Emails go to spam with postfix and spf ... ?

I managed to get my outgoing email server to send emails avoiding the spam folder

… create TLS cert files as per

https://letsecure.me/secure-web-deployment-with-lets-encrypt-and-nginx/ and/or https://www.linode.com/docs/security/ssl/install-lets-encrypt-to-create-ssl-certificates

actually above instructions are extremely concise which is gr8 … to above I added my email subdomain

export DOMAINS="mail.example.com,example.here,www.example.here"

… its output will be these files

-rw-r–r-- 1 root root 1887 Sep 3 18:42 cert.pem -rw-r–r-- 1 root root 1647 Sep 3 18:42 chain.pem -rw-r–r-- 1 root root 3534 Sep 3 18:42 fullchain.pem -rw-r–r-- 1 root root 1704 Sep 3 18:42 privkey.pem

now just copy them and define these variables as

cp privkey.pem  /etc/ssl/private/mail.example.com.privkey.pem
cp cert.pem       /etc/ssl/certs/mail.example.com.cert.pem
cp chain.pem    /etc/ssl/certs/mail.example.com.chain.pem

postconf 'smtpd_tls_key_file  = /etc/ssl/private/mail.example.com.privkey.pem'
postconf 'smtpd_tls_cert_file = /etc/ssl/certs/mail.example.com.cert.pem'
postconf 'smtpd_tls_CAfile    = /etc/ssl/certs/mail.example.com.chain.pem'

notice above vars will then appear in file

/etc/postfix/main.cf

bounce postfix and send a post … notice TLS will now be mentioned in the received email header

Received: from mail.example.com ([159.203.100.178])
by mx.google.com with ESMTPS id 4si10110105qta.2.2016.09.04.06.45.52
for kaptainkrunch@gmail.com
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sun, 04 Sep 2016 06:45:52 -0700 (PDT)

frustratingly emails still landed in spam folder so I just said Not Spam to train my gmail inbox and since the red unlocked padlock icon was now gone to indicate TLS is active afterwards new emails correctly land in inbox not spam ;-)

for completeness here are relevant vars from /etc/postfix/main.cf

smtpd_tls_cert_file = /etc/ssl/certs/mail.example.com.cert.pem
smtpd_tls_key_file = /etc/ssl/private/mail.example.com.privkey.pem
smtpd_tls_CAfile = /etc/ssl/certs/mail.example.com.chain.pem
smtpd_tls_auth_only = no
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_received_header = yes
smtpd_tls_security_level = encrypt
smtpd_tls_session_cache_timeout = 3600s
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
tls_random_source = dev:/dev/urandom

in my DNS to satisfy SPF I have a record Type TXT with value

@       "v=spf1 mx a -all"

and a MX record

10      mail.example.com.

here is a really slick DNS records validator http://intodns.com/ and https://toolbox.googleapps.com/apps/checkmx/