX 优先级调回原服务器
[ ] 等待 TTL 过期
[ ] 增量回迁未收到的邮件

阶段 5: 后续 (迁移后 1 周)
[ ] 监控邮件队列 (mailq / qshape)
[ ] 检查 Rspamd 统计（垃圾率/误判率）
[ ] 检查 SNDS/Postmaster Tools 信誉
[ ] 源服务器关闭/销毁
[ ] 更新文档