How to Host Multiple Email Domains in PostfixAdmin on Debian
This tutorial will be showing you how to set up multiple mail domains (virtual hosting) on Debian server with PostfixAdmin, which is an open-source web-based interface to configure and manage a Postfix-based email server for many domains and users.
Prerequisites
To follow this tutorial, it’s assumed that
- You have already configured PostfixAdmin with one mail domain
- You have followed part 4 to set up SPF and OpenDKIM.
- You have installed Roundcube Webmail for the first mail domain
What You Need to Do
If you want to host multiple mail domains, then you need to
- Add a new mail domain and user in PostfixAdmin web-based panel.
- Create MX, A and SPF record for the new mail domain.
- Set up DKIM signing for the new domain.
- Create DMARC Record for the new domain.
- Set up RoundCube Webmail, Postfix, and Dovecot for multiple domains
Step 1: Adding Additional Domains in PostfixAdmin Panel
Log into PostfixAdmin panel with the postmaster account. (https://postfixadmin.your-domain.com/) Then go to Domain List -> New Domain to add a new domain.
Note that the new domain should have DNS A record, or PostfixAdmin would throw the following error message. You can check the DNS propagation status on dnsmap.io.
Invalid domain domain2.com, and/or not discoverable in DNS
Next, add a user under the new domain.
Step 2: Creating MX, A and SPF record for the new mail domain
In your DNS manager, add MX record for the new domain like below.
Record Type Name Value
MX @ mail.domain2.com
The A record points to your mail server’s IP address.
Record Type Name Value
A mail IP-address-of-mail-server
If your server uses IPv6 address, be sure to add AAAA record.
Then create SPF record to allow the MX host to send email for the new mail domain.
Record Type Name Value TXT @ v=spf1 mx ~all
Step 3: Setting up DKIM signing for the new domain
We have installed and configured OpenDKIM for a single domain in part 4 of this tutorial series. Now we need to tell OpenDKIM to sign every outgoing email for the new mail domain.
Edit the OpenDKIM signing table file.
sudo nano /etc/opendkim/signing.table
Add the second domain like below.
*@domain1.com default._domainkey.domain1.com *@domain2.com default._domainkey.domain2.com
Edit the key table file.
sudo nano /etc/opendkim/key.table
Add the second domain like below.
default._domainkey.domain1.com domain1.com:default:/etc/opendkim/keys/domain1.com/default.private default._domainkey.domain2.com domain2.com:default:/etc/opendkim/keys/domain2.com/default.private
Edit the trusted hosts file.
sudo nano /etc/opendkim/trusted.hosts
Add the second domain like below.
127.0.0.1 localhost .domain1.com .domain2.com
Next, we need to generate a priavte/public keypair for the second domain. Create a separate folder for the second domain.
sudo mkdir /etc/opendkim/keys/domain2.com
Generate keys using opendkim-genkey tool.
sudo opendkim-genkey -b 2048 -d domain2.com -D /etc/opendkim/keys/domain2.com -s default -v
The above command will create 2048 bits keys. -d (domain) specifies the domain. -D (directory) specifies the directory where the keys will be stored and we use default as the selector (-s). Once the command is executed, the private key will be written to default.private file and the public key will be written to default.txt file.
Make opendkim as the owner of the private key.
sudo chown opendkim:opendkim /etc/opendkim/keys/domain2.com/default.private
Display the public key
sudo cat /etc/opendkim/keys/domain2.com/default.txt
The string after the p parameter is the public key.
In your DNS manager, create a TXT record for the second domain. Enter default._domainkey in the Name field. Copy everything in the parentheses and paste into the value field. Delete all double-quotes. (You can paste it into a text editor first, delete all double quotes, then copy it to your DNS manager. Your DNS manager may require you to delete other invalid characters, such as carriage return.)
After saving your changes. Check the TXT record with this command.
dig TXT default._domainkey.domain2.com
Now you can run the following command to test if your DKIM DNS record is correct.
sudo opendkim-testkey -d domain2.com -s default -vvv
If everything is OK, you will see
opendkim-testkey: using default configfile /etc/opendkim.conf opendkim-testkey: checking key 'default._domainkey.domain2.com' opendkim-testkey: key secure opendkim-testkey: key OK
If you see “Key not secure”, don’t panic. This is because DNSSEC isn’t enabled on your domain name. DNSSEC is a security standard for secure DNS query. Most domain names haven’t enabled DNSSEC. You can continue to follow this guide.
Restart OpenDKIM so it will start signing emails for the second domain.
sudo systemctl restart opendkim
Step 4: Creating DMARC Record For the New Domain
To create a DMARC record, go to your DNS manager and add a TXT record. In the name field, enter _dmarc. In the value field, enter the following. Note that you need to create the [email protected] email address.
v=DMARC1; p=none; pct=100; rua=mailto:[email protected]
The above DMARC record is a safe starting point. To see the full explanation of DMARC, please check the following article.
Step 5: Setting up RoundCube, Postfix and Dovecot for Multiple Domains
I assume you installed Roundcube webmail for the first mail domain.
It makes sense to let users of the first domain use mail.domain1.com and users of the second domain use mail.domain2.com when accessing RoundCube webmail. I will show you how to do it with Apache and Nginx.
Apache
If Roundcube is served by Apache web server, then create a virtual host for the second domain.
sudo nano /etc/apache2/sites-available/mail.domain2.com.conf
Put the following text into the file.
<VirtualHost *:80> ServerName mail.domain2.com DocumentRoot /var/www/roundcube/ ErrorLog ${APACHE_LOG_DIR}/mail.domain2.com_error.log CustomLog ${APACHE_LOG_DIR}/mail.domain2.com_access.log combined <Directory /> Options FollowSymLinks AllowOverride All </Directory> <Directory /var/www/roundcube/> Options FollowSymLinks MultiViews AllowOverride All Order allow,deny allow from all </Directory> </VirtualHost>
Save and close the file. Then enable this virtual host with:
sudo a2ensite mail.domain2.com.conf
Reload Apache for the changes to take effect.
sudo systemctl reload apache2
Nginx
If Roundcube is served by Nginx web server, then create a virtual host for the second domain.
sudo nano /etc/nginx/conf.d/mail.domain2.com.conf
Put the following text into the file.
server {
listen 80;
server_name mail.domain2.com;
root /var/www/roundcube/;
index index.php index.html index.htm;
error_log /var/log/nginx/mail.domain2.com.error;
access_log /var/log/nginx/mail.domain2.com.access;
location / {
try_files $uri $uri/ /index.php;
}
location ~ \.php$ {
try_files $uri =404;
fastcgi_pass unix:/run/php/php8.0-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
location ~ /.well-known/acme-challenge {
allow all;
}
location ~ ^/(README|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
deny all;
}
location ~ ^/(bin|SQL)/ {
deny all;
}
# A long browser cache lifetime can speed up repeat visits to your page
location ~* \.(jpg|jpeg|gif|png|webp|svg|woff|woff2|ttf|css|js|ico|xml)$ {
access_log off;
log_not_found off;
expires 360d;
}
}
Save and close the file. Then test Nginx configurations.
sudo nginx -t
If the test is successful, reload Nginx for the changes to take effect.
sudo systemctl reload nginx
Obtaining TLS Certificate
Now use Certbot to obtain TLS certificate for all your mail domains, so you will have a single TLS certificate with multiple domain names on it and mail clients won’t throw security warnings.
Apache
sudo certbot --apache --agree-tos --redirect --hsts --staple-ocsp -d mail.domain1.com,mail.domain2.com --cert-name mail.domain1.com --email [email protected]
Nginx
sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp -d mail.domain1.com,mail.domain2.com --cert-name mail.domain1.com --email [email protected]
Notice that in the above command, we specified the cert name using the first mail domain, which will be used in the file path, so you don’t have to change the file path in Postfix or Dovecot configuration file.
When it asks if you want to update the existing certificate to include the new domain, answer U and hit Enter.
Now you should see the following message, which indicates the multi-domain certificate is successfully obtained.
Run the following command to grant permission to read Let’s Encrypt TLS certificates.
sudo setfacl -R -m u:www-data:rx /etc/letsencrypt/live/ /etc/letsencrypt/archive/
Reload Apache or Nginx to pick up the new certificate.
sudo systemctl reload apache2 sudo systemctl reload nginx
You should now be able to use different domains to access RoundCube webmail. Also you need to reload Postfix SMTP server and Dovecot IMAP server in order to let them pick up the new certificate. That’s all you need to do for Postfix and Dovecot to serve multiple domains.
sudo systemctl reload postfix dovecot
Using Mail Client on Your Computer or Mobile Device
Fire up your desktop email client such as Mozilla Thunderbird and add a mail account of the second domain.
- In the incoming server section, select IMAP protocol, enter
mail.domain2.comas the server name, choose port 143 and STARTTLS. Choosenormal passwordas the authentication method. - In the outgoing section, select SMTP protocol, enter
mail.domain2.comas the server name, choose port 587 and STARTTLS. Choosenormal passwordas the authentication method.
Hint: You can also use port 993 with SSL/TLS encryption for IMAP, and use port 465 with SSL/TLS encryption for SMTP. You should not use port 25 as the SMTP port to submit outgoing emails.
Although Postfix SMTP server and Dovecot IMAP server are using the hostname of the first mail domain (mail.domain1.com) when communicating with others, they are now using a multi-domain certificate, so the mail client won’t display certificate warnings.
SPF and DKIM Check
Now you can use your desktop email client or webmail client to send a test email to [email protected] and get a free email authentication report. Here’s the report I got from port25.com
Don’t forget to test your email score at https://www.mail-tester.com and also test email placement with GlockApps.
If DKIM check fails, you can go to https://www.dmarcanalyzer.com/dkim/dkim-check/ to see if there are any errors with your DKIM record.
What if Your Emails Are Still Being Marked as Spam?
I have more tips for you in this article: 7 effective Tips to stop your emails being marked as spam. Although it requires some time and effort, your emails will eventually be placed in the inbox after applying these tips.
rDNS for Multiple Mail Domains?
Reverse DNS (rDNS), aka PTR record, is used to check if the sender’s IP address matches the HELO hostname. You don’t need to add another PTR record when adding a new mail domain. Your rDNS should be set to just one hostname, i.e. the hostname set in Postfix, which can be shown with the following command.
postconf myhostname
rDNS is a record for IP addresses. It’s not a record for domain name. If you have just one IP address, then you need just one rDNS record pointing to one hostname. Reverse DNS check doesn’t verify what From: domain is in your email, as long as your IP address has an rDNS record and the hostname can resolve back to the same IP address, you can pass reverse DNS check.
Also, you don’t need to change the following settings in Postfix when hosting multiple domains on one server.
- myhostname
- myorigin
- mydestination
Hosted email services like G Suite and Microsoft Exchange Online all use one hostname for a server to send an email for their customers. Emails sent from G Suite users all use google.com in the hostname and emails sent from Microsoft Exchange Online users all use outlook.com in the hostname. This is also true for other email service providers like Mailchimp, SendinBlue, SendPluse, etc. They all use one hostname for a single server and one IP address has just one rDNS record.
Unable to Receive Email From Gmail, Hotmail, Yahoo Mail, etc
If you can’t receive emails from Gmail, Hotmail, Yahoo Mail, etc, here are the possible causes:
- Your MX record is wrong, or not propagated to the Internet yet.
- Your mail server hostname doesn’t have DNS A record, or is not propagated to the Internet yet.
- Your firewall doesn’t allow incoming connections to port 25. Maybe your mail server is behind a NAT?
- Postfix isn’t listening on the public IP address.
- Check the mail log (
/var/log/mail.log) to find out if there are other errors in your Postfix and Dovecot configuration.
You can use the Network Tools Email Checker to test if your SMTP server is reachable from the Internet. Just enter your domain email address and click the Go button. As you can see from the screenshot below, it successfully found my domain’s MX record and my SMTP server is reachable from the Internet.
If your SMTP servers isn’t reachable from the Internet, then you have a problem in the first 4 items. If your SMTP server is reachable from the Internet, but you still can’t receive emails, check the mail log (/var/log/mail.log) to find out if there is any errors in your Postfix and Dovecot configuration.
Multiple TLS Certificates
If you manage email servers for lots of clients, you might not want to bundle all TLS certificates into one file, as it tells the information of your clients. Instead of using the following command to obtain a multi-domain certificate,
sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp -d mail.domain1.com,mail.domain2.com
You can just use the following command to obtain a separate TLS certificate for the second mail domain.
sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp -d mail.domain2.com
Next, you need to configure Postfix and Dovecot.
Postfix Multiple TLS Certificates
If you use Postfix version 3.4 or higher, you can use multiple TLS certificates. Edit the main.cf file.
sudo nano /etc/postfix/main.cf
Add the following line at the end of this file to enable multiple TLS certificates.
tls_server_sni_maps = hash:/etc/postfix/sni_maps
Save and close the file. Then create the sni_maps file.
sudo nano /etc/postfix/sni_maps
In this file, add each mail hostname and its certificate file.
mail.domain1.com /etc/letsencrypt/live/mail.domain1.com/privkey.pem /etc/letsencrypt/live/mail.domain1.com/fullchain.pem mail.domain2.com /etc/letsencrypt/live/mail.domain2.com/privkey.pem /etc/letsencrypt/live/mail.domain2.com/fullchain.pem
Save and close the file. Next, build the lookup table.
sudo postmap -F /etc/postfix/sni_maps
Restart Postfix.
sudo systemctl restart postfix
You must use the -F option in postmap to base64-decode each value in the SNI map, or Postfix will throw the malformed BASE64 value error in the /var/log/mail.log file. The following command is wrong.
sudo postmap /etc/postfix/sni_maps
Dovecot Multiple TLS Certificates
If you use multiple TLS certificates in Postfix, you should also enable it in Dovecot. Edit the Dovecot 10-ssl.conf file.
sudo nano /etc/dovecot/conf.d/10-ssl.conf
You can find the following lines.
ssl_cert =</etc/letsencrypt/live/mail.domain1.com/fullchain.pem ssl_key =</etc/letsencrypt/live/mail.domain1.com/privkey.pem
Then add the following lines.
local_name mail.domain1.com { ssl_cert =</etc/letsencrypt/live/mail.domain1.com/fullchain.pem ssl_key =</etc/letsencrypt/live/mail.domain1.com/privkey.pem } local_name mail.domain2.com { ssl_cert =</etc/letsencrypt/live/mail.domain2.com/fullchain.pem ssl_key =</etc/letsencrypt/live/mail.domain2.com/privkey.pem }
Save and close the file. Then restart Dovecot.
sudo systemctl restart dovecot
Run the following command to grant permission to read Let’s Encrypt TLS certificates.
sudo setfacl -R -m u:www-data:rx /etc/letsencrypt/live/ /etc/letsencrypt/archive/
Cron Job
If you use SNI map in Postfix, then you should run the sudo postmap -F /etc/postfix/sni_maps command after TLS certificate is renewed. If you don’t do this, then email clients might complain your TLS certificate has expired. You can add this command to Crontab file, so it will be automated.
sudo crontab -e
Apache web server user:
@daily certbot renew --quiet; /usr/sbin/postmap -F /etc/postfix/sni_maps; systemctl reload postfix dovecot apache2
Nginx web server user:
@daily certbot renew --quiet; /usr/sbin/postmap -F /etc/postfix/sni_maps; systemctl reload postfix dovecot nginx
Wrapping Up
That’s it! I hope this tutorial helped you host multiple email domains with PostfixAdmin. As always, if you found this post useful, then subscribe to our free newsletter to get more tips and tricks. Take care 🙂
Thanks, excellent tutorial!
Q: I see that Roundcube is showing the page title = “domain1 – webmail” even when I am in domain2. Is it possible to customize it according to the domain?
Hey perfect tutorial, this mailserver has been running for a couple of months for me without any problems.
Now that I wanted to add an extra mailbox i can’t login anymore in postfixadmin.
On the setupage i am getting the following errors/warnings do u know what i can do to fix this?
Warnings
⚠ Database – PostgreSQL (pdo_pgsql) extension not found
⚠ Database support – SQLite (pdo_sqlite) extension not found
⚠ Warning: Optional dependency ‘imap’ extension missing, without this you may not be able to automate creation of sub-folders for new mailboxes
Errors (MUST be fixed)
⛔Password Hashing – attempted to use configured encrypt backend (dovecot:ARGON2I) triggered an error: /usr/bin/doveadm pw -r 5 failed, see error log for details
⛔You will have problems logging into PostfixAdmin.
⛔Check out our Dovecot documentation at https://github.com/postfixadmin/postfixadmin/blob/master/DOCUMENTS/DOVECOT.txt, specifically around ‘3. Permissions’.
HI. I need help in installing a elay-send-only-mail-server with multiple domains incl. DKIM.
We have an internal Mail-Server, that have NOT the DKIM and ONLY Port 25.
So I have to create an internal RELAY (SMARTHOST).
do not know if I need some extra Fix-IP or any more new DNS-Entries. I do not to have mailboxes in this server. It has to be really ONLY SEND.
Your documentaion is a little to much for me.
Can you help me to create this Server?