Mail setup for deSEC

aleks — Fri, 18 Jul 2025 00:00:00 +0000

Introduction🔗</a></h1>
This post describes how to configure the mail DNS setup for deSEC</a> via commandline.</p>

In this post and for the setup are the following tools required bash</code>, curl</code>, jq</code>, envsubst</code> and certbot</code>.</p>

For the beginning will we export the two environment variables below.</p>

export</span> DNSSEC_TOKEN</span>=</span>'</span>Your-DNSSEC-API-Token</span>'</span></span>
export</span> DOMAIN_NAME</span>=</span>'</span>Your-Domain</span>'</span></span></code></pre>
The value for the DNSSEC_TOKEN</code> can be created via the Web UI or via API as documented at Creating a Token</a>.</p>
Create Certificate🔗</a></h2>
The creation of the file /etc/letsencrypt/secrets/$DOMAIN_NAME.ini</code> is documented on the certbot-dns-desec</a>

We can now create the LE certificate and key after the preparation above.</p>




  
    
      warning
    </div>
    Warning</strong></span>
  </div>
  Please be aware that an wildcard certificate will be created with the call below!</p>
</div>
</div>
certbot</span> certonly</span> \</span></span>
  -</span>-authenticator</span> dns-desec</span> \</span></span>
  -</span>-dns-desec-credentials</span> /etc/letsencrypt/secrets/</span>$</span>DOMAIN_NAME</span>.ini</span> \</span></span>
  -</span>d</span> '</span>$DOMAIN_NAME</span>'</span> \</span></span>
  -</span>d</span> '</span>*.$DOMAIN_NAME</span>'</span></span></code></pre>
There must be an directory /etc/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem</code> after the successfully execution of the certbot call.</p>
The deSEC json file🔗</a></h2>
To be able to create the DNS Resource Record Sets (RRsets) is a json file required. The json file below can be used to create the RRsets via the API call, which is shown at the end.

Save the json text into the file mail-setup.json</code>.</p>
[</span></span>
    {</span></span>
        "</span>subname</span>"</span>:</span> "</span>"</span>,</span></span>
        "</span>type</span>"</span>:</span> "</span>MX</span>"</span>,</span></span>
        "</span>ttl</span>"</span>:</span> 3600</span>,</span></span>
        "</span>records</span>"</span>:</span> [</span></span>
            "</span>5 mail.${DOMAIN_NAME}.</span>"</span></span>
        ]</span></span>
    }</span>,</span></span>
    {</span></span>
        "</span>subname</span>"</span>:</span> "</span>"</span>,</span></span>
        "</span>type</span>"</span>:</span> "</span>TXT</span>"</span>,</span></span>
        "</span>ttl</span>"</span>:</span> 3600</span>,</span></span>
        "</span>records</span>"</span>:</span> [</span></span>
            "</span>\"</span>v=spf1 mx -all</span>\"</span>"</span></span>
        ]</span></span>
    }</span>,</span></span>
    {</span></span>
        "</span>subname</span>"</span>:</span> "</span>"</span>,</span></span>
        "</span>type</span>"</span>:</span> "</span>A</span>"</span>,</span></span>
        "</span>ttl</span>"</span>:</span> 3600</span>,</span></span>
        "</span>records</span>"</span>:</span> [</span></span>
            "</span>IPv4 Adress</span>"</span></span>
        ]</span></span>
    }</span>,</span></span>
    {</span></span>
        "</span>subname</span>"</span>:</span> "</span>"</span>,</span></span>
        "</span>type</span>"</span>:</span> "</span>AAAA</span>"</span>,</span></span>
        "</span>ttl</span>"</span>:</span> 3600</span>,</span></span>
        "</span>records</span>"</span>:</span> [</span></span>
            [</span>"</span>IPv6 Adress</span>"</span>]</span></span>
        ]</span></span>
    }</span>,</span></span>
    {</span></span>
        "</span>subname</span>"</span>:</span> "</span>"</span>,</span></span>
        "</span>type</span>"</span>:</span> "</span>CAA</span>"</span>,</span></span>
        "</span>ttl</span>"</span>:</span> 3600</span>,</span></span>
        "</span>records</span>"</span>:</span> [</span></span>
            "</span>0 iodef mailto:postmaster@${DOMAIN_NAME}</span>"</span>,</span></span>
            "</span>0 issue letsencrypt.org</span>"</span></span>
        ]</span></span>
    }</span>,</span></span>
    {</span></span>
        "</span>subname</span>"</span>:</span> "</span>_25._tcp.mail</span>"</span>,</span></span>
        "</span>type</span>"</span>:</span> "</span>TLSA</span>"</span>,</span></span>
        "</span>ttl</span>"</span>:</span> 3600</span>,</span></span>
        "</span>records</span>"</span>:</span> [</span></span>
            "</span>3 1 1 ${TLSA_SHA}</span>"</span></span>
        ]</span></span>
    }</span>,</span></span>
    {</span></span>
        "</span>subname</span>"</span>:</span> "</span>_dmarc</span>"</span>,</span></span>
        "</span>type</span>"</span>:</span> "</span>TXT</span>"</span>,</span></span>
        "</span>ttl</span>"</span>:</span> 3600</span>,</span></span>
        "</span>records</span>"</span>:</span> [</span></span>
            "</span>\"</span>v=DMARC1;p=quarantine;pct=100;rua=mailto:postmaster@${DOMAIN_NAME};ruf=mailto:postmaster@${DOMAIN_NAME}</span>\"</span>"</span></span>
        ]</span></span>
    }</span>,</span></span>
    {</span></span>
        "</span>subname</span>"</span>:</span> "</span>_mta-sts</span>"</span>,</span></span>
        "</span>type</span>"</span>:</span> "</span>TXT</span>"</span>,</span></span>
        "</span>ttl</span>"</span>:</span> 3600</span>,</span></span>
        "</span>records</span>"</span>:</span> [</span></span>
            "</span>\"</span>v=STSv1; id=2023042102;</span>\"</span>"</span></span>
        ]</span></span>
    }</span>,</span></span>
    {</span></span>
        "</span>subname</span>"</span>:</span> "</span>_smtp._tls</span>"</span>,</span></span>
        "</span>type</span>"</span>:</span> "</span>TXT</span>"</span>,</span></span>
        "</span>ttl</span>"</span>:</span> 3600</span>,</span></span>
        "</span>records</span>"</span>:</span> [</span></span>
            "</span>\"</span>v=TLSRPTv1; rua=mailto:postmaster@${DOMAIN_NAME}</span>\"</span>"</span></span>
        ]</span></span>
    }</span>,</span></span>
    {</span></span>
        "</span>subname</span>"</span>:</span> "</span>dkim._domainkey</span>"</span>,</span></span>
        "</span>type</span>"</span>:</span> "</span>TXT</span>"</span>,</span></span>
        "</span>ttl</span>"</span>:</span> 3600</span>,</span></span>
        "</span>records</span>"</span>:</span> [</span></span>
            "</span>\"</span>v=DKIM1; p=${DKIM_PUB_KEY}</span>\"</span>"</span></span>
        ]</span></span>
    }</span>,</span></span>
    {</span></span>
        "</span>subname</span>"</span>:</span> "</span>mta-sts</span>"</span>,</span></span>
        "</span>type</span>"</span>:</span> "</span>CNAME</span>"</span>,</span></span>
        "</span>ttl</span>"</span>:</span> 3600</span>,</span></span>
        "</span>records</span>"</span>:</span> [</span></span>
            "</span>mail.${DOMAIN_NAME}.</span>"</span></span>
        ]</span></span>
    }</span></span>
]</span></span></code></pre>Add Data to deSEC🔗</a></h1>
There are now two more environment variables necessary before the call to the deSEC API is possible.</p>

DKIM_PUB_KEY</code> is the dkim key from your mail system.

for example with amavis /usr/sbin/amavisd showkeys ${DOMAIN_NAME}</code></li>
</ul>
</li>
TLSA_HASH</code> is the sha256 hash for the TLSA</code> Record.</li>
</ul>
example call🔗</a></h2>
The shell code below shows how such a shell session looks like.</p>



  
    
      warning
    </div>
    Example</strong></span>
  </div>
  You will need to adopt the environment variables.</p>
</div>
</div>
export</span> DNSSEC_TOKEN</span>=</span>'</span>Your-DNSSEC-API-Token</span>'</span></span>
export</span> DOMAIN_NAME</span>=</span>'</span>Your-Domain</span>'</span></span>
export</span> DKIM_PUB_KEY</span>=</span>'</span>Your-DKIM-Public-Key</span>'</span></span>
export</span> TLSA_HASH</span>=</span>$(</span>openssl</span> x509</span> -</span>noout</span> -</span>pubkey</span> \</span></span>
    -</span>in</span> /etc/letsencrypt/live/</span>$</span>{</span>DOMAIN_NAME</span>}</span>/fullchain.pem</span> \</span></span>
    |</span> openssl</span> pkey</span> -</span>pubin</span> -</span>outform</span> DER</span> \</span></span>
    |</span> openssl</span> sha256</span> 2</span>>&1</span> \</span></span>
    |</span> cut</span> -</span>f2</span> -</span>d</span> '</span> '</span>)</span></span>
</span>
envsubst</span> <</span> mail-setup.json</span>|</span>curl</span> -</span>sSLX</span> PUT</span> \</span></span>
  https://desec.io/api/v1/domains/</span>$</span>{</span>DOMAIN_NAME</span>}</span>/rrsets/</span> \</span></span>
  -</span>-header</span> "</span>Authorization: Token </span>$</span>{</span>DNSSEC_TOKEN</span>}</span>"</span> \</span></span>
  -</span>-header</span> "</span>Content-Type: application/json</span>"</span> -</span>-data</span> @-</span> |</span> jq</span></span></code></pre>

Alek's Blog - mailing

Mail setup for deSEC

Introduction🔗</a></h1> This post describes how to configure the mail DNS setup for deSEC</a> via commandline.</p>

Add Data to deSEC🔗</a></h1> There are now two more environment variables necessary before the call to the deSEC API is possible.</p> DKIM_PUB_KEY</code> is the dkim key from your mail system. for example with amavis /usr/sbin/amavisd showkeys ${DOMAIN_NAME}</code></li> </ul> </li>

Introduction🔗</a></h1>
This post describes how to configure the mail DNS setup for deSEC</a> via commandline.</p>