sending email

[jojo05]

What solution would you use/propose for sending email ? (I understand that go-guerrilla is only for receiving emails).

I would like to adapt go-guerrilla to build my own webmail. Wouldn't be ok for the local smtp client to talk to this server?
thanks

[flashmob]

For sending email, it's much more tricky since there's a lot of moving parts such as DKIM, SPF, feedback loops, IP address reputation and more. Perhaps a cloud offering such as mailgun.com or mandrill.com could be used, or you could DIY and configure an instance of postfix if you are familar with setting all that up.

We are currently refactoring the server to be more modular so that it would be easier to add new features in the future.

[jojo05]

Is Postfix better than Exim? (I've used Exim in the past and it's slightly complicated).
Thanks

[jojo05]

I've done some research and Postfix seems better (more modular, better confi). For the Go solution, I've found these libraries (in rough order of priority):

https://godoc.org/github.com/eaigner/dkim
https://godoc.org/github.com/toorop/go-dkim
https://godoc.org/github.com/emailfabric/dkim

https://github.com/gopistolet/gospf
https://godoc.org/github.com/zaccone/goSPF/spf
https://godoc.org/github.com/cathalgarvey/gospf
https://github.com/daniellockard/gospfquery

[flashmob]

This is how email is sent on Guerrilla Mail:

For DKIM key generation, the dkim tools package is very useful:

apt install opendkim-tools

and then the following command to generate the keys:

opendkim-genkey -r -b 2048 -d guerrillamail.com -s selector_name --hash-algorithms=sha256 --directory=/path/to/somewhere

(Where selector_name can be any name you choose)

Then the DNS is updated with the public key, the private key is used for signing. You only need to do this once every year or so. Also the SPF is also set in the DNS records, no need to use any other tools / programs.

Guerrilla Mail has all the DKIM and SPF admin procedure fully automated.

As for sending, a Go program is used to read messages from a queue and schedule them for sending. To do the actual sending, the Go program executes a legacy PHP script through a FastCGI backend ( https://github.com/flashmob/go-fastcgi-client ). The PHP does the signing, reads the MX records, chooses the best MX server and uses https://github.com/PHPMailer/PHPMailer to do the actual sending and returns the result to the Go program...

The packages you have linked to are mostly for validating DKIM / SPF, but validation is only used for spam filtering, we just have to sign the message with our key when sending and make sure that our SPF and DMARC records are configured + any other administrative tasks.

[jojo05]

Thanks, this is very useful.

For a webmail solution, where I get messages I care about, I would need to filter spam (on the received messages) using DMARC (DKIM+SPF), that's why I thought I would need the validating libs.

[flashmob]

Welcome, Thanks for asking.
A quick way to setup a spam filter would be to
apt-get install spamassassin spamc

/etc/init.d/spamassassin restart
and then do something like in this example: https://github.com/saintienn/go-spamc

[aftabnaveed]

I know this issue is closed, but I am just wondering why would you need "Go" to process the output of PHP script (that is used to send emails via PHPMailer like mentioned above)?

[flashmob]

Go program just needs to get the result to see if the send was successful. Of course, you do not need to use Go for that - there are many ways to skin a cat. This is really a Producer–consumer problem, whatever way you use to solve it should be fine :-)