Email & Networking Intermediate 25 min

How to Set Up Postfix Mail Server with DKIM, SPF, and DMARC

Ensure 100% email inbox delivery to Gmail, Outlook, and Yahoo with cryptographic DKIM and SPF authentication

IndSoft Cloud Engineering
Reviewed October 2026
Production Verified Commands

Guide Overview & Architecture Outcome

By following this guide, you will configure Postfix as an authoritative mail transfer agent on Ubuntu. You will generate 2048-bit OpenDKIM cryptographic keys, publish SPF TXT records, and enforce strict DMARC alignment to avoid spam folders.

Table of Contents
Step 1: Install Postfix and OpenDKIM Package... Step 2: Generate 2048-bit DKIM Keys... Step 3: Publish DNS TXT Records for SPF, DKI... Check That It Worked Troubleshooting
Practice on Live Cloud

Spin up an Ubuntu 24.04 instance with instant activation to test this tutorial:

Deploy IndSoft VPS

Prerequisites & System Requirements

A Linux VPS with clean reverse DNS (PTR) set on its dedicated IP address. Recommended: IndSoft Dedicated IP VPS.

1

Install Postfix and OpenDKIM Packages

Install Postfix MTA and OpenDKIM signing utilities.

bash · step-1-command.sh
sudo DEBIAN_FRONTEND=noninteractive apt install postfix postfix-pcre opendkim opendkim-tools -y
Expected System Output:
Installed.
2

Generate 2048-bit DKIM Keys

Create RSA keys and configure OpenDKIM key tables.

bash · step-2-command.sh
sudo mkdir -p /etc/opendkim/keys/example.com sudo opendkim-genkey -b 2048 -d example.com -D /etc/opendkim/keys/example.com -s mail -v sudo chown -R opendkim:opendkim /etc/opendkim
Expected System Output:
Key generated: mail.private, mail.txt
3

Publish DNS TXT Records for SPF, DKIM, and DMARC

Publish the generated public key in your DNS zone along with SPF and DMARC policies.

bash · step-3-command.sh
# DNS TXT for SPF: v=spf1 ip4:YOUR_SERVER_IP ~all # DNS TXT for mail._domainkey.example.com: v=DKIM1; k=rsa; p=MIIBIj... # DNS TXT for _dmarc.example.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
Expected System Output:
DNS records saved.

Check That It Worked (Verification)

Run this quick verification check to confirm your installation is responding properly:

verify-service.sh
opendkim-testkey -d example.com -s mail -vvv
Expected Response:
opendkim-testkey: key OK

Troubleshooting Common Errors

Quick resolutions for frequent setup pitfalls and configuration issues.

Diagnostic Tips
Gmail marks email as spam
Verify reverse DNS (PTR) matches your mail hostname: dig -x YOUR_IP +short. Contact IndSoft support to set your custom PTR record.
DKIM signature failure in email headers
Ensure the selector name (e.g. mail) matches between OpenDKIM KeyTable and your DNS record name.
Port 25 outbound blocked
Contact IndSoft support to verify your account has port 25 enabled for legitimate transactional mail.