Translated from 日本語 • View original Hello. This is Komiya from the platform. A while ago, I used AmazoneSES to set up email sending via SMTP relay, so I would like to publish the record.
*Try SMTP relay instead of SDK. (Because to use the SDK, you need to use ruby in the server.) )
★Request Production Access to Simple Email There is a button called "RequestProductionAccess" on the SES service dashboard, press it and you will be taken to the contact screen, where you can enter the required information (name, service domain, email address, email usage, etc.) Request Production Access to Simple Email Service (Inquiry) When you enter and submit, you will receive an English message saying "Thank you for your request, we will review it so that you can use it as soon as possible, so please read the manual and wait."
The day after the application, I checked the SES dashboard and found the following markings
Your Amazon SES Sending Limits
Sending Quota: send 10000 emails per 24 hour period
Quota Used: 0% as of 2013-03-08 10:53 UTC+9
Max Send Rate: 5 emails/second
It is possible to send up to 10,000 messages in 24 hours, the current usage rate is 0%, and the maximum transmission rate is 5 messages per second.
I was told that the sender was as follows → When registering as a member, I sent an email saying "no_reply@hoge.jp", When I made an inquiry, I received (forwarded) an email called "support@hoge.jp",
It was discovered that MX records were needed to receive them. Set separately. It seems that the securitygroup also has to be fully opened at number 25.
For the time being, the email address from which SES will be sent must be registered with Verified Senders, so register the following:
no_reply@hoge.jp support@hoge.jp no_reply@stg.hoge.jp support@stg.hoge.jp
When I registered with Verified Senders, it seems that it is useless if I can't receive it, because it is said that "if you receive an email, you will be included in the confirmed sender list".
You have successfully sent a verification email to no_reply@hoge.jp.
It may take up to an hour for the verification email to arrive in this user's inbox.
When the user opens this email message and verifies the address, it will appear in your "Verified Senders" list.
Status:
pending verification
The resend link is out.
★ I changed the domain name of postfix with permission.
STG environment: hoge.jp→stg.hoge.jp Production environment: www.hoge.jp→hoge.jp *It was a request to hoge.jp both the STG environment and the production environment, but it was not successful in transmitting when the domain was the same and it was relayed. Mail guru senior opinion:
・What can be thought of if the domain is the same: The source is sent to the relay server by xxx@a.com. I think there is a high possibility that the relay will recognize the a.com as its own domain and deliver it locally and not put it out、、、
Web side
vi /etc/postfix/main.cf
# diff /etc/postfix/main.cf{,.`date +%Y%m%d`}
76c76
< myhostname = hoge.jp
---
> myhostname = www.hoge.jp
318c318
< relayhost = [stg.hoge.jp]
---
> relayhost = [10.122.4.56]
# service postfix reload
Reloading postfix: [ OK ]
STG side hoge.jp→stg.hoge.jp will be changed later along with other settings.
★Add SMTP account (to receive VerifySenders emails)
mkdir -p /etc/skel/Maildir/{tmp,cur,new}
useradd -s /sbin/nologin no_reply
useradd -s /sbin/nologin support
tail -3 /etc/passwd
no_reply:x:1002:1002::/home/no_reply:/sbin/nologin
support:x:1003:1003::/home/support:/sbin/nologin
passwd no_reply
passwd support
*If you create an account without forgetting to create a directory in SKEL first.
mkdir -p /home/{no_reply,support}/Maildir/{tmp,cur,new}
chown -R no_reply. /home/no_reply/Maildir
chown -R support. /home/support/Maildir
If it is reserved in the alias file and the email is set to go to root, fix it as follows.
vi /etc/aliases
#support: postmaster
★MX Registration
cd /var/named/var/named/zone
# cp -p hoge.jp.zone Backup/hoge.jp.zone.20130308
# diff hoge.jp.zone Backup/hoge.jp.zone.20130308
3c3
< 2013030801 ; serial
---
> 2013030701 ; serial
17,18d16
< hoge.jp. IN MX 10 hoge.jp.
< stg.hoge.jp. IN MX 20 stg.hoge.jp.
/usr/local/sbin/named-checkzone hoge.jp /var/named/var/named/zone/hoge.jp.zone
zone hoge.jp/IN: loaded serial 2013030801
OK
# ps -ef|grep named
named 7323 1 0 2011 ? 2-09:26:44 /usr/local/sbin/named -u named -t /var/named
reload named
★Create an SMTPCredential: Select SMTP Settings in Navigation, press CreateMySMTP Credentials, modify the username if necessary, and create IAM for SMTP.
ses-smtp-user
SMTP Username:
AKIAJGYLX2Z3E*********
SMTP Password:
AivJPK/r95RFbjm+z1vApHSAacUnA90SqhU*********
*Use this as saslpassword later.
The MTA information of Amazon SES is displayed as follows
Server Name: email-smtp.us-east-1.amazonaws.com
Port: 25, 465 or 587
Use Transport Layer Security (TLS): Yes
Authentication: Your SMTP credentials - see below.
★Try SMTP linkage Put the necessary packages
sudo yum -y install mailx stunnel system-switch-mail
Installed:
stunnel.x86_64 0:4.29-2.el6
*mailx is included, and system-switch-mail has no package, so switch with alternatives --config mta. (No switching is required because only postfix is included)
Set up stunnel (amazonses.com email MTA and SSL tunnel)
vi /etc/stunnel/stunnel.conf
-----
[smtp-tls-wrapper]
accept = 2525
client = yes
connect = email-smtp.us-east-1.amazonaws.com:465
-----
*Set the Amazon SES MTA information displayed earlier.
Launch
stunnel /etc/stunnel/stunnel.conf
Then the port opened as follows.
# netstat -lnpt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 8029/mysqld
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 14206/httpd
tcp 0 0 0.0.0.0:4949 0.0.0.0:* LISTEN 15963/perl
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 871/sshd
tcp 0 0 10.122.4.56:25 0.0.0.0:* LISTEN 20141/master
tcp 0 0 127.0.0.1:8891 0.0.0.0:* LISTEN 15222/dkim-filter
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 14206/httpd
tcp 0 0 0.0.0.0:2525 0.0.0.0:* LISTEN 29423/stunnel ← this
It is dangerous to start the command*, so prepare a startup script and set it to auto-start
curl -L http://www.gaztronics.net/rc/stunnel.txt > /etc/init.d/stunnel
chmod 755 /etc/init.d/stunnel
vi /etc/init.d/stunnel
----
SEXE=/usr/sbin/stunnel
↓
SEXE=/usr/bin/stunnel
----
chkconfig --add stunnel
chkconfig stunnel on
chkconfig --list| grep 3:on
ps -ef
pkill stunnel
ps -ef
service stunnel start
netstat -lnpt; ps -ef
*The process file is not erased and cannot be automatically started next time, and various problems may occur.
Set the MTA side of the staging to relay to SES (*The production environment is relayed to staging)
cp /etc/postfix/main.cf{,.`date +%Y%m%d`}
vi /etc/postfix/main.cf
--
relayhost = 127.0.0.1:2525
#smtp_sender_dependent_authentication = yes
smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = may
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
--
diff /etc/postfix/main.cf{,.`date +%Y%m%d`}
Set IAM access and secret keys for SES as sasl passwords
vi /etc/postfix/sasl_passwd
cat /etc/postfix/sasl_passwd
---
127.0.0.1:2525 AKIAJGYLX2Z3EUK*****:AivJPK/r95RFbjm+z1vApHSAacUnA90SqhU+IB******
---
Sanko:127.0.0.1:2525 YOUR_SMTP_USERNAME:YOUR_SMTP_PASSWORD
postmap hash:/etc/postfix/sasl_passwd
rm /etc/postfix/sasl_passwd
service postfix restart
*Remove the milter if it is not relayed to SES. (Because I had set dkim-milter in staging)
★Verified Senders Certification
*If you have an account and its email directory, the hosts and dns name resolution is going well, the MX record of the domain you want to receive is registered, and you check in advance that port 25 (and 465 and 587 are also required) are fully open in SecurityGroup, and then register Verified Senders, you will receive an email as follows.
# ll /home/no_reply/Maildir/new
Total 4
-rw------- 1 no_reply no_reply 1684 11:13 Mar 11, 2013 1362968004.Vca41I6309dM300065.hoge-stg01
# ll /home/support/Maildir/new
Total 4
-rw------- 1 support support 1679 11:13, 11 March 2013 1362968012.Vca41I6309eM30768.hoge-stg01
If you look at the contents and refer to the URL,
# view /home/support/Maildir/new/1362968012.Vca41I6309eM30768.hoge-stg01
===================================
Dear Amazon SES customer:
We have received a request to authorize an email address for use with Amazon SES
. To confirm that you are authorized to use this email address, please go to th
e following URL:
https://email-verification.us-east-1.amazonaws.com/~Omitted~
Your request will not be processed unless you confirm the address using this URL. This link expires 24 hours after your original verification request.
To learn more about sending email from Amazon SES, please refer to the Amazon SES Developer Guide.
Sincerely, Amazon Web Services
===================================
Congratulations!
Your email address has been verified in Amazon Simple Email Service. You can now start sending emails from this address.
If you're new to Amazon SES and haven't received production access to Amazon SES yet, you can only send emails to verified addresses.
To see a list of verified email addresses, visit the AWS Management Console or see the Amazon SES Developer Guide.
If you've already been approved for production access, you can send an email to any address.
Thank you for using Amazon SES.
===================================
This message will be displayed, so repeat this as many times as you registered.
The status of the account registered with Verified Senders will be verified.
★Saving DKIM (DomainKeyIdentifiedMail) in SES
Try domain authentication There is a Domains tab next to the EmailAddresses tab of Verified Senders, select it and let it appear In VerifyNewDomain, enter the hoge.jp in Domain: and check Generate DKIM Settings and press the VerifyThisDomain button If you click the domain hoge.jp has been added to the list of Verified Senders with a Status of "pending verification". Further action is needed to complete verification of this domain. See details below. There are several records, so press the link to copy them. (There is also a download link in CSV) stg.hoge.jp do the same. The CSV download is as follows.
Record name Record type Record Value
_amazonses.stg.hoge.jp TXT y8KcO9LXHuhPI4Cq5AyLiupqmLkL3heDHtPMvm1dIWQ=
vbprbshhpghfchslva**************._domainkey.stg.hoge.jp CNAME vbprbshhpghfchslva**************.dkim.amazonses.com
rxbb6kw5kowwwvwaob**************._domainkey.stg.hoge.jp CNAME rxbb6kw5kowwwvwaob**************.dkim.amazonses.com
5hh6n54jqgxlcmqv5s**************._domainkey.stg.hoge.jp CNAME 5hh6n54jqgxlcmqv5s**************.dkim.amazonses.com
DNS registration
# cd /var/named/var/named/zone
# cp -p hoge.jp.zone Backup/hoge.jp.zone.20130311
# diff hoge.jp.zone Backup/hoge.jp.zone.20130311
3c3
< 2013031101 ; serial
---
> 2013030801 ; serial
19,27d18
< ; for amazon sns
< _amazonses IN TXT "16WLDm8JwrqC0k7/TFMhjHB246CeD2wV+6QLC4FxUFc="
< pbwpmydtc6ui65thcl**************._domainkey IN CNAME pbwpmydtc6ui65thcl**************.dkim.amazonses.com.
< 6zuapajg5fmtcvlcb3**************._domainkey IN CNAME 6zuapajg5fmtcvlcb3**************.dkim.amazonses.com.
< wiewjgibezmoyvtxyx**************._domainkey IN CNAME wiewjgibezmoyvtxyx**************.dkim.amazonses.com.
< _amazonses.stg IN TXT "y8KcO9LXHuhPI4Cq5AyLiupqmLkL3heDHtPMvm1dIWQ="
< vbprbshhpghfchslva**************._domainkey.stg IN CNAME vbprbshhpghfchslva**************.dkim.amazonses.com.
< rxbb6kw5kowwwvwaob**************._domainkey.stg IN CNAME rxbb6kw5kowwwvwaob*************.dkim.amazonses.com.
< 5hh6n54jqgxlcmqv5s**************._domainkey.stg IN CNAME 5hh6n54jqgxlcmqv5s**************.dkim.amazonses.com.
# /usr/local/sbin/named-checkzone hoge.jp /var/named/var/named/zone/hoge.jp.zone
zone hoge.jp/IN: loaded serial 2013031101
OK
# ps -ef|grep named|grep -v grep
named 7323 1 0 2011 ? 2-09:47:31 /usr/local/sbin/named -u named -t /var/named
Get third-party verification here
# kill -HUP 7323 && tail -f .. /.. /log/named.log
dig +noall +answer _amazonses.hoge.jp txt
dig +noall +answer _amazonses.stg.hoge.jp txt
dig +noall +answer pbwpmydtc6ui65thcl**************._domainkey.hoge.jp cname
dig +noall +answer 6zuapajg5fmtcvlcb3**************._domainkey.hoge.jp cname
dig +noall +answer wiewjgibezmoyvtxyx**************._domainkey.hoge.jp cname
dig +noall +answer vbprbshhpghfchslva**************._domainkey.stg.hoge.jp cname
dig +noall +answer rxbb6kw5kowwwvwaob**************._domainkey.stg.hoge.jp cname
dig +noall +answer 5hh6n54jqgxlcmqv5s**************._domainkey.stg.hoge.jp cname
It should be propagated in about 10 minutes.
Since the status of Verified Sender: Domain was success, press the enable link in the DKIM tab.
*It seems that you have to do both email source authentication and domain authentication.
・Try sending an email
Email sending route: hoge-web01→hoge-stg01→amazonses.com→ client (for exams, to gmail, etc.)
# cat testmail.sh
-----------------------------
#!/bin/bash
set -e
DATE=`date '+%Y%m%d.%H%M'`
HENKAN="/usr/bin/iconv -f UTF-8 -t ISO-2022-JP"
## mail
SUBJ="mailsend-test $1 "$DATE""
#mail_to=******@isao.co.jp'
#mail_to=******_y@ezweb.ne.jp'
mail_to=***_****_k@i.softbank.jp'
mail_from='no_reply@hoge.jp'
mail_err='support@hoge.jp'
mail_subj="$SUBJ"
$HENKAN <<EOF | mailx -t
To: $mail_to
CC: $mail_cc
BCC: $mail_bcc
From: $mail_from
Subject: $mail_subj
test "$1"
***
TEL:XX-XXXX-XXXX
EOF
exit 0
-----------------------------
While changing the mail_to, I confirmed that it would arrive in gmail, iPhone, and au garake.
# sudo -u no_reply ./testmail.sh 6
# sudo -u support ./testmail.sh 1
*Test STG and production environments separately.
Check your Gmail email headers.
★ Failure history Mar 11 14:14:19 ip-10-122-4-56 postfix/smtpd[8876]: connect from unknown[54.249.xxx.xxx] and it doesn't arrive. It seems that you need to put the outer EIP in mynetworks.
# sudo -u no_reply ./testmail.sh 2
Mar 11 14:31:14 ip-10-122-4-56 postfix/smtp[9573]: B754C24210: to=<no_reply@hoge.jp>, relay=127.0.0.1[127.0.0.1]:2525, delay=1.3, delays=0.01/0/1/0.21, dsn=5.0.0, status= bounced (host 127.0.0.1[127.0.0.1] said: 530 Authentication required (in reply to MAIL FROM command))
Apparently, SASL password authentication has failed.
# diff main.cf{,.`date +%Y%m%d`}
321c321
< #smtp_sender_dependent_authentication = yes
---
> smtp_sender_dependent_authentication = yes
687,690c687,690
< #milter_default_action = accept
< #milter_protocol = 6
< #smtpd_milters = inet:127.0.0.1:8891
< #non_smtpd_milters = inet:127.0.0.1:8891
---
> milter_default_action = accept
> milter_protocol = 6
> smtpd_milters = inet:127.0.0.1:8891
> non_smtpd_milters = inet:127.0.0.1:8891
# service postfix reload
# service dkim-milter stop
Shutting down DomainKeys Identified Mail Milter: [ OK ]
It seems that it was necessary to remove the milter when not relaying to the SES.
I have reached it now.
amazonses.com I modified the SPF record a few times because it showed up via but I only had to press the enable link in the DKIM tab even for individual email accounts in the Verified Sender: EmailAddresses tab, and when I pressed it and sent it again amazonses.com the via disappeared.
The sender was also hoge.jp domain regardless of whether it was sent from the web or STG.
★ Check the current zone information:
# cat /var/named/var/named/zone/hoge.jp.zone
$TTL 3600 ; 1 hour
@ IN SOA ns3.isao.net. Postmaster.ns3.isao.net. (
2013031104 ; serial
1800 ; refresh (30 mins)
900 ; retry (15 mins)
604800 ; expire (7 days)
600 ; minimum (10 mins)
)
IN NS ns3.isao.net.
IN NS ns4.isao.net.
IN A 54.249.235.xxx
stg IN A 54.249.238.xxx
www IN CNAME hoge.jp.
hoge.jp. IN TXT "v=spf1 +ip4:54.249.235.xxx/32 +ip4:54.249.238.xxx/32 include:amazonses.com ~all"
stg.hoge.jp. IN TXT "v=spf1 +ip4:54.249.238.xxx/32 54.249.235.xxx/32 include:amazonses.com ~all"
_policy._domainkey 7200 IN TXT "t=y\; o=~\;"
hoge_jp_selector._domainkey IN TXT "v=DKIM1\; g=*\; k=rsa\; t=y\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ*****B" ; ----- DKIM hoge_jp_selector for hoge.jp
hoge.jp. IN MX 10 hoge.jp.
stg.hoge.jp. IN MX 20 stg.hoge.jp.
; for amazon sns
_amazonses IN TXT "16WLDm8JwrqC0k7/TFMhjHB246CeD2wV+6QLC4FxUFc="
pbwpmydtc6ui65thcl**************._domainkey IN CNAME pbwpmydtc6ui65thcl**************.dkim.amazonses.com.
6zuapajg5fmtcvlcb3**************._domainkey IN CNAME 6zuapajg5fmtcvlcb3**************.dkim.amazonses.com.
wiewjgibezmoyvtxyx**************._domainkey IN CNAME wiewjgibezmoyvtxyx**************.dkim.amazonses.com.
_amazonses.stg IN TXT "y8KcO9LXHuhPI4Cq5AyLiupqmLkL3heDHtPMvm1dIWQ="
vbprbshhpghfchslva**************._domainkey.stg IN CNAME vbprbshhpghfchslva**************.dkim.amazonses.com.
rxbb6kw5kowwwvwaob**************._domainkey.stg IN CNAME rxbb6kw5kowwwvwaob**************.dkim.amazonses.com.
5hh6n54jqgxlcmqv5s**************._domainkey.stg IN CNAME 5hh6n54jqgxlcmqv5s**************.dkim.amazonses.com.
★Diff from postfix main.cf default
・hoge-stg01 (staging environment, MTA server)
# diff /etc/postfix/main.cf{,.org}
76c76
< myhostname = stg.hoge.jp
---
> #myhostname = virtual.domain.tld
83c83
< mydomain = hoge.jp
---
> #mydomain = domain.tld
114c114
< inet_interfaces = $myhostname
---
> #inet_interfaces = $myhostname
116c116
< #inet_interfaces = localhost
---
> inet_interfaces = localhost
119,120c119
< #inet_protocols = all
< inet_protocols = ipv4
---
> inet_protocols = all
268d266
< mynetworks = 54.249.238.xxx/32, 10.122.4.xxx/32, 10.121.18.xxx/32 54.249.235.xxx/32
320,325d317
< relayhost = 127.0.0.1:2525
< #smtp_sender_dependent_authentication = yes
< smtp_sasl_auth_enable = yes
< smtp_sasl_security_options = noanonymous
< smtp_tls_security_level = may
< smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
427c419
< home_mailbox = Maildir/
---
> #home_mailbox = Maildir/
685,690d676
<
< # DKIM
< #milter_default_action = accept
< #milter_protocol = 6
< #smtpd_milters = inet:127.0.0.1:8891
< #non_smtpd_milters = inet:127.0.0.1:8891
・hoge-web01 (production, SMTP client)
# diff /etc/postfix/main.cf{,.org}
76c76
< myhostname = hoge.jp
---
> #myhostname = virtual.domain.tld
83c83
< mydomain = hoge.jp
---
> #mydomain = domain.tld
114c114
< inet_interfaces = $myhostname
---
> #inet_interfaces = $myhostname
116c116
< #inet_interfaces = localhost
---
> inet_interfaces = localhost
119,120c119
< #inet_protocols = all
< inet_protocols = ipv4
---
> inet_protocols = all
318c317
< relayhost = [stg.hoge.jp]
---
> #relayhost = [an.ip.add.ress]
420c419
< home_mailbox = Maildir/
---
> #home_mailbox = Maildir/
678d676
<
★ Reference: Amazon Simple Email Service Developer Guide
Sending Emails with SES Using the SDK Email Sending Program with Attachments Using the AWS SDK for Ruby (Sample)
Sending Emails in SES Using the SMTP Interface Summary of Using Amazon SES as an SMTP Interface Startup Script for stunnel Configuring Amazon SES
Easy DKIM with SES
How to eliminate "via amazonses.com" emails sent with Amazon SES
SASL Authentication with Postfix as an SMTP Client SASL Authentication with Postfix as an SMTP Client Postfix SASL How to Configure Mail Relay with Postfix (SMTP Client + SMTP Auth) How to Use Amazon SES SMTP Server to Send Emails 530 Authentication required (in reply to MAIL FROM command)