Web & Mail Servers
Nginx, Apache, Postfix, Zimbra and email authentication (SPF, DKIM, DMARC).
Web & Mail Servers articles
Postfix as a Relay, with Milters
A relay Postfix accepts mail from your apps/network and forwards it — authenticated, restricted, and DKIM-signed. Here's the config and the milter chain.
October 24, 2026Postfix postscreen and Pre-Queue Spam Defense
postscreen weeds out zombie/botnet SMTP connections before they reach Postfix's smtpd — cheap, effective, and the first line of spam defense. Here's how to configure it.
October 24, 2026Dovecot IMAP Basics
Dovecot is the IMAP/POP server that lets users read mail Postfix delivered. Here's the storage formats, auth model, the Postfix hand-off, and doveadm for debugging.
October 24, 2026unbound as a Recursive Resolver
unbound is a small, fast, security-focused recursive resolver. Here's a config for a LAN resolver with DNSSEC validation, local overrides, and optional DoT upstream.
October 24, 2026OCSP Stapling and Modern TLS Config
TLS config drifts out of date fast. Here's a current baseline — TLS 1.2/1.3 only, a good cipher list, OCSP stapling, session resumption, HSTS — for Nginx and Apache.
October 24, 2026HAProxy Basics
HAProxy is a fast, reliable L4/L7 load balancer. Here's the frontend/backend config model, health checks, ACL routing, and the stats page that answers most questions.
October 24, 2026Nginx Content Caching
Nginx can cache upstream responses to disk, serving them without touching your app. Here's proxy_cache, the key, stale content, and even micro-caching dynamic pages.
October 24, 2026Varnish Cache in Front of a Site
Varnish is a caching HTTP accelerator configured in VCL. Here's the request lifecycle, why you strip cookies, how bans work, and grace mode for serving stale during backend trouble.
October 24, 2026Running BIND 9 as an Authoritative Server
BIND as an authoritative server: zone files, secured AXFR with TSIG, SOA serial rules, and DNSSEC inline-signing. Here's a working master/slave setup.
October 24, 2026Postfix as a Null Client: Send-Only Mail Done Right
The minimal, secure Postfix config for a server that only needs to send: relayhost, SASL, TLS, and rewriting the From address.
October 24, 2026Rate Limiting in Nginx: limit_req, limit_conn, and burst
How the leaky-bucket rate limiter works, what burst and nodelay actually do, and a config that protects a login endpoint without breaking real users.
October 24, 2026Translating an Apache Config to Nginx
Moving a site from Apache to Nginx means giving up .htaccess and per-directory context. Here's what each common Apache directive becomes.
October 24, 2026