如何为GCE托管域名配置本地Debian代收发邮件？技术求助

Alright, let's get your Debian server handling mail for blablabla.com while keeping your web host on GCE. Here's a step-by-step breakdown that'll make this work smoothly:

First, you need to tell the internet where to send emails for blablabla.com. Log into your domain registrar's DNS management panel and make these changes:

• A Record: Create (or update) a record for mail.blablabla.com pointing to your Debian server's public IP address. Make sure this IP is static—if it's dynamic, use a dynamic DNS service to keep the record updated automatically.
• MX Record: Set the primary MX record for blablabla.com to mail.blablabla.com with a priority of 10 (lower numbers mean higher priority). Remove any existing MX records pointing to your GCE instance.
• SPF Record: Add a TXT record for blablabla.com with value v=spf1 mx a ~all—this helps prevent your outgoing emails from being marked as spam by external providers.

Debian Squeeze is an older release, but Postfix + Dovecot still works reliably for basic mail sending and receiving.

Install Required Packages #

Run these commands as root:

apt-get update
apt-get install postfix dovecot-common dovecot-pop3d dovecot-imapd

When prompted for Postfix configuration, select "Internet Site" and enter blablabla.com as the system mail name.

Configure Postfix (SMTP for Sending/Receiving) #

Edit the main Postfix config file:

nano /etc/postfix/main.cf

Update these key settings to match your domain:

myhostname = mail.blablabla.com
mydomain = blablabla.com
myorigin = $mydomain
inet_interfaces = all  # Listen on all network interfaces to accept incoming mail
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
relayhost =  # Leave blank—we don't need a third-party relay for outgoing mail
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

Save the file and restart Postfix to apply changes:

/etc/init.d/postfix restart

Configure Dovecot (POP3/IMAP for Retrieving Mail) #

Edit Dovecot's main configuration file:

nano /etc/dovecot/dovecot.conf

Ensure these lines are set correctly:

protocols = pop3 imap
mail_location = maildir:~/Maildir

Restart Dovecot to activate the settings:

/etc/init.d/dovecot restart

Open Firewall Ports #

Your Debian server needs to allow incoming traffic on standard mail ports. If you're using iptables, run these commands:

iptables -A INPUT -p tcp --dport 25 -j ACCEPT  # Allow SMTP for incoming mail
iptables -A INPUT -p tcp --dport 110 -j ACCEPT # Allow POP3 for mail retrieval
iptables -A INPUT -p tcp --dport 143 -j ACCEPT # Allow IMAP for mail retrieval
# Save rules to persist after reboot
iptables-save > /etc/iptables/rules.v4

Since mail is now delegated to your Debian server, disable any mail services running on GCE to avoid conflicts:

systemctl stop postfix
systemctl disable postfix

If you had any mail forwarding rules or aliases set up on GCE, remove those as well to ensure no stray mail routing occurs.

Verify everything works end-to-end:

• Receive test mail: Send a message from an external email (like Gmail) to your-user@blablabla.com. Check if it arrives in the user's ~/Maildir on Debian (use the mail command or an IMAP/POP3 client to access it).
• Send test mail: Log into Debian, run mail external-recipient@gmail.com, type a subject and message, then press Ctrl+D to send. Confirm it lands in the recipient's inbox (not spam).
• Fix spam issues: If outgoing emails go to spam, add a DKIM record to your DNS. Install opendkim on Debian, generate encryption keys, and add the public key as a TXT record for default._domainkey.blablabla.com.

• Static IP Requirement: Your Debian server must have a static public IP (or dynamic DNS) to avoid broken mail delivery when your IP changes.
• ISP Port Blocking: Some ISPs block port 25 to curb spam. If you can't receive incoming mail, contact your ISP to unblock port 25—using a relay service would alter the "source" appearance of your mail, which defeats your goal of presenting the Debian server as the mail provider.
• Security Best Practices: Keep your Debian packages updated, add SASL authentication to Postfix to prevent unauthorized use, and enable SSL/TLS for mail connections to encrypt traffic.

内容的提问来源于stack exchange，提问作者E.Keeya