Email System Revamp

== Glossary ==
* ARC (Authenticated Received Chain): Provides a method for mail relays to digitally sign the results of their SPF and DKIM checks, which may then be verified by the next hop mail server, RFC 8617.
* DKIM (DomainKeys Identified Mail): Adds an encrypted digital signature from the sender’s domain to each message. This signature allows a receiver to verify that specific headers were not tampered with in transit. Notably the From header is always signed by DKIM, RFC 6376.
* DMARC (Domain-based Message Authentication, Reporting, and Conformance): Provides a policy and reporting mechanism to describe what a receiving domain should do with emails which fail their SPF or DKIM checks, RFC 7489.
* Null Client: Mail server, which only relays mail to another mail server for the domain. The receiving mail server then handles the actual delivery to the email recipient (also referred to as a “satellite config”).
* Milter: Mail filter for an MTA, portmanteau of mail & filter, e.g. rspamd.
* MTA (Mail Transfer Agent): A general mail server, RFC 5321.
* MTA-STS (MTA Strict Transport Security): Allows a domain to specify that incoming emails should be delivered only over TLS encrypted sessions, RFC 8461
* MX: Mail exchange DNS record, specifies which servers accept mail for a given domain.
* SPF (Sender Policy Framework): Allows a domain to declare via DNS the mail servers which are authorized to send email for the domain, RFC 7208.
== Current Email Services Overview ==
All current email services use Exim for delivery.
=== Inbound Email Services ===
# Wikimedia Foundation Email: @wikimedia.org
#* Gmail for the Wikimedia Foundation
#* Donation email, donate@wikimedia.org
#* Enterprise support, enterprise@wikimedia.org
#* Aliases
# VRT Contacts:
#* (permissions, info)-(en, ko, tr, etc)
#** @wikimedia.org
#** wikis
#**# @wikipedia.org
#**# @wikibooks.org
#**# @wikivoyage.org
#**# etc.
# Wiki Operators:
#* postmaster, abuse, hostmaster, etc.
# Phabricator Replies: Replies to issues,@phabricator.wikimedia.org
# Mailing Lists: wikitech-l, mediawiki-l, etc, @lists.wikimedia.org
=== Inbound Email Routing ===
* mx(1001,2001).wikimedia.org
** Wikimedia Foundation Email: Internet ➡ mx(1001,2001).wikimedia.org ➡ Gmail
** VRT Contacts: Internet ➡ mx(1001,2001).wikimedia.org ➡ otrs1001.eqiad.wmnet
** Wiki Operators: Internet ➡ mx(1001,2001).wikimedia.org ➡ Gmail
** Phabricator Replies: Internet ➡ mx(1001,2001).wikimedia.org ➡ phab1001.eqiad.wmnet
* lists.wikimedia.org
** Mailing Lists: Internet ➡ lists1001.wikimedia.org
=== Outbound Email Services ===
# Wiki Email: Email generated by MediaWiki
#* Password resets
#* Login notifications
#* Article edits
# Infra Email: Email generated by our infrastructure
#* Email to local users, e.g. root@HOST.(eqiad, codfw, etc).wmnet
#* Jenkins
#* Wikitech
#* AlertManager
#* GitLab
# VRT Email: Volunteer Response Team Replies from Znuny (Formerly OTRS)
#* Replies for wiki domains: wikimedia.org, wikipedia.org, wiktionary.org, etc
# Mailing List Email: Email from Mailman3 to subscribers, hosted on lists1001.wikimedia.org
# Phabricator Email: Email from Phabricator, comments, notifications, etc (phabX.wikimedia.org)
# Gerrit Email: Email from Gerrit, comments, notifications, etc (gerrit1001.wikimedia.org)
=== Outbound Email Routing ===
* mx(1001,2001).wikimedia.org
** Wiki Email: (MediaWiki Servers) ➡ mx(1001,2001).wikimedia.org ➡ Internet
** Infra Email: (Servers) ➡ mx(1001,2001).wikimedia.org ➡ Internet
** VRT Replies: otrs1001.eqiad.wmnet ➡ mx(1001,2001).wikimedia.org ➡ Internet
** Gerrit Email: gerrit1001.wikimedia.org ➡ mx(1001,2001).wikimedia.org ➡ Internet
* lists.wikimedia.org
** Mailing List Email: lists1001.wikimedia.org ➡ Internet
* phabricator.wikimedia.org
** Phabricator Email: phab1001.eqiad.wmnet ➡ Internet
== Problems with Current Design ==
# Exim as the MTA: Exim has had a long string of security vulnerabilities, including many with remote code execution:
## 16 Debian Security Advisories & 6 Debian Long Term Support Security Advisory since 2010
## Vulnerabilities have been found in both new and old code.
# MTAs serve domains with mixed user groups
## Crosses organizational boundaries: e.g. ITS owns gmail, but SRE operates the MTA for inbound Wikimedia Foundation email.
## Makes it more difficult to tighten our DMARC and SPF configurations.
## IP reputation is mixed: e.g. Wiki email egresses the same servers as Infra email.
## Maintenance impacts more domains.
# Inbound & outbound MTAs are the same servers, T175362
## Makes it more difficult to monitor and administer the mail queues.
## Maintenance affects sending and receiving email
=== Benefits to Improving our Current Design ===
# Improved software security
# Reduced operational burden
# Improved spam identification
=== Risks of Keeping the Status Quo ===
# Continued possibility of a server compromise via an Exim vulnerability
# Operational burdens continue
# Spam levels stay the same or increase
== Design Considerations ==
=== Subdomains or new domains for email services ===
Some of our email services have been moved to subdomains of wikimedia.org, e.g. lists.wikimedia.org. An alternative option is to move services to a separate domain, e.g. wikimedia-lists.org.
==== Options: ====
# Subdomain
## Pros
### Easy to create & manage
### Allows separate MX, SPF, DKIM, & DMARC
## Cons
### Some email service providers, such as Gmail, will alter the spam reputation of the apex domain, e.g. wikimedia.org, if a subdomain produces substantial spam, e.g. lists.wikimedia.org, 1 2
# Domain
## Pros
### Allows separate MX, SPF, DKIM, & DMARC
### Spam scoring is completely separate from other domains
## Cons
### Domain recognition may be more confusing for end users, e.g. should they trust wikimedia-lists.org?
Option (1) is used in the proposed design as that method was already used for the mailing list addresses and the risk of high levels of spam egressing our systems appears low. However, if egress spam becomes a problem we can reconsider the decision.
=== Multiple User Groups of @wikimedia.org ===
There are two primary user groups who use @wikimedia.org email addresses:
# VRT Contacts
# Wikimedia Foundation Email
All email for @wikimedia.org addresses ingresses SRE managed email servers and then, depending on the user group, are routed to Gmail’s or VRTS’ email servers. The current setup complicates administration as ITS owns the Wikimedia Foundation employees’ email concerns and SRE owns the email ingress servers and VRTS. In addition this setup is suboptimal as Gmail’s spam detection works best when email directly ingresses their MTAs. However, changing the current setup is not without difficulties and risks.
==== Options: ====
# Keep the Status Quo
## Pros
### Around 80% of VRT email is addressed to the wikimedia.org domain. VRT email addresses, e.g. <info@wikimedia.org>, have been publicized for many years and are documented in numerous places on and off wiki.
## Cons
### More spam to Wikimedia Foundation Email Users since Gmail is not the first point of ingestion.
### Requires some coordination between ITS, SRE, & VRT.
# Separate domains for VRT Contacts & Wikimedia Foundation Email
## Pros
### Separates ITS handled email and SRE handled email
### Wikimedia Foundation email would ingress Gmail directly for better spam protection
## Cons
### Significant migration effort needed to move VRT addresses off of the wikimedia.org domain. We would need to support old domain addresses for many years, if not indefinitely. Alternatively, Wikimedia Foundation email could be moved off of the wikimedia.org domain, but this would also require a long painful migration process.
Option (1) Though, separating domains for VRT email and Wikimedia Foundation email is attractive from an organizational perspective, the migration for either user group would be so disruptive as to negate any gains realized by separating the domains. Instead we keep the status quo of both user groups sharing the wikimedia.org domain. Also, we assume the user groups will share the domain for the foreseeable future, thus making investment in easing the complexity burden worthwhile.
== Proposed Design Overview ==
=== Replace Exim with Postfix ===
Postfix offers a more security focused implementation than Exim. In comparison to Exim, Postfix has had only one Debian Security Advisory since 2010 and is structured in a way so as to minimize attack vectors,T232343.
* Pros
** Improved security design
* Cons
** More difficult configuration
** Requires porting Exim’s configuration to Postfix’s
** Debian has had a similar debate for many years, but has stuck with Exim
=== Split Inbound and Outbound MTAs ===
Splitting our inbound and outbound email delivery should allow for easier monitoring and security controls,T175362.
* Pros
** Easier to monitor
** Easier to reason about configuration changes
* Cons
** More servers to monitor and maintain
== Proposed Design ==
=== Inbound Email Routing ===
Two hosts per inbound MX record (one per site, eqiad & codfw), redundancy provided by DNS MX records for each domain.
* mta-inbound-wiki (MX record for wikimedia.org & wikis: wikipedia.org, wikivoyage.org, etc)
** Wikimedia Foundation Email: Internet ➡ mta-inbound-wiki ➡ Gmail
** VRT Contacts: Internet ➡ mta-inbound-wiki ➡ otrs1001.eqiad.wmnet
** Wiki Operators: Internet ➡ mta-inbound-wiki ➡ Gmail
* mta-inbound-infra (MX record for phabricator.wikimedia.org)
** Phabricator Replies: Internet ➡ mta-inbound-infra ➡ phab1001.eqiad.wmnet
* mta-inbound-lists (MX record for lists.wikimedia.org)
** Mailing Lists: Internet ➡ mta-inbound-lists ➡ lists1001.wikimedia.org
=== Outbound Email Routing ===
Two hosts per outbound relay (eqiad & codfw), redundancy provided by including both servers in Null Client configs. Alternatively, each pair of servers could be fronted by LVS for redundancy.
* mta-outbound-wiki
** Wiki Email (domain: wikimedia.org): MediaWiki Servers ➡ mta-outbound-wiki ➡ Internet
** VRT Replies (domain: wikimedia.org): otrs1001.eqiad.wmnet ➡ mta-outbound-wiki ➡ Internet
* mta-outbound-infra
** Infra Email (domain: wikimedia.org): Servers ➡ mta-outbound-infra ➡ Internet
** Phabricator Email (domain: phabricator.wikimedia.org): phab1001.eqiad.wmnet ➡ mta-outbound-infra ➡ Internet
** Gerrit Email (domain: wikimedia.org): gerrit1001.wikimedia.org ➡ mta-outbound-infra ➡ Internet
* mta-outbound-lists
** Mailing List Email (domain: lists.wikimedia.org): lists1001.wikimedia.org ➡ mta-outbound-lists ➡ Internet
== Task Outline ==
These tasks are listed in approximate dependency order. Though some of them could be done in parallel.
=== Improve Test Coverage & Methodologies for Mail Config Changes ===
# High level domain, address and routing tests
# Config syntax checking
=== Provision a Development Setup on OpenStack ===
# Create Postfix configuration
# Add spam & security features, via postfix or separate milters, rspamd, opendkim, etc.
## SPF
## DKIM
## DMARC
## ARC
=== Create Puppet Modules ===
# Evaluate Puppet Forge modules for suitability
# Create or augment an existing Postfix module to support
## Null Client MTAs
## Inbound MTAs
## Outbound MTAs
# Create or augment an existing milter module to support
## SPF
## DKIM
## DMARC
## ARC
## MTA-STS,T203883
=== Setup Postfix Monitoring ===
# Export Postfix metric data to Prometheus to match existing Exim metrics
# Add alerts on key metrics
# Assess our DMARC report monitoring and improve if needed
=== Setup Outbound Postfix Email Servers ===
Two hosts per outbound MTA relay (one per site, eqiad & codfw), redundancy provided by including both servers in Null Client configs. Alternatively, each pair of servers could be fronted by LVS for redundancy. IP reputation is helpful for ensuring messages are not being marked as spam. However, it is difficult to retain the same IPs while setting up new outbound servers. Instead new IPs will be used and DMARC reports will be monitored to determine if there is an elevated number of messages being marked as spam.
* General MTA Relay Steps
*# Provision Servers
*# Build Postfix config
*# Add DKIM records, or reuse existing records
*# Test delivery
*# Update DNS SPF records to include new servers
*# Monitor delivery rates
*# Remove Exim servers from SPF records
*# Update DMARC records for domains
# MTA Relay Wiki: Outbound MTA Relay for wiki domains.
## General MTA Relay Steps
## Point MediaWiki to new hosts
## Point VRTS to new hosts
# MTA Relay Infra:Outbound MTA Relay for infrastructure
## General MTA Relay Steps
## Point servers to new hosts
# MTA Relay Lists: Outbound MTA Relay for Mailing Lists
## General MTA Relay Steps
## ARC Setup
## Point mailing list servers to new hosts
=== Convert Null Clients to Postfix ===
# Replace Exim Null Clients with Postfix equivalents
=== Setup Inbound Postfix Email Servers ===
The goal will be to provision Postfix servers in front of the existing Exim servers for inbound traffic. This setup should provide a fair bit of increased security, since Exim will no longer be exposed directly to the internet, but it will also allow us to temporarily keep the existing Exim mail routing logic in place.
* General MX Steps
*# Provision Servers
*# Build Postfix config
*# Setup MTA-STS
*# Test delivery
*# Add new servers with a higher value MX record (lower priority)
*# Monitor delivery rates
*# Raise priority of MX records
*# Remove Exim servers from MX records
# MX Wiki: Inbound MX server for wiki domains.
## General MX Steps
# MX Lists: Inbound MX server for mailing lists
## General MX Steps
## ARC Setup
# MX Infra: Inbound MX server for Infrastructure services
## General MX Steps
=== Remove Exim MTAs ===
# Move inbound routing rules to Postfix
# Monitor for changes in delivery rates
# Shutdown the Exim servers once they are no longer routing any mail