在 Go 中构建您自己的 SMTP 服务器

在 Valyent，我们正在为开发人员构建开源软件。

作为此使命的一部分，我们目前正在开发 Ferdinand，这是我们为开发者提供的电子邮件发送服务（目前处于 alpha 阶段）。

电子邮件基础设施依赖于几个关键协议，其中最重要的是：

1. SMTP（简单邮件传输协议）：用于在邮件服务器之间发送和接收电子邮件。
2. IMAP（互联网消息访问协议）：允许用户直接从服务器阅读和管理电子邮件。
3. POP3（邮局协议版本 3）：将电子邮件从服务器下载到本地设备，通常将它们从服务器中删除。

在今天的文章中，我们将重点关注构建我们自己的出站 SMTP 服务器，反映我们对 Ferdinand 采取的方法。通过这样做，我们将深入了解电子邮件发送基础设施中最关键的组件。

“我无法创造的东西，我就不明白。”

— 理查德·费曼

通过从头开始构建出站 SMTP 服务器，您可以深入了解大多数开发人员无法实现的电子邮件传送。

为了继续，我们将使用 Go 编程语言以及 Simon Ser 提供的出色的邮件库。我们将揭开这个过程的神秘面纱，向您展示如何将电子邮件发送到其他服务器，甚至解释 SPF、DKIM 和 DMARC 等关键概念以实现可交付性。

到最后，尽管没有可用于生产的 SMTP 服务器，您至少会对电子邮件基础设施有更深入的了解。

了解 SMTP：基础知识

在深入研究代码之前，我们先回顾一下 SMTP 是什么以及它是如何工作的。 SMTP（简单邮件传输协议）是通过 Internet 发送电子邮件的标准协议。这是一个相对简单的基于文本的协议，在客户端-服务器模型上运行。

SMTP 命令

SMTP 协议使用命令。 SMTP 中的每个命令在电子邮件传输过程中都有特定的用途。它们允许服务器自我介绍、指定发件人和收件人、传输实际的电子邮件内容以及管理整个通信会话。将这些命令视为两个电子邮件服务器之间的结构化对话，其中每个命令代表该对话中的特定陈述或问题。

当您构建 SMTP 服务器时，您实际上是在创建一个可以流利地说这种语言的程序，解释传入的命令并做出适当的响应，以及在发送电子邮件时发出正确的命令。

让我们探索最重要的 SMTP 命令，看看这个对话是如何展开的：

• HELO/EHLO（Hello）：此命令启动 SMTP 会话。 EHLO 是 SMTP 的扩展版本，支持附加功能。语法为 HELO 域或 EHLO 域。例如：EHLO example.com。
• MAIL FROM：此命令指定发件人的电子邮件地址并开始新的邮件事务。它使用语法 MAIL FROM:。例如，邮件来自：.
• RCPT TO：用于指定收件人的电子邮件地址，该命令可以针对多个收件人多次使用。语法为 RCPT TO:。例如：RCPT TO：.
• DATA：该命令表示消息内容的开始。它以仅包含单个句点 (.) 的行结束。在DATA命令之后，您可以输入消息内容。例如：

DATA
From: john@example.com
To: jane@example.com
Subject: Hello

This is the body of the email.
.

• QUIT：这个简单的命令结束 SMTP 会话。它的语法就是 QUIT。
• RSE​​T（重置）：RSET 命令中止当前邮件事务，但保持连接打开。它对于重新开始而不启动新连接很有用。语法很简单：RSET。
• AUTH（身份验证）：该命令用于向服务器验证客户端，支持各种身份验证机制。语法为AUTH机制，例如：AUTH LOGIN.

典型的 SMTP 对话可能如下所示：

C: EHLO client.example.com
S: 250-smtp.example.com Hello client.example.com
S: 250-SIZE 14680064
S: 250-AUTH LOGIN PLAIN
S: 250 HELP

C: MAIL FROM:<sender@example.com>
S: 250 OK

C: RCPT TO:<recipient@example.com>
S: 250 OK

C: DATA
S: 354 Start mail input; end with <CRLF>.<CRLF>

C: From: sender@example.com
C: To: recipient@example.com
C: Subject: Test Email
C:
C: This is a test email.
C: .

S: 250 OK: queued as 12345

C: QUIT
S: 221 Bye

SMTP 中的身份验证

身份验证是 SMTP 的一个重要方面，特别是对于出站电子邮件服务器而言。它有助于防止未经授权使用服务器并减少垃圾邮件。 SMTP 中使用了几种身份验证方法：

1. PLAIN: This is a simple authentication method where the username and password are sent in clear text. It should only be used over encrypted connections.
2. LOGIN: Similar to PLAIN, but the username and password are sent in separate commands.
3. CRAM-MD5: This method uses a challenge-response mechanism to avoid sending the password in clear text.
4. OAUTH2: This method allows the use of OAuth 2.0 tokens for authentication.

Here's an example of how PLAIN authentication looks in an SMTP conversation:

C: EHLO example.com
S: 250-STARTTLS
S: 250 AUTH PLAIN LOGIN
C: AUTH PLAIN AGVtYWlsQGV4YW1wbGUuY29tAHBhc3N3b3Jk
S: 235 2.7.0 Authentication successful

In this example, AGVtYWlsQGV4YW1wbGUuY29tAHBhc3N3b3Jk is the base64-encoded version of \0email@example.com\0password.

When implementing authentication in your SMTP server, you'll need to:

1. Advertise supported authentication methods in response to the EHLO command.
2. Implement handlers for the AUTH command that can process the chosen authentication method.
3. Verify the provided credentials against your user database.
4. Maintain the authenticated state for the duration of the SMTP session.

Now, let's move on to implementing these concepts in our Go SMTP server.

Achieving deliverability: DKIM, SPF, DMARC

Imagine sending a letter through the postal service without a return address or an official stamp. It might reach its destination, but there's a good chance it'll end up in the "suspicious mail" pile. In the digital world of email, we face a similar challenge.

How do we ensure our emails aren't just sent, but actually delivered and trusted?

Enter the holy trinity of email authentication: DKIM, SPF, and DMARC.

DKIM: Your Email's Digital Signature

DKIM (DomainKeys Identified Mail) is like a wax seal on a medieval letter. It proves the email hasn't been tampered with during transit.

How it works:

• Your email server adds a digital signature to every outgoing email.
• The receiving server checks this signature against a public key published in your DNS records.
• If the signature is valid, the email passes the DKIM check.

Think of it as your email's passport, stamped and verified at each checkpoint.

Example DKIM DNS Record:

<selector>._domainkey.<domain>.<tld>. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3QEKyU1fSma0axspqYK5iAj+54lsAg4qRRCnpKK68hawSd8zpsDz77ntGCR0X2mHVvkHbX6dX...oIDAQAB"

Here, 'selector' is a unique identifier for this DKIM key, and the long string is your public key.

SPF: The Guest List for Your Domain's Party

SPF (Sender Policy Framework) is like the bouncer at an exclusive club. It specifies which email servers are allowed to send emails on behalf of your domain.

How it works:

• You publish a list of authorized IP addresses in your DNS records.
• When an email arrives claiming to be from your domain, the receiving server checks if it came from an IP on your list.
• If it matches, the email passes the SPF check.

It's like saying, "If the email didn't come from one of these guys, it's not with us!"

Example SPF DNS Record:

<domain>.<tld>. IN TXT "v=spf1 ip4:192.0.2.0/24 include:_spf.google.com ~all"

This record says:

• Emails can come from IP addresses in the range 192.0.2.0 to 192.0.2.255.
• Emails can also come from servers specified in Google's SPF record.
• The ~all means to soft-fail emails from other sources (treat as suspicious but don't reject).

DMARC: The Rule Maker and Enforcer

DMARC (Domain-based Message Authentication, Reporting & Conformance) is the wise judge that decides what happens to emails that fail DKIM or SPF checks.

How it works:

• You set a policy in your DNS records specifying how to handle emails that fail authentication.
• Options range from "let it through anyway" to "reject it outright."
• DMARC also provides reports on email authentication results, helping you monitor and improve your email security.

Think of DMARC as your email bouncer's rulebook and incident report.

Example DMARC DNS Record:

_dmarc.<domain>.<tld>. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@<domain>.<tld>"

This record says:

• If an email fails DKIM and SPF checks, quarantine it (typically send to spam folder).
• Send aggregate reports about email authentication results to dmarc-reports@example.com.

Why This Trinity Matters

Together, DKIM, SPF, and DMARC form a powerful shield against email spoofing and phishing. They tell receiving servers, "This email is really from us, sent by someone we trust, and here's what to do if something seems fishy."

Implementing this trinity not only improves your email deliverability but also protects your domain's reputation. It's like having a state-of-the-art security system for your email infrastructure.

As we build our SMTP server, keeping these authentication methods in mind will be crucial for ensuring our emails don't just get sent, but actually reach their destination and are trusted when they arrive. Remember, when implementing these records on a production domain, start with permissive policies and gradually tighten them as you confirm everything is working correctly.

Building the SMTP Server with Go

1. Project Initialization

First, let's create a new directory for our project and initialize a Go module:

mkdir go-smtp-server
cd go-smtp-server
go mod init github.com/yourusername/go-smtp-server

2. Installing Dependencies

We'll need a few dependencies for our SMTP server. Run the following commands:

go get github.com/emersion/go-smtp
go get github.com/emersion/go-sasl
go get github.com/emersion/go-msgauth

3. Basic SMTP Server Setup

1. Create a new file named main.go and add the following code:

package main

import (
    "log"
    "time"
    "io"

    "github.com/emersion/go-smtp"
)

func main() {
    s := smtp.NewServer(&Backend{})

    s.Addr = ":2525"
    s.Domain = "localhost"
    s.WriteTimeout = 10 * time.Second
    s.ReadTimeout = 10 * time.Second
    s.MaxMessageBytes = 1024 * 1024
    s.MaxRecipients = 50
    s.AllowInsecureAuth = true

    log.Println("Starting server at", s.Addr)
    if err := s.ListenAndServe(); err != nil {
        log.Fatal(err)
    }
}

// Backend implements SMTP server methods.
type Backend struct{}

func (bkd *Backend) NewSession(_ *smtp.Conn) (smtp.Session, error) {
    return &Session{}, nil
}

// A Session is returned after EHLO.
type Session struct{}

// We'll implement the Session methods next

This creates an SMTP server, listening on the 2525 port, a convenient choice for development purposes, since this port doesn’t require administrative privileges, unlike the standard ports 25 (standard SMTP), 465 (TLS), 587 (STARTTLS).

1. Implementing EHLO/HELO

The EHLO/HELO command is handled automatically by the go-smtp library. We don't need to implement it ourselves.

1. Implementing MAIL FROM

Add this method to the Session struct:

func (s *Session) Mail(from string, opts *smtp.MailOptions) error {
    fmt.Println("Mail from:", from) s.From = from
    return nil
}

This method is called when the server receives a MAIL FROM command. It logs the sender's address and stores it in the session.

1. Implementing RCPT TO

Add this method to the Session struct:

func (s *Session) Rcpt(to string) error {
    fmt.Println("Rcpt to:", to)
    s.To = append(s.To, to)
    return nil
}

This method is called for each RCPT TO command. It logs the recipient's address and adds it to the list of recipients for this session.

1. Implementing DATA

Add this method to the Session struct:

import (
    "fmt"
    "io"
)

func (s *Session) Data(r io.Reader) error {
    if b, err := io.ReadAll(r); err != nil {
        return err
    } else {
        fmt.Println("Received message:", string(b))

        // Here you would typically process the email
        return nil
    }
}

This method is called when the server receives the DATA command. It reads the entire email message and logs it. In a real server, you would process the email here.

1. Implementing AUTH

Add this method to the Session struct:

func (s *Session) AuthPlain(username, password string) error {
    if username != "testuser" || password != "testpass" {
        return fmt.Errorf("Invalid username or password")
    }

    return nil
}

This implements a basic authentication mechanism. Note that this is for demonstration purposes only and should not be used in production.

1. Implementing RSET

Add this method to the Session struct:

func (s *Session) Reset() {
    s.From = "" s.To = []string{}
}

This method is called when the server receives a RSET command. It resets the session state.

1. Implementing QUIT

Add this method to the Session struct:

func (s *Session) Logout() error {
    return nil
}

This method is called when the server receives a QUIT command. In this simple implementation, we don't need to do anything special.

1. Sending Emails: MX Lookup, Port Selection, and DKIM Signing

Once we've received and processed an email, the next step is to send it to its destination. This involves two key steps: finding the recipient's mail server using MX (Mail Exchanger) records, and attempting to send the email using standard SMTP ports.

First, let's add a function to look up MX records:

import "net"

func lookupMX(domain string) ([]*net.MX, error) {
    mxRecords, err := net.LookupMX(domain)
    if err != nil {
        return nil, fmt.Errorf("Error looking up MX records: %v", err)
    }

    return mxRecords, nil
}

Next, let's create a function that attempts to send an email using different ports:

import (
    "crypto/tls"
    "net/smtp"
    "strings"
)

func sendMail(from string, to string, data []byte) error {
    domain := strings.Split(to, "@")[1]

    mxRecords, err := lookupMX(domain)
    if err != nil {
        return err
    }

    for _, mx := range mxRecords {
        host := mx.Host

        for _, port := range []int{25, 587, 465} {
            address := fmt.Sprintf("%s:%d", host, port)

            var c *smtp.Client

            var err error

            switch port {
            case 465:
                // SMTPS
                tlsConfig := &tls.Config{ServerName: host}
                conn, err := tls.Dial("tcp", address, tlsConfig)
                if err != nil {
                    continue
                }

                c, err = smtp.NewClient(conn, host)

            case 25, 587:
                // SMTP or SMTP with STARTTLS
                c, err = smtp.Dial(address)
                if err != nil {
                    continue
                }

                if port == 587 {
                    if err = c.StartTLS(&tls.Config{ServerName: host}); err != nil {
                        c.Close()
                        continue
                    }
                }
            }

            if err != nil {
                continue
            }

            // SMTP conversation
            if err = c.Mail(from); err != nil {
                c.Close()
                continue
            }

            if err = c.Rcpt(to); err != nil {
                c.Close()
                continue
            }

            w, err := c.Data()
            if err != nil {
                c.Close()
                continue
            }

            if _, err := w.Write(data); err != nil {
                c.Close()
                continue
            }

            err = w.Close()
            if err != nil {
                c.Close()
                continue
            }

            c.Quit()

            return nil
        }
    }

    return fmt.Errorf("Failed to send email to %s", to)
}

This function does the following:

• Looks up the MX records for the recipient's domain.
• For each MX record, it tries to connect using ports 25, 587, and 465 in that order.
• It uses the appropriate connection method for each port:
  • Port 25: Plain SMTP
  • Port 587: SMTP with STARTTLS
  • Port 465: SMTPS (SMTP over TLS)
• If a connection is successful, it attempts to send the email using the SMTP protocol.
• If the email is sent successfully, it returns. Otherwise, it tries the next port or MX record.

Now, let's modify our Data method in the Session struct to use this new sendMail function:

func (s *Session) Data(r io.Reader) error {
    if data, err := io.ReadAll(r); err != nil {
        return err
    } else {
        fmt.Println("Received message:", string(data))
        for _, recipient := range s.To {
            if err := sendMail(s.From, recipient, data); err != nil {
                fmt.Printf("Failed to send email to %s: %v", recipient, err)
            } else {
                fmt.Printf("Email sent successfully to %s", recipient)
            }

        }

        return nil
    }
}

This implementation will attempt to send the received email to each recipient using the appropriate mail server and port.

Now, let's add DKIM signing to our email sending process. First, we need to import the necessary packages and set up our DKIM options:

import (
    // ... other imports ...
    "crypto/rsa"
    "crypto/x509"
    "encoding/pem"
    "github.com/emersion/go-msgauth/dkim"
)

// Load your DKIM private key
var dkimPrivateKey *rsa.PrivateKey

func init() {
    // Load your DKIM private key from a file
    privateKeyPEM, err := ioutil.ReadFile("path/to/your/private_key.pem")
    if err != nil {
        log.Fatalf("Failed to read private key: %v", err)
    }

    block, _ := pem.Decode(privateKeyPEM)
    if block == nil {
        log.Fatalf("Failed to parse PEM block containing the private key")
    }

    privateKey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
    if err != nil {
        log.Fatalf("Failed to parse private key: %v", err)
    }

    dkimPrivateKey = privateKey
}

// DKIM options
var dkimOptions = &dkim.SignOptions{
    Domain: "example.com",
    Selector: "default",
    Signer: dkimPrivateKey,
}

Next, let's modify our sendMail function to include DKIM signing:

func sendMail(from string, to string, data []byte) error {
    // ... [previous MX lookup code] ...

    for _, mx := range mxRecords {
        host := mx.Host
        for _, port := range []int{25, 587, 465} {
            // ... [previous connection code] ...

            // DKIM sign the message
            var b bytes.Buffer
            if err := dkim.Sign(&b, bytes.NewReader(data), dkimOptions); err != nil {
                return fmt.Errorf("Failed to sign email with DKIM: %v", err)
            }
            signedData := b.Bytes()

            // SMTP conversation
            if err = c.Mail(from); err != nil {
                c.Close()
                continue
            }
            if err = c.Rcpt(to); err != nil {
                c.Close()
                continue
            }
            w, err := c.Data()
            if err != nil {
                c.Close()
                continue
            }
            _, err = w.Write(signedData) // Use the DKIM signed message
            if err != nil {
                c.Close()
                continue
            }
            err = w.Close()
            if err != nil {
                c.Close()
                continue
            }
            c.Quit()
            return nil
        }
    }

    return fmt.Errorf("Failed to send email to %s", to)
}

In this updated sendMail function:

• We sign the email data with DKIM before sending it.
• We use the signed data (signedData) when writing to the SMTP connection.

This implementation will add a DKIM signature to your outgoing emails, which will help improve deliverability and authenticity of your emails.

请记住将“path/to/your/private_key.pem”替换为您的 DKIM 私钥的实际路径，并更新 dkimOptions 中的域和选择器以匹配您的 DKIM DNS 记录。

1. 注意事项和后续步骤

虽然此实现提供了一个能够接收和发送电子邮件的基本工作 SMTP 服务器，但对于生产就绪服务器有几个重要的考虑因素：

• 速率限制：实施速率限制以防止滥用并防止电子邮件轰炸。
• 垃圾邮件预防：采取措施防止您的服务器被用来发送垃圾邮件。
• 错误处理：改进错误处理和日志记录，以实现更好的调试和监控。
• 队列管理：实现邮件发送失败时重试逻辑的队列系统。

结论

我们希望您通过阅读这篇文章学到了很多东西。要了解有关发送电子邮件的更多信息，请随时查看 Ferdinand 的 GitHub 存储库，并探索代码。

以上是在 Go 中构建您自己的 SMTP 服务器的详细内容。更多信息请关注PHP中文网其他相关文章！