Debian邮件服务器怎么部署

下面给你一个在 Debian 上部署邮件服务器（SMTP + IMAP/POP3）的完整实战流程，适合生产环境，基于 Postfix + Dovecot + MariaDB + Let’s Encrypt。

一、部署前准备

1️⃣ 系统要求

cat /etc/debian_version

推荐：

• Debian 11 / 12
• 2GB+ 内存
• 固定公网 IP
• 已解析的域名（如 mail.example.com）

2️⃣ 域名与 DNS 设置（关键）

假设你的域名是：

example.com

✅ 必须配置的 DNS 记录

✅ PTR 反向解析（必须）

• 向你的 VPS / IDC 申请
• IP 反解析为 mail.example.com

二、安装基础组件

apt update
apt install -y \
postfix \
dovecot-core dovecot-imapd dovecot-pop3d \
dovecot-mysql \
mariadb-server \
postfix-mysql \
certbot python3-certbot-nginx

三、数据库配置（虚拟用户）

1️⃣ 初始化 MariaDB

mysql_secure_installation

2️⃣ 创建数据库和用户

CREATE DATABASE mailserver;
GRANT ALL ON mailserver.* TO 'mailuser'@'localhost' IDENTIFIED BY 'StrongPassword';
FLUSH PRIVILEGES;

3️⃣ 创建表结构

USE mailserver;

CREATE TABLE domains (
  id INT AUTO_INCREMENT PRIMARY KEY,
  domain VARCHAR(50) NOT NULL UNIQUE
);

CREATE TABLE users (
  id INT AUTO_INCREMENT PRIMARY KEY,
  domain_id INT NOT NULL,
  email VARCHAR(100) NOT NULL UNIQUE,
  password VARCHAR(255) NOT NULL,
  FOREIGN KEY (domain_id) REFERENCES domains(id)
);

CREATE TABLE aliases (
  id INT AUTO_INCREMENT PRIMARY KEY,
  source VARCHAR(100),
  destination VARCHAR(100)
);

四、Postfix 配置（SMTP）

1️⃣ 主配置 /etc/postfix/main.cf

myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
inet_interfaces = all
inet_protocols = ipv4

mydestination = localhost

virtual_mailbox_domains = mysql:/etc/postfix/mysql-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-users.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-aliases.cf

virtual_mailbox_base = /var/mail/vhosts
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000

smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_use_tls = yes
smtpd_tls_auth_only = yes

smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes

smtpd_recipient_restrictions =
  permit_sasl_authenticated,
  permit_mynetworks,
  reject_unauth_destination

2️⃣ MySQL 查询文件

/etc/postfix/mysql-domains.cf

user = mailuser
password = StrongPassword
dbname = mailserver
query = SELECT domain FROM domains WHERE domain='%s'

/etc/postfix/mysql-users.cf

user = mailuser
password = StrongPassword
dbname = mailserver
query = SELECT email FROM users WHERE email='%s'

/etc/postfix/mysql-aliases.cf

user = mailuser
password = StrongPassword
dbname = mailserver
query = SELECT destination FROM aliases WHERE source='%s'

五、Dovecot 配置（IMAP / POP3）

1️⃣ /etc/dovecot/dovecot.conf

protocols = imap pop3
listen = *

2️⃣ /etc/dovecot/conf.d/10-mail.conf

mail_location = maildir:/var/mail/vhosts/%d/%n

3️⃣ /etc/dovecot/conf.d/10-auth.conf

disable_plaintext_auth = no
auth_mechanisms = plain login

!include auth-sql.conf.ext

4️⃣ /etc/dovecot/conf.d/auth-sql.conf.ext

passdb {
  driver = sql
  args = /etc/dovecot/dovecot-sql.conf.ext
}

userdb {
  driver = static
  args = uid=5000 gid=5000 home=/var/mail/vhosts/%d/%n
}

5️⃣ /etc/dovecot/dovecot-sql.conf.ext

driver = mysql
connect = host=127.0.0.1 dbname=mailserver user=mailuser password=StrongPassword
default_pass_scheme = SHA256-CRYPT
password_query = SELECT email AS user, password FROM users WHERE email='%u'

六、SSL 证书（Let’s Encrypt）

certbot certonly --standalone -d mail.example.com

自动续期：

systemctl enable certbot.timer

七、创建虚拟用户目录

groupadd -g 5000 vmail
useradd -g vmail -u 5000 vmail -d /var/mail/vhosts -m

mkdir -p /var/mail/vhosts
chown -R vmail:vmail /var/mail/vhosts

八、启动服务

systemctl restart postfix dovecot
systemctl enable postfix dovecot

九、测试邮件服务器

1️⃣ 发信测试

telnet mail.example.com 25

2️⃣ 用邮件客户端

• IMAP: mail.example.com 993（SSL）
• SMTP: mail.example.com 587（STARTTLS）
• 账号：user@example.com

十、反垃圾 & 安全（强烈建议）

✅ 安装：

apt install spamassassin clamav

✅ 配置：

• SPF / DKIM / DMARC
• Fail2ban
• 限制发信频率

十一、常见问题

❌ 25 端口被封

• 云厂商默认封 25
• 解决：申请解封或使用中继（SMTP Relay）

❌ 能发不能收

• 检查 MX 记录
• Dovecot 是否监听 143/993

❌ 被当垃圾邮件

• 缺 PTR / SPF / DKIM

十二、总结架构

Postfix (SMTP)
   ↓
Dovecot (IMAP/POP3)
   ↓
MariaDB (用户)
   ↓
Let's Encrypt (SSL)

如果你愿意，我可以： ✅ 给你 一键部署脚本
✅ 帮你 排查具体报错
✅ 配置 DKIM / 反垃圾
✅ 用 Docker 方式部署

只要告诉我你目前的 Debian 版本和网络环境即可。