This is a setup for a Tor based email hosting server. It is provided as is and before putting it into production you should make changes according to your needs. This is a work in progress and you should carefully check the commit history for changes before updating.
Uninstall packages that may interfere with this setup:
DEBIAN_FRONTEND=noninteractive apt-get purge -y apache2* dnsmasq* eatmydata exim4* imagemagick-6-common mysql-client* mysql-server* nginx* libnginx-mod* php7* resolvconf && systemctl disable systemd-resolved.service && systemctl stop systemd-resolved.service
If you have problems resolving hostnames after this step, temporarily switch to a public nameserver like 1.1.1.1 (from CloudFlare) or 8.8.8.8 (from Google)
rm /etc/resolv.conf && echo "nameserver 1.1.1.1" > /etc/resolv.conf
Install git and clone this repository
apt-get update && apt-get install git -y && git clone https://github.com/DanWin/mail-hosting && cd mail-hosting
Install files and programs
./install_binaries.sh
When updating the application, copy the updated composer.json to /var/www/mail/ and refresh the installed dependencies and autoloader:
cd /var/www/mail && composer install --no-dev --no-interaction
Copy (and modify according to your needs) the site files in etc to /etc after installation has finished. Then restart some services:
systemctl daemon-reload && systemctl restart tor@default.service
Replace the default .onion domain with your domain:
sed -i "s/danielas3rtn54uwmofdo3x2bsdifr47huasnmbgqzfrec5ubupvtpid.onion/`cat /var/lib/tor/hidden_service/hostname`/g" /etc/prosody/prosody.cfg.lua /etc/nginx/sites-enabled/mail /var/www/mail/common_config.php /etc/postfix/main.cf
Replace the default clearnet domain with your domain:
sed -i "s/danwin1210.de/YOUR_DOMAIN/g" /etc/prosody/prosody.cfg.lua /etc/postfix/main.cf /etc/dovecot/dovecot.conf /etc/nginx/sites-enabled/* /var/www/mail/common_config.php /var/www/mail/www/squirrelmail/config/config.php
Create a mysql users and databases:
mysql
CREATE DATABASE postfix;
CREATE DATABASE prosody;
CREATE USER 'postfix'@'%' IDENTIFIED BY 'MY_PASSWORD';
CREATE USER 'postfix_readonly'@'%' IDENTIFIED BY 'MY_PASSWORD';
CREATE USER 'prosody'@'%' IDENTIFIED BY 'MY_PASSWORD';
GRANT ALL PRIVILEGES ON postfix.* TO 'postfix'@'%';
GRANT SELECT ON postfix.* TO 'postfix_readonly'@'%';
GRANT ALL PRIVILEGES ON prosody.* TO 'prosody'@'%';
FLUSH PRIVILEGES;
quit
Then update the passwords you've set in your configuration files:
nano /etc/dovecot/dovecot-dict-sql.conf.ext /etc/dovecot/dovecot-sql.conf.ext /etc/postfix/sql/mysql_* /etc/prosody/prosody.cfg.lua /var/www/mail/common_config.php
Generate a keypair for rspamd with rspamadm keypair gen and add it to /etc/rspamd/local.d/worker-fuzzy.inc, add the public encryption key to /etc/rspamd/override.d/fuzzy_check.conf
Set a password for the web interface with rspamadm pw and add the hash for it to /etc/rspamd/override.d/worker-controller.inc
Configure the Rspamd dynamic maps by replacing CHANGE_ME_TO_A_LONG_RANDOM_SECRET with the same value in /var/www/mail/common_config.php, /etc/rspamd/rspamd.conf.override, and /etc/rspamd/lua/rspamd.local.lua. Generate a secret with openssl rand -hex 32. Also replace the example hostname in both Rspamd URLs with your mail server's public hostname. The authenticated settings endpoint returns Rspamd's UCL settings map; the feedback ID endpoint returns the active mailbox-to-ID map. Users can configure exact sender addresses to block or whitelist in their account settings; whitelisting uses Rspamd's want_spam option and bypasses all Rspamd checks, including virus scanning.
Each mailbox receives a unique 15-character Feedback Loop sender ID. Rspamd adds it to authenticated outgoing messages as Feedback-ID: :::<id> before DKIM signing, replacing any existing Feedback-ID header so the resulting message contains only one. The account settings and admin mailbox editor display the ID.
Google FBL reporting requires mail to be DKIM-signed by a domain verified in Google Postmaster Tools. Publish the sending IPs in SPF and ensure the IPs have valid PTR records; FBL reports apply only to Gmail recipients.
Configure the DKIM signing map by replacing the example hostname and token in /etc/rspamd/local.d/dkim_signing.conf with the same hostname and token used for the other Rspamd maps. ARC/DKIM signing uses the local Redis instance (127.0.0.1:6379) via the php-redis extension, with Redis hashes dkim_keys and dkim_selectors; the installation script installs the extension. ARC signing is enabled for authenticated, local, and inbound messages, using the recipient's hosted domain for inbound ARC seals. The database-backed ARC hashes are synchronized during setup, when a domain is added/updated or a key is regenerated, and by the five-minute cron job. An RSA DKIM key is generated automatically when a domain is added. The domain editor shows the selector and public DNS TXT record to publish; regenerating the key changes the selector and requires updating that record. Private keys are stored in the database and Redis and should be protected accordingly.
The authenticated-user ratelimit map is configured in /etc/rspamd/custom_ratelimit.lua; replace its example hostname and token with your map endpoint settings. Accounts registered within the last 14 days receive lower sending limits. A mailbox marked as trusted in the admin editor receives higher limits; other authenticated mailboxes receive the default limits.
Postfix updates a mailbox's last_login timestamp when an authenticated SMTP session reaches the MAIL FROM command. Install the policy script at /var/www/mail/tools/postfix_last_login_policy.php and reload Postfix after updating /etc/postfix/main.cf and /etc/postfix/master.cf. An SMTP session that authenticates but disconnects before MAIL FROM cannot be recorded by this policy hook.
Mailbox owners can add identity addresses on their mailbox domain from account settings; administrators can associate addresses on domains they manage from the mailbox editor. Identity addresses deliver only to their owner, are hidden from the regular alias list, and are authorized as sender addresses only for that mailbox's SMTP login.
Registering a mailbox on CLEARNET_SERVER automatically creates its matching local_part@ONION_SERVER identity. The database upgrade backfills this identity for existing clearnet mailboxes.
Rspamd rejects unauthenticated inbound messages using a hosted envelope-sender domain unless SPF passes or DMARC passes for a hosted From domain. Configure the hosted-domain map URL and token in /etc/rspamd/rspamd.local.lua alongside the other Rspamd map settings.
Create a password used for your TURN server and replace all YOUR_SECRET in /etc/prosody/prosody.cfg.lua with it.
Install acme.sh or certbot to obtain a free letsencrypt SSL certificate, then update the path to this new certificate in the following files:
nano /etc/prosody/prosody.cfg.lua /etc/dovecot/dovecot.conf /etc/postfix/main.cf /etc/nginx/nginx.conf /etc/nginx/sites-enabled/mail /etc/nginx/sites-enabled/openpgpkey
Add your other servers IP under unrestricted access to these IPs in /etc/rc.local
Create database tables, activate firewall and enable cron:
postmap /etc/postfix/header_checks
cd /var/www/mail && php setup.php && chmod +x /etc/rc.local && /etc/rc.local && systemctl enable mail-cron.timer
Generate a wireguard keypair and add the public key generated here to the primary mail server wireguard config:
export PRIV=$(wg genkey)
sed -i "s~YOUR_PRIVATE_KEY~$PRIV~g" /etc/wireguard/wg0.conf
echo $PRIV | wg pubkey
Replace YOUR_IP with the IP of your other server, then enable and start wireguard:
nano /etc/wireguard/wg0.conf
systemctl enable wg-quick@wg0 && systemctl start wg-quick@wg0
Final step is to reboot the server and check that everything is working.
To send emails to the regular internet, it is necessary to have a static IP to retain a reputation with an IP+Domain mapping. If you try sending via Tor, your emails will most certainly get blocked by spam filters. For this reason we need to setup a proxy server which will hold no user data itself, but simply act as a gateway to reach the less anonymous part of the internet.
Uninstall packages that may interfere with this setup:
DEBIAN_FRONTEND=noninteractive apt-get purge -y apache2* dnsmasq* eatmydata exim4* imagemagick-6-common mysql-client* mysql-server* nginx* libnginx-mod* php7* resolvconf && systemctl disable systemd-resolved.service && systemctl stop systemd-resolved.service
If you have problems resolving hostnames after this step, temporarily switch to a public nameserver like 1.1.1.1 (from CloudFlare) or 8.8.8.8 (from Google)
rm /etc/resolv.conf && echo "nameserver 1.1.1.1" > /etc/resolv.conf
Install git and clone this repository
apt-get update && apt-get install git -y && git clone https://github.com/DanWin/mail-hosting && cd mail-hosting
Install files and programs
./install_binaries_proxy.sh
Copy (and modify according to your needs) the site files in etc_clearnet_proxy to /etc after installation has finished.
Add the password for your TURN server you created for prosody in the main server and replace YOUR_AUTH_SECRET in /etc/turnserver.conf with it.
Install acme.sh or certbot to obtain a free letsencrypt SSL certificate, then update the path to this new certificate in the following files:
nano /etc/postfix/main.cf /etc/nginx/nginx.conf /etc/turnserver.conf
Replace YOUR_PASSWORD in /etc/postfix/sql/mysql_tls_policy_out.cf with the one you've generated previously on the other server.
Generate a wireguard keypair and add the public key generated here to the primary mail server wireguard config:
export PRIV=$(wg genkey)
sed -i "s~YOUR_PRIVATE_KEY~$PRIV~g" /etc/wireguard/wg0.conf
echo $PRIV | wg pubkey
Replace YOUR_IP with the IP of your other server and ens3 with your network interface name, then enable and start wireguard:
nano /etc/wireguard/wg0.conf
systemctl enable wg-quick@wg0 && systemctl start wg-quick@wg0
Edit and create your admin user with the following script:
nano /var/www/mail/tools/create_admin.php
php /var/www/mail/tools/create_admin.php
Copy the file /etc/postfix/danwin1210-mail.crt from your main server to the same location on the proxy server.
Final step is to reboot the server and check that everything is working.
Add the following DNS records to your domain, with the IPs of your proxy server:
@ IN TXT "v=spf1 ip4:your.ip.v4.address ip6:your:ip:v6:address -all"
_dmarc IN TXT "v=DMARC1;p=quarantine;adkim=r;aspf=r;fo=1;rua=mailto:postmaster@yourdomain;ruf=mailto:postmaster@yourdomain;rf=afrf;ri=86400;pct=100"
_adsp._domainkey IN TXT "dkim=all;"
_domainkey IN TXT "o=-;r=postmaster@yourdomain"
*._report._dmarc IN TXT "v=DMARC1"
_mta-sts IN TXT "v=STSv1; id=2024060601"
_smtp._tls IN TXT "v=TLSRPTv1; rua=mailto:postmaster@yourdomain"
_imaps._tcp IN SRV 0 0 993 yourdomain.
_submission._tcp IN SRV 0 0 587 yourdomain.
@ IN MX 0 yourdomain.
@ IN A your.ip.v4.address
@ IN AAAA your:ip:v6:address
www IN A your.ip.v4.address
www IN AAAA your:ip:v6:address
mta-sts IN A your.ip.v4.address
mta-sts IN AAAA your:ip:v6:address
conference IN A your.ip.v4.address
conference IN AAAA your:ip:v6:address
proxy IN A your.ip.v4.address
proxy IN AAAA your:ip:v6:address
upload IN A your.ip.v4.address
upload IN AAAA your:ip:v6:address
_xmpp-server._tcp.conference IN SRV 5 0 5269 yourdomain.
_xmpp-server._tcp.conference IN SRV 0 0 5269 your_onion_domain.
_xmpp-client._tcp IN SRV 5 0 5222 yourdomain.
_xmpp-client._tcp IN SRV 0 0 5222 your_onion_domain.
_xmpps-client._tcp IN SRV 5 0 5223 yourdomain.
_xmpps-client._tcp IN SRV 0 0 5223 your_onion_domain.
_xmpp-server._tcp IN SRV 5 0 5269 yourdomain.
_xmpp-server._tcp IN SRV 0 0 5269 your_onion_domain.
_stun._udp IN SRV 0 0 3478 yourdomain.
_turn._udp IN SRV 0 0 3478 yourdomain.
_stun._tcp IN SRV 0 0 3478 yourdomain.
_stuns._tcp IN SRV 0 0 3479 yourdomain.
_turn._tcp IN SRV 0 0 3478 yourdomain.
_turns._tcp IN SRV 0 0 5349 yourdomain.
_xmppconnect IN TXT "_xmpp-client-xbosh=https://yourdomain:5281/http-bind"
_xmppconnect IN TXT "_xmpp-client-websocket=wss://yourdomain:5281/xmpp-websocket"
Set the PTR record of your proxy servers IPs to your domain. This can usually be done from your hosting panels configuration, but may not be available with every hosting provider, where you can then request them to do it via a support ticket.
Consider registering your domain with DNSWL, SNDS, Google Postmaster Tools and YahooCFL for valuable insights into your delivery.
Consider enabling DNSSEC on your domain, when available by your Domain registrar. Some registrars may charge extra for it. Once enabled, you can also enable DANE, which increases security. Use TLSA Record Genearator to help you create an appropriate DNS record.
Consider adding your domain to HSTS Preload List which will prevent browsers from even trying to access your domain on the insecure http:// protocol and automatically upgreade to https://
Follow SnappyMail installation instructions to finish setting it up at yourdomain/mail/snappymail/?admin
Translations are managed in Weblate.
If you prefer manually submitting translations, the script update-translations.sh can be used to update the language template and translation files from source.
It will generate the file locale/mail-hosting.pot which you can then use as basis to create a new language file in YOUR_LANG_CODE/LC_MESSAGES/mail-hosting.po and edit it with a translation program, such as Poedit.
Once you are done, you can open a pull request, or email me, to include the translation.
If you want to see the script in action, and/or register for a free anonymous E-Mail address, you can visit my Tor hidden service or my clearnet proxy if you don't have Tor installed.