postfix tries to send mail to domains with no mx record

2014-02-11 Thread Klaffehn, Peter
Hi, yesterday i noticed an unexpected behaviour. This mail is lingering in the outbound queue on my mailserver: 54086E032F 10413683 Fri Feb 7 14:04:21 some.user@my.domain (lost connection with apple.de[17.149.160.31] while receiving the initial server greeting) pre...@apple.de Searching the

Re: postfix tries to send mail to domains with no mx record

2014-02-11 Thread Erwan David
On Tue, Feb 11, 2014 at 09:48:29AM CET, Klaffehn, Peter peter.klaff...@westermann.de said: Now the strange thing. There is no mx record for apple.de: root@mx-50:~# host -t mx apple.de apple.de has no MX record So how could postfix determine the mxer for this Domain?

Re: postfix tries to send mail to domains with no mx record

2014-02-11 Thread DTNX Postmaster
On 11 Feb 2014, at 09:48, Klaffehn, Peter peter.klaff...@westermann.de wrote: yesterday i noticed an unexpected behaviour. This mail is lingering in the outbound queue on my mailserver: 54086E032F 10413683 Fri Feb 7 14:04:21 some.user@my.domain (lost connection with

Re: Postfix DNS resolver blindly relying on cached Additional section?

2014-02-11 Thread Patrik Båt
On 2013-10-10 02:18, Viktor Dukhovni wrote: It does not fail to find it. It just uses IPv4. See: http://www.postfix.org/postconf.5.html#smtp_address_preference The documentation for http://www.postfix.org/postconf.5.html#inet_protocols is sadly I believe out of date. The

Re: Postfix DNS resolver blindly relying on cached Additional section?

2014-02-11 Thread Wietse Venema
Patrik B?t: The correct description is: When both IPv4 and IPv6 support are enabled, the Postfix SMTP client, for Postfix versions prior to 2.8, will attempt to connect via IPv6 before attempting to use IPv4. Starting with 2.8 protocol preference is controlled via the

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread fleon
i disabled NTLM with sasl_mechanism_filter = !ntlm but of course now i get an error that the server offered no compatible authentication mechanism When i telnet to my exchange server i only get: STARTTLS X-ANONYMOUS TLS AUTH NTLM X-EXPS GSSAPI NTLM Like i said, if i cannot get this to work, i

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread li...@rhsoft.net
Am 11.02.2014 13:13, schrieb fleon: i disabled NTLM with sasl_mechanism_filter = !ntlm but of course now i get an error that the server offered no compatible authentication mechanism When i telnet to my exchange server i only get: STARTTLS X-ANONYMOUS TLS AUTH NTLM X-EXPS GSSAPI NTLM

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread li...@rhsoft.net
Am 11.02.2014 13:31, schrieb fleon: Hello, can you please put your relevant main.cf, /etc/postfix/generic, etc/postfix/sasl/sasl_passwd (or the file you set up in main.cf), /etc/aliases and maybe a syslog entry after doing a test with /usr/sbin/sendmail? all database configuration Please

network is unreachable

2014-02-11 Thread c cc
Hi, All of the sudden, we can't send any email to one particular domain, and below is the error message we got. Does anyone have any idea how to fix this problem? Thanks! Charles This is the mail system at host es1.mydomain.com.

Re: Email clients timing out. Can you help?

2014-02-11 Thread Michael Weissenbacher
Dear Anthony! You should be ashamed of yourself and the community should be ashamed for allowing you to act this way to new people. Essentially you are insulting someone because he didn't do your homework for you. The link posted by Matthew was a very good starting point for being able doing

Re: network is unreachable

2014-02-11 Thread lst_hoe02
Zitat von c cc sub...@gmail.com: Hi, All of the sudden, we can't send any email to one particular domain, and below is the error message we got. Does anyone have any idea how to fix this problem? Thanks! Charles This is the mail

Re: Does this have side effects?

2014-02-11 Thread Michael P. Demelbauer
On Mon, Feb 10, 2014 at 11:39:10AM -0600, Jay G. Scott wrote: On Fri, Feb 07, 2014 at 01:55:09PM -0500, Glenn Sieb wrote: This will do what you're looking for, much easier. in main.cf: mydomain = arlut.utexas.edu So, eliminating myorigin as a variable. I'm far from an expert, but

Re: Does this have side effects?

2014-02-11 Thread Michael P. Demelbauer
It looks like the following docs should cover your needs: http://www.postfix.org/OVERVIEW.html http://www.postfix.org/ADDRESS_REWRITING_README.html Sorry, if you already know and read those. Cheers -- Michael P. Demelbauer Systemadministration WSR Arsenal, Objekt 20 1030 Wien

Re: network is unreachable

2014-02-11 Thread Wietse Venema
c cc: Andreas, Thanks for your quick reply--is there a setting in Postfix that I should configure to fix this problem? Thanks! Try using his telnet example first. If that doesn't work then no amount of Postfix tweaking will help. Wietse Charles On Tue, Feb 11, 2014 at 8:18

Re: network is unreachable

2014-02-11 Thread Mauricio Tavares
On Tue, Feb 11, 2014 at 9:34 AM, c cc sub...@gmail.com wrote: Andreas, Thanks for your quick reply--is there a setting in Postfix that I should configure to fix this problem? Thanks! Forget about postfix. First validate you have connection to that server. i.e. can you reach that port

Re: network is unreachable

2014-02-11 Thread lst_hoe02
Zitat von c cc sub...@gmail.com: Andreas, Thanks for your quick reply--is there a setting in Postfix that I should configure to fix this problem? Thanks! Charles You might try with IPv4 only with inet_protocols=ipv4 but you should first check if you can reach them by IPv4 anyway. But

Re: network is unreachable

2014-02-11 Thread c cc
Hi all, Thanks for all your help. Since we are using EC2 from Amazon and they don't support ip6 on EC2, they recommended me to force Postfix to send email using ipV4 by changing: inet_protocols = all to inet_protocols = ipv4 and restart or reload Postfix If I change to ipV4, would it create

Re: network is unreachable

2014-02-11 Thread Robert Schetterer
Am 11.02.2014 17:19, schrieb c cc: f I change to ipV4, would it create more problems for my Postfix no Best Regards MfG Robert Schetterer -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263

Re: network is unreachable

2014-02-11 Thread lst_hoe02
Zitat von c cc sub...@gmail.com: Hi all, Thanks for all your help. Since we are using EC2 from Amazon and they don't support ip6 on EC2, they recommended me to force Postfix to send email using ipV4 by changing: inet_protocols = all to inet_protocols = ipv4 and restart or reload Postfix

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread fleon
I tried to connect with this command: openssl s_client -starttls -smtp -crlf -connect exchangeserver.ourdomain.com:25 It connects, though it says it can't validate certificate (which is expected, our exchange certificate is self signed) After EHLO i now get: AUTH NTLM LOGIN So i tried with

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread Wietse Venema
fleon: I tried to connect with this command: openssl s_client -starttls -smtp -crlf -connect exchangeserver.ourdomain.com:25 ... After typing then manually encoded, i got a RENEGOTIATING and finally a Openssl s_client will renegotiate when you type R. Try using lowercase characters only.

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread Viktor Dukhovni
On Tue, Feb 11, 2014 at 09:48:03AM -0800, fleon wrote: After EHLO i now get: AUTH NTLM LOGIN So i tried with login and it requested my username and password in base64. After typing then manually encoded, i got a RENEGOTIATING and finally a handshake failure. Don't know if it's because i

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread fleon
I have this in my main.cf (note: i didn't set this up, my guess is that debian itself did, or maybe when i installed libsasl2-modules, but i don't think so) smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key smtpd_use_tls = yes

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread Viktor Dukhovni
On Tue, Feb 11, 2014 at 10:36:54AM -0800, fleon wrote: I have this in my main.cf (note: i didn't set this up, my guess is that debian itself did, or maybe when i installed libsasl2-modules, but i don't think so) smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem smtpd_tls_key_file

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread li...@rhsoft.net
Am 11.02.2014 20:01, schrieb Viktor Dukhovni: On Tue, Feb 11, 2014 at 10:36:54AM -0800, fleon wrote: I have this in my main.cf (note: i didn't set this up, my guess is that debian itself did, or maybe when i installed libsasl2-modules, but i don't think so) smtpd_tls_cert_file =

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread Viktor Dukhovni
On Tue, Feb 11, 2014 at 08:06:17PM +0100, li...@rhsoft.net wrote: and that is why i hours ago posted the *client* configuration of the machine happily sends authenticated mail over TLS to exchange smtp_use_tls = yes Obsolete. smtp_tls_loglevel = 1 smtp_tls_CAfile =

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread fleon
FINALLY it worked, but not before i disabled NTLM in the config, because otherwise it would try it. So, i had to enable client side TLS and disabling NTLM. It says untrusted connection in the logs, and i tried modifying the mynetworks variable below but couldn't fix it. It may be untrusted

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread li...@rhsoft.net
Am 11.02.2014 21:15, schrieb fleon: FINALLY it worked, but not before i disabled NTLM in the config, because otherwise it would try it. as said in my first reply uninstall the NTLM module as long you have no damned good reason to install it in case of the distributions i work with it is a

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread Viktor Dukhovni
On Tue, Feb 11, 2014 at 10:14:10PM +0100, li...@rhsoft.net wrote: So, i had to enable client side TLS and disabling NTLM. It says untrusted connection in the logs, and i tried modifying the mynetworks variable below but couldn't fix it. It may be untrusted because of the invalid exchange

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread Noel Jones
On 2/11/2014 2:15 PM, fleon wrote: ... Now, a final question that isn't exactly relevant to postfix. Can i make emails sent to come as myu...@ourdomain.com instead of the default myu...@helpdesk.ourdomain.com Maybe you're looking for http://www.postfix.org/postconf.5.html#masquerade_domains

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread fleon
I am fine with the end result. The untrusted message is rather cosmetic, i would like to know how to import the certificate or rather trust the server (as i thought the mynetwork variable would do), but it's no biggie. The server is inside our lan and the relay will only be used for our helpdesk,

Re: Exchange 2007 gives 535 5.7.3 Authentication unsuccessful

2014-02-11 Thread Viktor Dukhovni
On Tue, Feb 11, 2014 at 01:37:17PM -0800, fleon wrote: Some would argue that using the virtual smtp server (that asks for no password) is better, since with the current setup i have to make sure the user that will send the mail (which should be static, as they will be automatically sent by

How to block bogus localhost.localdomain/127.0.0.1 (helo_access)

2014-02-11 Thread L. D. James
Most of the spam getting in my system is stamped with localhost.localdomain. I have tried to use the helo_access file from a few sources. The ones I tried either didn't work or made more of the spam messages get through. One of the fixes I tried I got from:

Re: How to block bogus localhost.localdomain/127.0.0.1 (helo_access)

2014-02-11 Thread Wietse Venema
L. D. James: main.cf: ? smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, check_helo_access hash:/etc/postfix/helo_access, permit You need whitespace at the beginning of the permit_mynetworks and

Re: How to block bogus localhost.localdomain/127.0.0.1 (helo_access)

2014-02-11 Thread Noel Jones
On 2/11/2014 4:20 PM, L. D. James wrote: Most of the spam getting in my system is stamped with localhost.localdomain. All the mail that passes through your amavisd-new mail filter passes through localhost.localdomain. If you block localhost you won't receive any mail. You need to trace a

Re: network is unreachable

2014-02-11 Thread Benny Pedersen
On 2014-02-11 17:19, c cc wrote: Since we are using EC2 from Amazon and they don't support ip6 on EC2, they recommended me to force Postfix to send email using ipV4 by changing:  inet_protocols = all to inet_protocols = ipv4 and restart or reload Postfix this will force postfix to only use

Re: How to block bogus localhost.localdomain/127.0.0.1 (helo_access)

2014-02-11 Thread L. D. James
On 02/11/2014 06:05 PM, Noel Jones wrote: On 2/11/2014 4:20 PM, L. D. James wrote: Most of the spam getting in my system is stamped with localhost.localdomain. All the mail that passes through your amavisd-new mail filter passes through localhost.localdomain. If you block localhost you won't

Re: How to block bogus localhost.localdomain/127.0.0.1 (helo_access)

2014-02-11 Thread L. D. James
On 02/11/2014 05:39 PM, Wietse Venema wrote: permit_mynetworks, check_helo_access hash:/etc/postfix/helo_access, permit Thanks, Wietse. I had white spaces. I had tried to have it exactly like the example in the link I posted. I see I made a mistake in my post. But the main.cf has the