GDPR-Compliant Securing of Association Email Accounts under Virtualmin: Setting Up SPF, DKIM, DMARC, and Encrypted IMAP/SMTP Access Correctly to Prevent Phishing, Spoofing, and Data Leaks

Why Email Security Is Indispensable for Associations

Associations communicate daily via email – whether with members, authorities, or sponsors. Sensitive data such as addresses, bank details, or personal information are often exchanged. The GDPR obligates associations to protect this data appropriately. However, email accounts are a popular target for phishing, spoofing, and data leaks. In this article, you will learn how to secure your association emails under Virtualmin with SPF, DKIM, DMARC, and encrypted IMAP/SMTP access in a GDPR-compliant manner.

Basics: What Are SPF, DKIM, and DMARC?

Before we dive into the practical setup, let's clarify the terms:

• SPF (Sender Policy Framework): Defines which servers are allowed to send emails for your domain. This prevents outsiders from sending emails in your name.
• DKIM (DomainKeys Identified Mail): Adds a digital signature to emails that confirms the authenticity of the sender and detects tampering.
• DMARC (Domain-based Message Authentication, Reporting and Conformance): Builds on SPF and DKIM and defines how recipients should handle unauthenticated emails. You also receive reports about suspicious activities.

These three technologies are essential to combat spoofing and phishing and to improve the deliverability of your emails.

Prerequisites: Virtualmin and a Reliable Hosting Partner

For the setup, you need a Virtualmin installation on a server. If you don't have a suitable server yet, we recommend our virtual server or our web hosting package. Both offer the necessary flexibility and security.

Make sure you have access to the DNS management of your domain – either directly at your registrar or via Virtualmin. If you still need a domain, you can easily purchase it through our domain registration.

Step by Step: Setting Up SPF, DKIM, and DMARC under Virtualmin

1. Configure SPF Record

Log in to Virtualmin and navigate to Server Configuration > DNS Records. There you will find the DNS zone of your domain. Add a new TXT record:

• Name: @ (or your domain)
• Type: TXT
• Value: v=spf1 a mx ip4:YOUR_SERVER_IP include:yourmailprovider.com ~all

Replace YOUR_SERVER_IP with the IP address of your server and yourmailprovider.com with the hostname of your mail server. The ~all means that emails from unauthorized servers are marked as suspicious but not immediately rejected. For strict policies, you can use -all.

2. Generate and Set Up DKIM Key

Virtualmin offers integrated DKIM support. Go to Email Settings > DomainKeys Identified Mail. Click on Enable DKIM and choose the desired key length (recommended: 2048 bits). Virtualmin automatically generates a private and public key. The public key is stored as a DNS TXT record:

• Name: default._domainkey
• Type: TXT
• Value: v=DKIM1; k=rsa; p=PUBLIC_KEY

Make sure the record is saved correctly. You can verify it with tools like MXToolbox.

3. Set DMARC Policy

Create another TXT record for DMARC:

• Name: _dmarc
• Type: TXT
• Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@your-domain.com; ruf=mailto:dmarc@your-domain.com; fo=1

With p=quarantine, emails that fail SPF and DKIM are moved to the spam folder. rua and ruf specify where the reports should be sent. Monitor these reports regularly to detect attacks.

Setting Up Encrypted IMAP/SMTP Access

Unencrypted connections are a security risk. Under Virtualmin, you can enable SSL/TLS for IMAP and SMTP. Go to Server Configuration > SSL Certificate and ensure that a valid certificate (e.g., Let's Encrypt) is installed. Then, under Email Settings > Mail Server Configuration, enable the options SSL for IMAP and SSL for SMTP.

In your email client (e.g., Thunderbird, Outlook), set the following settings:

• IMAP: Port 993, SSL/TLS
• SMTP: Port 587, STARTTLS (or Port 465, SSL/TLS)

Use strong passwords and enable two-factor authentication if your mail server supports it.

GDPR Compliance: What You Need to Consider

The technical measures are an important step, but the GDPR also requires organizational measures:

• Data Processing Agreement (DPA): Sign a DPA with your hosting provider.
• Encrypted Storage: Ensure that emails are stored encrypted on the server (e.g., via full-disk encryption).
• Access Control: Only authorized persons should have access to email accounts.
• Regular Backups: Back up emails and configurations to avoid data loss.
• Deletion Concept: Delete emails after the retention periods expire.

Document all measures to be able to prove in case of an audit that you are acting in a GDPR-compliant manner.

Conclusion: Security Is an Ongoing Process

Setting up SPF, DKIM, DMARC, and encrypted access under Virtualmin is an important step to protect your association emails from phishing, spoofing, and data leaks. Regularly check your DNS records and DMARC reports to be able to respond to new threats. If you need support, our support is happy to assist. For more information on secure email communication, visit our blog.