postfix tries to send mail to domains with no mx record

2014-02-11 Thread Klaffehn, Peter
Hi, yesterday i noticed an unexpected behaviour. This mail is lingering in the outbound queue on my mailserver: 54086E032F 10413683 Fri Feb 7 14:04:21 some.user@my.domain (lost connection with apple.de[17.149.160.31] while receiving the initial server greeting) pre...@apple.de Searching the po

Re: postfix tries to send mail to domains with no mx record

2014-02-11 Thread Erwan David
On Tue, Feb 11, 2014 at 09:48:29AM CET, "Klaffehn, Peter" said: > > Now the strange thing. There is no mx record for apple.de: > > > > root@mx-50:~# host -t mx apple.de > > apple.de has no MX record > > > > So how could postfix determine the mxer for this Domain? Apparently postfix > us

Re: postfix tries to send mail to domains with no mx record

2014-02-11 Thread DTNX Postmaster
On 11 Feb 2014, at 09:48, Klaffehn, Peter wrote: > yesterday i noticed an unexpected behaviour. This mail is lingering in the > outbound queue on my mailserver: > > 54086E032F 10413683 Fri Feb 7 14:04:21 some.user@my.domain > (lost connection with apple.de[17.149.160.31] while receiving the in

Re: Postfix DNS resolver blindly relying on cached Additional section?

2014-02-11 Thread Patrik Båt
On 2013-10-10 02:18, Viktor Dukhovni wrote: > > It does not fail to find it. It just uses IPv4. See: > > http://www.postfix.org/postconf.5.html#smtp_address_preference > > The documentation for > > http://www.postfix.org/postconf.5.html#inet_protocols > > is sadly I believe out of date.

Re: Postfix DNS resolver blindly relying on cached Additional section?

2014-02-11 Thread Wietse Venema
Patrik B?t: > > The correct description is: > > > > When both IPv4 and IPv6 support are enabled, the Postfix SMTP > > client, for Postfix versions prior to 2.8, will attempt to > > connect via IPv6 before attempting to use IPv4. Starting > > with 2.8 protocol preference is controll

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread fleon
i disabled NTLM with sasl_mechanism_filter = !ntlm but of course now i get an error that the server offered no compatible authentication mechanism When i telnet to my exchange server i only get: STARTTLS X-ANONYMOUS TLS AUTH NTLM X-EXPS GSSAPI NTLM Like i said, if i cannot get this to work, i w

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread li...@rhsoft.net
Am 11.02.2014 13:13, schrieb fleon: > i disabled NTLM with sasl_mechanism_filter = !ntlm but of course now i get an > error that the server offered no compatible authentication mechanism > > When i telnet to my exchange server i only get: > > STARTTLS > X-ANONYMOUS TLS > AUTH NTLM > X-EXPS GSSA

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread fleon
Hello, can you please put your relevant main.cf, /etc/postfix/generic, etc/postfix/sasl/sasl_passwd (or the file you set up in main.cf), /etc/aliases and maybe a syslog entry after doing a test with /usr/sbin/sendmail? Please mangle your username, domain and password hashes. Your server seems qui

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread li...@rhsoft.net
Am 11.02.2014 13:31, schrieb fleon: > Hello, can you please put your relevant main.cf, /etc/postfix/generic, > etc/postfix/sasl/sasl_passwd (or the file you set up in main.cf), > /etc/aliases and maybe a syslog entry after doing a test with > /usr/sbin/sendmail? all database configuration > Pleas

network is unreachable

2014-02-11 Thread c cc
Hi, All of the sudden, we can't send any email to one particular domain, and below is the error message we got. Does anyone have any idea how to fix this problem? Thanks! Charles This is the mail system at host es1.mydomain.com. I'm

Re: Email clients timing out. Can you help?

2014-02-11 Thread Michael Weissenbacher
Dear Anthony! You should be ashamed of yourself and the community should be ashamed for allowing you to act this way to new people. Essentially you are insulting someone because he didn't do your homework for you. The link posted by Matthew was a very good starting point for being able doing

Re: network is unreachable

2014-02-11 Thread lst_hoe02
Zitat von c cc : Hi, All of the sudden, we can't send any email to one particular domain, and below is the error message we got. Does anyone have any idea how to fix this problem? Thanks! Charles This is the mail system at host e

Re: Does this have side effects?

2014-02-11 Thread Michael P. Demelbauer
On Mon, Feb 10, 2014 at 11:39:10AM -0600, Jay G. Scott wrote: > On Fri, Feb 07, 2014 at 01:55:09PM -0500, Glenn Sieb wrote: > > This will do what you're looking for, much easier. > > > > in main.cf: > > > > mydomain = arlut.utexas.edu > So, eliminating myorigin as a variable. I'm far from an ex

Re: Does this have side effects?

2014-02-11 Thread Michael P. Demelbauer
It looks like the following docs should cover your needs: http://www.postfix.org/OVERVIEW.html http://www.postfix.org/ADDRESS_REWRITING_README.html Sorry, if you already know and read those. Cheers -- Michael P. Demelbauer Systemadministration WSR Arsenal, Objekt 20 1030 Wien ---

Re: network is unreachable

2014-02-11 Thread Wietse Venema
c cc: > Andreas, > > Thanks for your quick reply--is there a setting in Postfix that I should > configure to fix this problem? Thanks! Try using his telnet example first. If that doesn't work then no amount of Postfix tweaking will help. Wietse > Charles > > > On Tue, Feb 11, 2014 at

Re: network is unreachable

2014-02-11 Thread Mauricio Tavares
On Tue, Feb 11, 2014 at 9:34 AM, c cc wrote: > Andreas, > > Thanks for your quick reply--is there a setting in Postfix that I should > configure to fix this problem? Thanks! > Forget about postfix. First validate you have connection to that server. i.e. can you reach that port while in ipv6?

Re: network is unreachable

2014-02-11 Thread lst_hoe02
Zitat von c cc : Andreas, Thanks for your quick reply--is there a setting in Postfix that I should configure to fix this problem? Thanks! Charles You might try with IPv4 only with "inet_protocols=ipv4" but you should first check if you can reach them by IPv4 anyway. But to really solve

Re: network is unreachable

2014-02-11 Thread c cc
Hi all, Thanks for all your help. Since we are using EC2 from Amazon and they don't support ip6 on EC2, they recommended me to force Postfix to send email using ipV4 by changing: inet_protocols = all to inet_protocols = ipv4 and restart or reload Postfix If I change to ipV4, would it create mo

Re: network is unreachable

2014-02-11 Thread Robert Schetterer
Am 11.02.2014 17:19, schrieb c cc: > f I change to ipV4, would it create more problems for my Postfix no Best Regards MfG Robert Schetterer -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263

Re: network is unreachable

2014-02-11 Thread lst_hoe02
Zitat von c cc : Hi all, Thanks for all your help. Since we are using EC2 from Amazon and they don't support ip6 on EC2, they recommended me to force Postfix to send email using ipV4 by changing: inet_protocols = all to inet_protocols = ipv4 and restart or reload Postfix If I change to ipV

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread fleon
I tried to connect with this command: openssl s_client -starttls -smtp -crlf -connect exchangeserver.ourdomain.com:25 It connects, though it says it can't validate certificate (which is expected, our exchange certificate is self signed) After EHLO i now get: AUTH NTLM LOGIN So i tried with log

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread Wietse Venema
fleon: > I tried to connect with this command: > > openssl s_client -starttls -smtp -crlf -connect > exchangeserver.ourdomain.com:25 ... > After typing then manually encoded, i got a RENEGOTIATING and finally a Openssl s_client will "renegotiate" when you type "R". Try using lowercase characters

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread Viktor Dukhovni
On Tue, Feb 11, 2014 at 09:48:03AM -0800, fleon wrote: > After EHLO i now get: > AUTH NTLM LOGIN > > So i tried with login and it requested my username and password in base64. > > After typing then manually encoded, i got a RENEGOTIATING and finally a > handshake failure. Don't know if it's beca

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread fleon
I have this in my main.cf (note: i didn't set this up, my guess is that debian itself did, or maybe when i installed libsasl2-modules, but i don't think so) smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key smtpd_use_tls = yes sm

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread Viktor Dukhovni
On Tue, Feb 11, 2014 at 10:36:54AM -0800, fleon wrote: > I have this in my main.cf (note: i didn't set this up, my guess is that > debian itself did, or maybe when i installed libsasl2-modules, but i don't > think so) > > smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem > smtpd_tls_key_

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread li...@rhsoft.net
Am 11.02.2014 20:01, schrieb Viktor Dukhovni: > On Tue, Feb 11, 2014 at 10:36:54AM -0800, fleon wrote: > >> I have this in my main.cf (note: i didn't set this up, my guess is that >> debian itself did, or maybe when i installed libsasl2-modules, but i don't >> think so) >> >> smtpd_tls_cert_file

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread Viktor Dukhovni
On Tue, Feb 11, 2014 at 08:06:17PM +0100, li...@rhsoft.net wrote: > and that is why i hours ago posted the *client* configuration > of the machine happily sends authenticated mail over TLS to > exchange > > smtp_use_tls = yes Obsolete. > smtp_tls_loglevel = 1 > smtp_tls_CAfile = /etc/pki/tls/ce

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread fleon
FINALLY it worked, but not before i disabled NTLM in the config, because otherwise it would try it. So, i had to enable client side TLS and disabling NTLM. It says untrusted connection in the logs, and i tried modifying the mynetworks variable below but couldn't fix it. It may be untrusted because

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread li...@rhsoft.net
Am 11.02.2014 21:15, schrieb fleon: > FINALLY it worked, but not before i disabled NTLM in the config, because > otherwise it would try it. as said in my first reply "uninstall the NTLM module" as long you have no damned good reason to install it in case of the distributions i work with it is a

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread Viktor Dukhovni
On Tue, Feb 11, 2014 at 10:14:10PM +0100, li...@rhsoft.net wrote: > > So, i had to enable client side TLS and disabling NTLM. It says untrusted > > connection in the logs, and i tried modifying the mynetworks variable below > > but couldn't fix it. It may be untrusted because of the invalid exchan

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread Noel Jones
On 2/11/2014 2:15 PM, fleon wrote: > ... > Now, a final question that isn't exactly relevant to postfix. Can i make > emails sent to come as "myu...@ourdomain.com" instead of the default > "myu...@helpdesk.ourdomain.com" Maybe you're looking for http://www.postfix.org/postconf.5.html#masquerade_do

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread fleon
I am fine with the end result. The untrusted message is rather cosmetic, i would like to know how to import the certificate or rather trust the server (as i thought the mynetwork variable would do), but it's no biggie. The server is inside our lan and the relay will only be used for our helpdesk,

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread Viktor Dukhovni
On Tue, Feb 11, 2014 at 01:37:17PM -0800, fleon wrote: > Some would argue that using the virtual smtp server (that asks for no > password) is better, since with the current setup i have to make sure the > user that will send the mail (which should be static, as they will be > automatically sent by

How to block bogus localhost.localdomain/127.0.0.1 (helo_access)

2014-02-11 Thread L. D. James
Most of the spam getting in my system is stamped with localhost.localdomain. I have tried to use the helo_access file from a few sources. The ones I tried either didn't work or made more of the spam messages get through. One of the fixes I tried I got from: http://www.postfix.org/SMTPD_ACCESS_

Re: How to block bogus localhost.localdomain/127.0.0.1 (helo_access)

2014-02-11 Thread Wietse Venema
L. D. James: > main.cf: > ? > smtpd_delay_reject = yes > smtpd_helo_required = yes > smtpd_helo_restrictions = > permit_mynetworks, > check_helo_access hash:/etc/postfix/helo_access, > permit You need whitespace at the beginning of the permit_mynetworks and chec

Re: How to block bogus localhost.localdomain/127.0.0.1 (helo_access)

2014-02-11 Thread Noel Jones
On 2/11/2014 4:20 PM, L. D. James wrote: > Most of the spam getting in my system is stamped with > localhost.localdomain. > All the mail that passes through your amavisd-new mail filter passes through localhost.localdomain. If you block localhost you won't receive any mail. You need to trace a

Re: network is unreachable

2014-02-11 Thread Benny Pedersen
On 2014-02-11 17:19, c cc wrote: Since we are using EC2 from Amazon and they don't support ip6 on EC2, they recommended me to force Postfix to send email using ipV4 by changing:  inet_protocols = all to inet_protocols = ipv4 and restart or reload Postfix this will force postfix to only use ipv

Re: How to block bogus localhost.localdomain/127.0.0.1 (helo_access)

2014-02-11 Thread L. D. James
On 02/11/2014 06:05 PM, Noel Jones wrote: On 2/11/2014 4:20 PM, L. D. James wrote: Most of the spam getting in my system is stamped with localhost.localdomain. All the mail that passes through your amavisd-new mail filter passes through localhost.localdomain. If you block localhost you won't

Re: How to block bogus localhost.localdomain/127.0.0.1 (helo_access)

2014-02-11 Thread L. D. James
On 02/11/2014 05:39 PM, Wietse Venema wrote: permit_mynetworks, >check_helo_access hash:/etc/postfix/helo_access, >permit Thanks, Wietse. I had white spaces. I had tried to have it exactly like the example in the link I posted. I see I made a mistake in my post. But the main.cf has the spa