Question Trouble securing both plesk and email

[michaeljoseph01]

Server operating system version

Ubuntu 22.04

Plesk version and microupdate number

18.0.53

I'm trying to get this mail server configured correctly.

My original config was working but microsoft would not deliver my emails at all and when testing with the mxtool email deliverability tool, it was showing an SPF Fail because it was evaluating the spf record against the localhost address of 127.0.0.1 for some reason. Anyways, one thing at a time... So as of right now this is what my setup looks like:

DNS handled by cloudflare
Server1 Ubuntu/plesk/litespeed setup serving domain.com web traffic behind cloudflare proxy
Server2 Ubuntu/plesk/postfix/dovecot setup with hosting set to "no hosting" serving mail traffic only. Plesk hostname of louie.domain.com, Cloudflare MX record for mail.domain.com points to this server
PTR record @ VPS host of mail.domain.com also points to Server2 IP

It's my understanding that plesk will automatically issue an ssl cert for the plesk hostname to secure the admin connection. This is fine.
But now, and maybe im missing something, but I can't figure out how to secure the mail traffic? I can "reissue" and enter mail.domain but then it breaks the https://louie.domain:8443 admin connection

What do I do here to get the louie.domain admin connection and the mail.domain smtp connections secured? Previously I had my plesk hostname and the mx record both set to the same thing and that's when I had the spf localhost fail errors so thats when I changed things up.

I know that self-managing email in 2023 is an uphill battle so Im considering offloading this to one of the big guys. I know how that works for marketing emails, but does that include individual replies? Say if you get an email through a contact form, would you reply through the email service?

 

[Kaspar]

I am not sure were server 1 fits in to your issue, so I'll focus on server 2. Let's handle the practical things first. If the host name of server 2 is louie.domain.com, then the PTR (reverse DNS) should point to louie.domain.com too. Your SPF record for domain.com should at least contain the a:louie.domain.com mechanism (you can add additional mechanisms if mail also gets send form different servers or services). On Tools & settings > Mail Server Settings, the Outgoing mail mode setting should be set to "Send from domain IP addresses" (which is the default setting).

You can secure Plesk access (https://louie.domain:8443) via Tools & Settings > SSL/TLS Certificates. This should secure the mail server too. Which you can check on the same settings page on "Certificate for securing mail". (See image below). If it's not, set is manuallt and pick the Lets Encrypt certificate from server pool.

After that, you can use louie.domain.com as host for secure SMTP connections.

I know that self-managing email in 2023 is an uphill battle so Im considering offloading this to one of the big guys. I know how that works for marketing emails, but does that include individual replies? Say if you get an email through a contact form, would you reply through the email service?

It all depends on how to configured email on your server. See this knowledgebase article on how to configure postfix to relay all email to an external email service, like SendGrid. https://support.plesk.com/hc/en-us/articles/12377374645655