Add null SPF, DMARC, and MX records for automatically generated autoconfig, autodiscover, and mta-sts subdomains; add null MX records for custom A-record subdomains
All A/AAAA-resolvable domains that don't send or receive mail should have these null records.
This simplifies the handling of domains a bit by handling automatically generated subdomains more like other domains.
* Migrate to the ECDSAP256SHA256 DNSSEC algorithm. If a DS record is set for any of your domain names that have DNS hosted on your box, you will be prompted by status checks to update the DS record.
Mail:
* Roundcube's login cookie is updated to use a new encryption algorithm (AES-256-CBC instead of DES-EDE-CBC).
DNS:
* The ECDSAP256SHA256 DNSSEC algorithm is now available. If a DS record is set for any of your domain names that have DNS hosted on your box, you will be prompted by status checks to update the DS record at your convenience.
* Null MX records are added for domains that do not serve mail.
records.append((qname,rtype,value,"(Set by user.)"))
# Add defaults if not overridden by the user's custom settings (and not otherwise configured).
# Add A/AAAA defaults if not overridden by the user's custom settings (and not otherwise configured).
# Any CNAME or A record on the qname overrides A and AAAA. But when we set the default A record,
# we should not cause the default AAAA record to be skipped because it thinks a custom A record
# was set. So set has_rec_base to a clone of the current set of DNS settings, and don't update
# during this process.
has_rec_base=list(records)
a_expl="Required. May have a different value. Sets the IP address that %s resolves to for web hosting and other services besides mail. The A record must be present but its value does not affect mail delivery."%domain
ifdomain_properties[domain]["auto"]:
ifdomain.startswith("ns1.")ordomain.startswith("ns2."):a_expl=False# omit from 'External DNS' page since this only applies if box is its own DNS server
ifdomain.startswith("www."):a_expl="Optional. Sets the IP address that %s resolves to so that the box can provide a redirect to the parent domain."%domain
ifdomain.startswith("autoconfig."):a_expl="Provides email configuration autodiscovery support for Thunderbird Autoconfig."
ifdomain.startswith("autodiscover."):a_expl="Provides email configuration autodiscovery support for Z-Push ActiveSync Autodiscover."
defaults=[
(None,"A",env["PUBLIC_IP"],"Required. May have a different value. Sets the IP address that %s resolves to for web hosting and other services besides mail. The A record must be present but its value does not affect mail delivery."%domain),
(None,"A",env["PUBLIC_IP"],a_expl),
(None,"AAAA",env.get('PUBLIC_IPV6'),"Optional. Sets the IPv6 address that %s resolves to, e.g. for web hosting. (It is not necessary for receiving mail on this domain.)"%domain),
("www","A",env["PUBLIC_IP"],"Optional. Sets the IP address that www.%s resolves to so that the box can provide a redirect to the parent domain."%domain),
("www","AAAA",env.get('PUBLIC_IPV6'),"Optional. Sets the IPv6 address that www.%s resolves to so that the box can provide a redirect to the parent domain."%domain),
]
forqname,rtype,value,explanationindefaults:
ifvalueisNoneorvalue.strip()=="":continue# skip IPV6 if not set
ifnotis_zoneandqname=="www":continue# don't create any default 'www' subdomains on what are themselves subdomains
# Don't pin the list of records that has_rec checks against anymore.
has_rec_base=records
# The MX record says where email for the domain should be delivered: Here!
ifnothas_rec(None,"MX",prefix="10 "):
records.append((None,"MX","10 %s."%env["PRIMARY_HOSTNAME"],"Required. Specifies the hostname (and priority) of the machine that handles @%s mail."%domain))
# SPF record: Permit the box ('mx', see above) to send mail on behalf of
# the domain, and no one else.
# Skip if the user has set a custom SPF record.
ifnothas_rec(None,"TXT",prefix="v=spf1 "):
records.append((None,"TXT",'v=spf1 mx -all',"Recommended. Specifies that only the box is permitted to send @%s mail."%domain))
# Append the DKIM TXT record to the zone as generated by OpenDKIM.
records.append((m.group(1),"TXT",val,"Recommended. Provides a way for recipients to verify that this machine sent @%s mail."%domain))
# Append a DMARC record.
# Skip if the user has set a DMARC record already.
ifnothas_rec("_dmarc","TXT",prefix="v=DMARC1; "):
records.append(("_dmarc","TXT",'v=DMARC1; p=quarantine',"Recommended. Specifies that mail that does not originate from the box but claims to be from @%s or which does not have a valid DKIM signature is suspect and should be quarantined by the recipient's mail system."%domain))
# For any subdomain with an A record but no SPF or DMARC record, add strict policy records.
records.append((qname,"TXT",'v=spf1 -all',"Recommended. Prevents use of this domain name for outbound mail by specifying that no servers are valid sources for mail from @%s. If you do send email from this domain name you should either override this record such that the SPF rule does allow the originating server, or, take the recommended approach and have the box handle mail for this domain (simply add any receiving alias at this domain name to make this machine treat the domain name as one of its mail domains)."%(qname+"."+domain)))
records.append((dmarc_qname,"TXT",'v=DMARC1; p=reject',"Recommended. Prevents use of this domain name for outbound mail by specifying that the SPF rule should be honoured for mail from @%s."%(qname+"."+domain)))
# Add CardDAV/CalDAV SRV records on the non-primary hostname that points to the primary hostname
# for autoconfiguration of mail clients (so only domains hosting user accounts need it).
# The SRV record format is priority (0, whatever), weight (0, whatever), port, service provider hostname (w/ trailing dot).
records.append((qname,"SRV","0 0 443 "+env["PRIMARY_HOSTNAME"]+".","Recommended. Specifies the hostname of the server that handles CardDAV/CalDAV services for email addresses on this domain."))
# Adds autoconfiguration A records for all domains that there are user accounts at.
# This allows the following clients to automatically configure email addresses in the respective applications.
# autodiscover.* - Z-Push ActiveSync Autodiscover
# autoconfig.* - Thunderbird Autoconfig
ifdomain_properties[domain]["mail"]:
# The MX record says where email for the domain should be delivered: Here!
ifnothas_rec(None,"MX",prefix="10 "):
records.append((None,"MX","10 %s."%env["PRIMARY_HOSTNAME"],"Required. Specifies the hostname (and priority) of the machine that handles @%s mail."%domain))
# SPF record: Permit the box ('mx', see above) to send mail on behalf of
# the domain, and no one else.
# Skip if the user has set a custom SPF record.
ifnothas_rec(None,"TXT",prefix="v=spf1 "):
records.append((None,"TXT",'v=spf1 mx -all',"Recommended. Specifies that only the box is permitted to send @%s mail."%domain))
# Append the DKIM TXT record to the zone as generated by OpenDKIM.
records.append((m.group(1),"TXT",val,"Recommended. Provides a way for recipients to verify that this machine sent @%s mail."%domain))
# Append a DMARC record.
# Skip if the user has set a DMARC record already.
ifnothas_rec("_dmarc","TXT",prefix="v=DMARC1; "):
records.append(("_dmarc","TXT",'v=DMARC1; p=quarantine',"Recommended. Specifies that mail that does not originate from the box but claims to be from @%s or which does not have a valid DKIM signature is suspect and should be quarantined by the recipient's mail system."%domain))
ifdomain_properties[domain]["user"]:
autodiscover_records=[
("autodiscover","A",env["PUBLIC_IP"],"Provides email configuration autodiscovery support for Z-Push ActiveSync Autodiscover."),
("autodiscover","AAAA",env["PUBLIC_IPV6"],"Provides email configuration autodiscovery support for Z-Push ActiveSync Autodiscover."),
("autoconfig","A",env["PUBLIC_IP"],"Provides email configuration autodiscovery support for Thunderbird Autoconfig."),
("autoconfig","AAAA",env["PUBLIC_IPV6"],"Provides email configuration autodiscovery support for Thunderbird Autoconfig.")
ifvalueisNoneorvalue.strip()=="":continue# skip IPV6 if not set
ifnothas_rec(qname,rtype):
records.append((qname,rtype,value,explanation))
# Add CardDAV/CalDAV SRV records on the non-primary hostname that points to the primary hostname
# for autoconfiguration of mail clients (so only domains hosting user accounts need it).
# The SRV record format is priority (0, whatever), weight (0, whatever), port, service provider hostname (w/ trailing dot).
ifdomain!=env["PRIMARY_HOSTNAME"]:
fordavin("card","cal"):
qname="_"+dav+"davs._tcp"
ifnothas_rec(qname,"SRV"):
records.append((qname,"SRV","0 0 443 "+env["PRIMARY_HOSTNAME"]+".","Recommended. Specifies the hostname of the server that handles CardDAV/CalDAV services for email addresses on this domain."))
# If this is a domain name that there are email addresses configured for, i.e. "something@"
# this domain name, then the domain name is a MTA-STS (https://tools.ietf.org/html/rfc8461)
# Mark this domain as not sending mail with hard-fail SPF and DMARC records.
d=(qname+"."ifqnameelse"")+domain
ifnothas_rec(qname,"TXT",prefix="v=spf1 "):
records.append((qname,"TXT",'v=spf1 -all',"Recommended. Prevents use of this domain name for outbound mail by specifying that no servers are valid sources for mail from @%s. If you do send email from this domain name you should either override this record such that the SPF rule does allow the originating server, or, take the recommended approach and have the box handle mail for this domain (simply add any receiving alias at this domain name to make this machine treat the domain name as one of its mail domains)."%d))
records.append(("_dmarc"+("."+qnameifqnameelse""),"TXT",'v=DMARC1; p=reject',"Recommended. Prevents use of this domain name for outbound mail by specifying that the SPF rule should be honoured for mail from @%s."%d))
# And with a null MX record (https://explained-from-first-principles.com/email/#null-mx-record)
ifnothas_rec(qname,"MX"):
records.append((qname,"MX",'0 .',"Recommended. Prevents use of this domain name for incoming mail."))
# Sort the records. The None records *must* go first in the nsd zone file. Otherwise it doesn't matter.