1

I have a dedicated server (debian) on which I have installed Exim and Dovecot. Everything worked fine until around a month ago. I tried to reinstall and reconfigure exim but I keep having all the incoming emails rejected.


Outlook says:

A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:

technical@mydomain.com SMTP error from remote mail server after RCPT TO:: host mail.mydomain.com [94.76.##.##]: 550 relay not permitted

GMAIL:

Delivery to the following recipient failed permanently:

technical@mydomain.com

Technical details of permanent failure: Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 550 550 relay not permitted (state 14).


On the server side, my rejectlog file shows:

2011-01-04 17:09:21 H=mail-qw0-f53.google.com [209.85.216.53] F=<####@gmail.com> rejected RCPT : relay not permitted

... and the mainlog file:

2011-01-04 17:00:01 1PaAEr-0007vN-DX <= root@ETC_MAILNAME U=root P=local S=869
2011-01-04 17:00:01 1PaAEr-0007vN-DX ** root@etc_mailname: Unrouteable address
2011-01-04 17:00:01 1PaAEr-0007vY-Kn Error while reading message with no usable sender address (R=1PaAEr-0007vN-DX): at least one malformed recipient address: root@ETC_MAILNAME - malformed address: _MAILNAME may not follow root@ETC
2011-01-04 17:00:01 1PaAEr-0007vN-DX Process failed (1) when writing error message to root@ETC_MAILNAME (frozen)
2011-01-04 17:09:21 no IP address found for host MAIN_RELAY_NETS (during SMTP connection from mail-qw0-f53.google.com [209.85.216.53])
2011-01-04 17:09:21 H=mail-qw0-f53.google.com [209.85.216.53] F=<####@gmail.com> rejected RCPT : relay not permitted

then after the message becomes frozen:

2011-01-04 17:28:44 1PaAEr-0007vN-DX Message is frozen



Thank you for your help, any idea/comment is welcomed as I am really running out of idea to fix this issue,
Nicolas.

Oh and the PHP mail() function does not do anything as well, would it be linked to? I think mail() uses sendmail from my php.ini.

2

Dunno excatly yet, but I have the same problem here since about 22hrs ago...

Maybe you should have a look at this http://forums.debian.net/viewtopic.php?f=11&t=58312 and that http://www.reddit.com/r/netsec/comments/en650/details_of_the_root_kit_that_got_installed_on_my/

Maybe you got rooted?

  • Hi, I have all the same symptoms! Even the /etc/init.d/xfs3, what should I do now? – Nicolas Jan 6 '11 at 11:49
  • Instructions:rm /dev/null && mknod /dev/null c 1 3 && chmod 666 /dev/null chattr -ai /var/spool/exim4/s* rm -r /var/spool/exim4/{a.conf*,e.conf*,rk*,s*,setuid*} chattr -ai /usr/include/sslv3/{dropbear,mig} rm -r /usr/include/sslv3/ update-rc.d -f xfs3 remove rm /etc/init.d/xfs3 rm /usr/include/mysql/mysql.hh1 chattr -ai /usr/bin/free /bin/kill /usr/bin/pgrep /usr/bin/pkill /usr/bin/pmap /bin/ps /usr/bin/pwdx /usr/bin/skill /usr/bin/slabtop /usr/bin/snice /sbin/sysctl /usr/bin/tload /usr/bin/top /usr/bin/uptime /usr/bin/vmstat /usr/bin/w /usr/bin/watch rm /usr/bin/w aptitude reinstall procps – Nicolas Jan 6 '11 at 11:58
  • Following the instructions pasted above thanks to davemmm on reddit.com/r/netsec/comments/en650/… , I cleaned everything on the server and jsut got rid of exim by using Google Apps SMTP feature instead. Thanks a LOT for that! – Nicolas Jan 6 '11 at 12:07
  • I'm afraid, but following this instructions is just some kind of quick-fix, workaround or something. There may be more rootkits installed. For example: my machine didn't have dorpbear installed, but at least there were a few irc-bots and a "patched" sshd. I cleand what I could find, but to make sure that you have a clean machine you have to set it up from scratch. Well, mine is still online, too. I'm currently thinking of moving to Google and switching off this machine... – Lost Carrier Jan 7 '11 at 9:22
  • I've cleaned the ssh connections as well, and I had dropbear installed. Everything exactly like him. As I am not using Exim anymore and I think I've cleaned a lot of things already I'm going to keep my server as it is -plus it's a live server...-. Google Apps is worth the changes. – Nicolas Jan 7 '11 at 11:58
3

A very handy trick to see what exim is doing with an email address is to run:

exim -bt example@domain.com

If it immediately uses the remote_smtp transport, then you need to tell exim what domains it's responsible for.

  • Hi Niall, here's the result of the exim -bt ######@gmail.com command: ######@gmail.com is undeliverable: Unrouteable address. Cheers – Nicolas Jan 5 '11 at 8:32
  • Even exim -bt ######@mydomain.com says the unrouteable address issue. – Nicolas Jan 5 '11 at 8:56
  • Then your exim.conf is well and truly screwed in some way. Can you try running "dpkg-reconfigure exim4-config" and see if you can reset the config? – Niall Donegan Jan 5 '11 at 11:23
2

Looks as though you're using /etc/exim4/exim4.conf.template as your /etc/exim4/exim4.conf file, verbatim, which is broken.

You should look at /usr/share/doc/exim4-base/README.Debian.gz as this is all Debian-specific. Stock Exim from upstream does not have any macro pre-processing or split configurations or the like. Section 2.1.6.1 talks about how you use a single config file, which is what I think you've tried to do.

Try first mv /etc/exim4/exim4.conf /etc/exim4/exim4.conf-old and then running: update-exim4.conf. (You could also first check that update-exim4.conf.conf is up-to-date.).

Ultimately, you'll want exim -bV to show that the configuration file in use is /var/lib/exim4/config.autogenerated, which means that the mass of tangled definitions all comes into play.

0

I wonder if you have somehow mixed up debian-specific Exim configuration (they use a packager-friendly config that is not part of the standard Exim distribution) with non-debian-specific? It appears that your outbound mail is being automatically tagged with the sender domain ETC_MAILNAME. I'm guessing that's a macro which is supposed to be replaced with the contents of /etc/mailname, but somehow the macro-definition is missing, so you just get the literal string.

Does /etc/mailname exist on your server? If not, you might try creating it and putting your server's FQDN (or whatever you want your default domain to be) in it. Beyond that I don't know anything about debian's packaging so you might seek help on the debian-exim4 help list.

  • 1
    Hi, the file did not exist but putting mydomain.com in a new file /etc/mailname did not fix the issue -unfortunately-. What I do not understand is I even uninstalled and reinstalled it and nothing's changed. Cheers – Nicolas Jan 5 '11 at 8:31
0

Had the same issue. Here's what I did to troubleshoot.

See where it fails by running (change example@domain.com to your destination)

exim -bt example@domain.com

Check if your hosts are getting resolved properly by running these commands on the terminal.

# the following should show the short 'hostname'
hostname

# following should show the full domain name (without www or subdomains)
hostname --fqdn

# following should show the external IP (not 127.0.0.1)
hostname -i

If all is good, and if the block is still unroutable, force the exim configuration to route it. So edit /etc/exim/exim4.conf.template file, and find the block within .ifdef DCconfig_internet. Add this as the first rule. (Change example.com to your domain)

my_domain_routing:
  debug_print = "R: dnslookup for $local_part@$domain"
  driver = dnslookup
  domains = example.com
  transport = remote_smtp
  # ignore private rfc1918 and APIPA addresses
  ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 : 192.168.0.0/16 :\
                        172.16.0.0/12 : 10.0.0.0/8 : 169.254.0.0/16 :\
                        255.255.255.255
  no_more

Run the routing test again to see if it passes now.

Note about exim4.conf.template file. This can get regenerated if you run the config utility again. To avoid this, duplicate this change in the /etc/exim/conf.d/routing/ folder as well.

Reference: SMTP unroutable address Understanding exim configuration files https://stackoverflow.com/questions/17351634/unrouteable-address-with-exim4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.