From e4ae00cd69e2651c03139487723173a0b0c9abde Mon Sep 17 00:00:00 2001
From: tfasano1 <54379134+tfasano1@users.noreply.github.com>
Date: Wed, 17 Jan 2024 01:56:33 -0500
Subject: [PATCH 1/5] Add spf arg to lower gmail false positive spam

---
 emailwiz.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/emailwiz.sh b/emailwiz.sh
index ce8e1f5..98151fd 100644
--- a/emailwiz.sh
+++ b/emailwiz.sh
@@ -347,10 +347,14 @@ for x in opendkim dovecot postfix fail2ban; do
 	systemctl enable "$x"
 done
 
+# In some cases, big name email services favor an spf record with certain mechanisms included.
+# See http://www.open-spf.org/SPF_Record_Syntax
+mailip=ip4:$(ping -c 1 $domain | grep -m1 -Eo '([0-9]+\.){3}[0-9]+')
+
 pval="$(tr -d '\n' <"/etc/postfix/dkim/$domain/$subdom.txt" | sed "s/k=rsa.* \"p=/k=rsa; p=/;s/\"\s*\"//;s/\"\s*).*//" | grep -o 'p=.*')"
 dkimentry="$subdom._domainkey.$domain	TXT	v=DKIM1; k=rsa; $pval"
 dmarcentry="_dmarc.$domain	TXT	v=DMARC1; p=reject; rua=mailto:dmarc@$domain; fo=1"
-spfentry="$domain	TXT	v=spf1 mx a:$maildomain -all"
+spfentry="$domain	TXT	v=spf1 mx a:$maildomain ip4:$mailip -all"
 mxentry="$domain	MX	10	$maildomain	300"
 
 useradd -m -G mail dmarc

From 0aa7a8df389ea4474f5cd97c6604133c5222edf1 Mon Sep 17 00:00:00 2001
From: tfasano1 <54379134+tfasano1@users.noreply.github.com>
Date: Wed, 17 Jan 2024 02:25:46 -0500
Subject: [PATCH 2/5] Update emailwiz.sh

---
 emailwiz.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/emailwiz.sh b/emailwiz.sh
index 98151fd..3b1ee89 100644
--- a/emailwiz.sh
+++ b/emailwiz.sh
@@ -349,7 +349,7 @@ done
 
 # In some cases, big name email services favor an spf record with certain mechanisms included.
 # See http://www.open-spf.org/SPF_Record_Syntax
-mailip=ip4:$(ping -c 1 $domain | grep -m1 -Eo '([0-9]+\.){3}[0-9]+')
+mailip=$(ping -c 1 $domain | grep -m1 -Eo '([0-9]+\.){3}[0-9]+')
 
 pval="$(tr -d '\n' <"/etc/postfix/dkim/$domain/$subdom.txt" | sed "s/k=rsa.* \"p=/k=rsa; p=/;s/\"\s*\"//;s/\"\s*).*//" | grep -o 'p=.*')"
 dkimentry="$subdom._domainkey.$domain	TXT	v=DKIM1; k=rsa; $pval"

From bda15800886db4947b3f92d285e7fc5e46928134 Mon Sep 17 00:00:00 2001
From: tfasano1 <54379134+tfasano1@users.noreply.github.com>
Date: Wed, 17 Jan 2024 22:48:14 -0500
Subject: [PATCH 3/5] add ipv6 mechanism

---
 emailwiz.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/emailwiz.sh b/emailwiz.sh
index 3b1ee89..e3a3ed8 100644
--- a/emailwiz.sh
+++ b/emailwiz.sh
@@ -347,14 +347,14 @@ for x in opendkim dovecot postfix fail2ban; do
 	systemctl enable "$x"
 done
 
-# In some cases, big name email services favor an spf record with certain mechanisms included.
-# See http://www.open-spf.org/SPF_Record_Syntax
-mailip=$(ping -c 1 $domain | grep -m1 -Eo '([0-9]+\.){3}[0-9]+')
+# Generate spf mechanisms
+mailip4=$(host "$domain" | grep -m1 -Eo '([0-9]+\.){3}[0-9]+')
+mailip6=$(host "$domain" | grep "IPv6" | awk '{print $NF}')
 
 pval="$(tr -d '\n' <"/etc/postfix/dkim/$domain/$subdom.txt" | sed "s/k=rsa.* \"p=/k=rsa; p=/;s/\"\s*\"//;s/\"\s*).*//" | grep -o 'p=.*')"
 dkimentry="$subdom._domainkey.$domain	TXT	v=DKIM1; k=rsa; $pval"
 dmarcentry="_dmarc.$domain	TXT	v=DMARC1; p=reject; rua=mailto:dmarc@$domain; fo=1"
-spfentry="$domain	TXT	v=spf1 mx a:$maildomain ip4:$mailip -all"
+spfentry="$domain	TXT	v=spf1 mx a:$maildomain ip4:$mailip4 ip6:$mailip6 -all"
 mxentry="$domain	MX	10	$maildomain	300"
 
 useradd -m -G mail dmarc

From 3dd706e5a811d9681c55ce134741788bb6f6b82b Mon Sep 17 00:00:00 2001
From: tfasano1 <54379134+tfasano1@users.noreply.github.com>
Date: Wed, 24 Jan 2024 10:22:11 -0500
Subject: [PATCH 4/5] Add checks with helpful debug information

---
 emailwiz.sh | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/emailwiz.sh b/emailwiz.sh
index e3a3ed8..d3212ab 100644
--- a/emailwiz.sh
+++ b/emailwiz.sh
@@ -23,6 +23,12 @@ subdom=${MAIL_SUBDOM:-mail}
 maildomain="$subdom.$domain"
 certdir="/etc/letsencrypt/live/$maildomain"
 
+# Preliminary record checks
+ipv4=$(host "$domain" | grep -m1 -Eo '([0-9]+\.){3}[0-9]+')
+[ -z "$ipv4" ] && echo "\033[0;31mPlease point your domain ("$domain") to your server's ipv4 address."
+ipv6=$(host "$domain" | grep "IPv6" | awk '{print $NF}')
+[ -z "$ipv6" ] && echo "\033[0;31mPlease point your domain ("$domain") to your server's ipv6 address."
+
 # Open required mail ports, and 80, for Certbot.
 for port in 80 993 465 25 587; do
 	ufw allow "$port" 2>/dev/null
@@ -347,14 +353,10 @@ for x in opendkim dovecot postfix fail2ban; do
 	systemctl enable "$x"
 done
 
-# Generate spf mechanisms
-mailip4=$(host "$domain" | grep -m1 -Eo '([0-9]+\.){3}[0-9]+')
-mailip6=$(host "$domain" | grep "IPv6" | awk '{print $NF}')
-
 pval="$(tr -d '\n' <"/etc/postfix/dkim/$domain/$subdom.txt" | sed "s/k=rsa.* \"p=/k=rsa; p=/;s/\"\s*\"//;s/\"\s*).*//" | grep -o 'p=.*')"
 dkimentry="$subdom._domainkey.$domain	TXT	v=DKIM1; k=rsa; $pval"
 dmarcentry="_dmarc.$domain	TXT	v=DMARC1; p=reject; rua=mailto:dmarc@$domain; fo=1"
-spfentry="$domain	TXT	v=spf1 mx a:$maildomain ip4:$mailip4 ip6:$mailip6 -all"
+spfentry="$domain	TXT	v=spf1 mx a:$maildomain ip4:$ipv4 ip6:$ipv6 -all"
 mxentry="$domain	MX	10	$maildomain	300"
 
 useradd -m -G mail dmarc

From e58b2bf426fe102211a5af6a41178923c73bc120 Mon Sep 17 00:00:00 2001
From: tfasano1 <54379134+tfasano1@users.noreply.github.com>
Date: Wed, 24 Jan 2024 10:25:42 -0500
Subject: [PATCH 5/5] exit when records aren't setup

---
 emailwiz.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/emailwiz.sh b/emailwiz.sh
index d3212ab..b525e59 100644
--- a/emailwiz.sh
+++ b/emailwiz.sh
@@ -25,9 +25,9 @@ certdir="/etc/letsencrypt/live/$maildomain"
 
 # Preliminary record checks
 ipv4=$(host "$domain" | grep -m1 -Eo '([0-9]+\.){3}[0-9]+')
-[ -z "$ipv4" ] && echo "\033[0;31mPlease point your domain ("$domain") to your server's ipv4 address."
+[ -z "$ipv4" ] && echo "\033[0;31mPlease point your domain ("$domain") to your server's ipv4 address." && exit 1
 ipv6=$(host "$domain" | grep "IPv6" | awk '{print $NF}')
-[ -z "$ipv6" ] && echo "\033[0;31mPlease point your domain ("$domain") to your server's ipv6 address."
+[ -z "$ipv6" ] && echo "\033[0;31mPlease point your domain ("$domain") to your server's ipv6 address." && exit 1
 
 # Open required mail ports, and 80, for Certbot.
 for port in 80 993 465 25 587; do