Config DKIM for Zimbra Mail Server with cloudflare DNS

 1. Generate DKIM https://dmarcly.com/tools/dkim-record-generator

    - Domain: mail.yourdomain.com
    - DKIM selector: key1
    - DKIM key length: 2048

2. Add new record at cloudflare

    - Type: TXT Name: key1._domainkey Content: "v=DKIM1; h=sha256; k=rsa; s=email; " "p=MIIBIjANBgkqhkiG9*****47/dk/Hg" "RUtXY55ENGs693W7ad4VDew6Uwr+2DVHN6****b+wIDAQAB"

3. Verify config https://mxtoolbox.com/dkim.aspx

    - Domain Name: yourdomain.com
    - Selector: key1

Read More

Install Zimbra Mail Server Ubuntu 20.04

 1. Setup domain

    - Type: A Host: mail Value: public IP
    - Type: MX Host: @ Value: mail.youdomain.com

2. Update & Upgrade your Ubuntu Server

    - sudo -i
    - apt update && apt upgrade -y 

3. Set Hostname & host

    - hostnamectl set-hostname mail.yourdomain.com
    - sudo -i
    - nano /etc/hosts
        PublicIP mail.yourdomain.com

4. Install DNSmasq & disable systemd-resolve

    - systemctl disable systemd-resolved
    - systemctl stop systemd-resolved
    - ls -lh /etc/resolv.conf
    - rm -f /etc/resolv.conf
    - nano /etc/resolv.conf
        nameserver 8.8.8.8
    - apt install dnsmasq -y

5. Config DNSmasq

    - cp /etc/dnsmasq.conf /etc/dnsmasq.conf.bak
    - nano /etc/dnsmasq.conf
        server= PublicIP
        domain= yourdomain.com
        mx-host= yourdomain.com, mail.yourdomain.com, 5
        mx-host= mail.yourdomain.com, mail.yourdomain.com, 5
        listen-address=127.0.0.1
    - dig -t A mail.yourdomain.com
    - dig -t MX yourdomain.com

6. Install Zimbra

    - wget https://files.zimbra.com/downloads/8.8.15_GA/zcs-8.8.15_GA_4179.UBUNTU20_64.20211118033954.tgz
    - tar xvzf zcs-8.8.15_GA_4179.UBUNTU20_64.20211118033954.tgz
    - cd zcs-8.8.15_GA_4179.UBUNTU20_64.20211118033954
    - ./install.sh (choice Y, waiting full done)

7. Set admin password

    - choice zimbra-store
    - choice Admin Password (set password)
    - r (back to menu)
    - a (to apply)
    - yes

8. Done, access with browser

    - https://mail.yourdomain.com:7071 (Zimbra Admin, for create account etc)
    - https://mail.yourdomain.com  (Web mail GUI)

        

Read More

SSL Zimbra

sudo snap install --classic certbot

sudo ln -s /snap/bin/certbot /usr/bin/certbot

1.  sudo certbot certonly --preferred-chain "ISRG Root X1"

** change to root (use: su) **

2.  cp /etc/letsencrypt/live/mail.avdenterprises.com/privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key

3.  chown zimbra:zimbra /opt/zimbra/ssl/zimbra/commercial/commercial.key

4.  wget -O /tmp/ISRG-X1.pem https://letsencrypt.org/certs/isrgrootx1.pem.txt

5.  cat /tmp/ISRG-X1.pem >> /etc/letsencrypt/live/mail.avdenterprises.com/chain.pem

6.  cp /etc/letsencrypt/live/mail.avdenterprises.com/* /opt/zimbra/ssl/letsencrypt/

7.  chown zimbra:zimbra /opt/zimbra/ssl/letsencrypt/*

NOTE: Step 6/7 is necessary for proper permissions, otherwise it fails saying unable to read

** exit to zimbraadmin **

8.  ls -al /opt/zimbra/ssl/letsencrypt/   NOTE: Verify permissions

9. sudo /opt/zimbra/libexec/zmfixperms

** change to zimbra mail (use: sudo su zimbra -)

10. cd ~

11. /opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /opt/zimbra/ssl/letsencrypt/cert.pem /opt/zimbra/ssl/letsencrypt/chain.pem

NOTE:  Currently step 11 fails saying they do NOT match

12. /opt/zimbra/bin/zmcertmgr deploycrt comm /opt/zimbra/ssl/letsencrypt/cert.pem /opt/zimbra/ssl/letsencrypt/chain.pem

 

13. zmcontrol restart 

Source:
https://community.letsencrypt.org/t/zimbra-certbot-letsencrypt-certificate-and-private-key-do-not-match/188530/2
https://forums.zimbra.org/viewtopic.php?t=69645
https://inguide.in/how-to-install-free-ssl-certificate-on-zimbra-mail-server/

Read More