I was asked to have a look at an old RedHat server (with old as in uname -a giving Linux server 2.4.20-27.7 #1 Thu Dec 11 15:04:48 EST 2003 i686 unknown) which is having problem with sendmail. The server was set up 2003 and hasn't really been touched since then from what I've learned. After a power failure it needed a fsck to boot, and since then the users aren't getting their mail.

I had a look at /var/log/maillog, and there are tons of lines like these:

Aug 22 21:26:22 server sendmail[12250]: p7KIujl05665: to=<id5367@demons.murgent.com>, delay=2+00:22:16, xdelay=00:00:20, mailer=esmtp, pri=4369005, relay=demons.murgent.com., dsn=4.0.0, stat=Deferred: Name server: demons.murgent.com.: host name lookup failure
Aug 22 21:27:22 server sendmail[12250]: p7KHujo05650: to=<apache@sweclo-web02.driften.net>, delay=2+00:27:53, xdelay=00:00:20, mailer=esmtp, pri=4404312, relay=sweclo-web02.driften.net., dsn=4.0.0, stat=Deferred: Name server: sweclo-web02.driften.net.: host name lookup failure
Aug 22 21:27:43 server sendmail[12435]: p7MJNuk12435: SYSERR: putoutmsg ([]): error on output channel sending "250 2.1.5 <user@domain.com>... Recipient ok (will queue)": Connection reset by []
Aug 22 21:27:43 server sendmail[12435]: p7MJNuk12435: lost input channel from [] to MTA after rcpt
Aug 22 21:27:43 server sendmail[12435]: p7MJNuk12435: from=<no-reply.1@nyc.gov>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[]
Aug 22 21:28:22 server sendmail[12250]: p7KIujm05665: to=<noreply@cgsociety.org>, delay=1+23:39:41, xdelay=00:00:20, mailer=esmtp, pri=4413757, relay=cgsociety.org., dsn=4.0.0, stat=Deferred: Name server: cgsociety.org.: host name lookup failure

However, name resolution works from the command line with every utility I've tried (ping, host, dig...). The server is also running a named, but it seems to have been shifted over to using another name server at some point (/etc/resolv.conf has the server IP listed, but commented out, and instead points at the router, which forwards to the ISP's DNS servers). Does sendmail have some internal way of doing name resolution?

I have never looked at a sendmail.cf file before today (what has been seen cannot be unseen) but couldn't make much out of it. It did not seem to mention name resolution. Any ideas what I should check?

EDIT: The requested config files:

resolv.conf: ( is the server, is the gateway/router)

# nameserver


// generated by named-bootconf.pl

options {
        directory "/var/named";
         * If there is a firewall between you and nameservers you want
         * to talk to, you might need to uncomment the query-source
         * directive below.  Previous versions of BIND always asked
         * questions using port 53, but BIND 8.1 uses an unprivileged
         * port by default.
        // query-source address * port 53;

// a caching only nameserver config
zone "." IN {
        type hint;
        file "named.ca";

zone "localhost" IN {
        type master;
        file "hosts.domain.com";
        allow-update { none; };

zone "0.168.192.in-addr.arpa" IN {
        type master;
        file "db.192.168.0";
        allow-update { none; };
key "key" {
        algorithm hmac-md5;
        secret "secret-key-edited-out";

EDIT 2: I rearranged the resolv.conf file to fallback to the server itself on failure, and now it is slowly but surely (700 MHz Celeron, woo!) processing the mail queue. I'm not certain for how long it has been commented out, but maybe someone else has been asked to have a look recently... Anyway, why would it only work when using it's own DNS?

  • Maybe I wasn't clear on this not being an initial setup problem - it has been working for almost a decade until now, so it is not a problem of the firewall not letting it through. – carlpett Aug 22 '11 at 19:58
  • It might still be something like the firewall; if the machine originally had the firewall adjusted with something like iptables -A, but not subsequently saved, the post-reboot configuration may not match the pre-reboot config. When was the last reboot before the power failure? – Stobor Aug 23 '11 at 2:34
  • @Stobor: Less than a year ago, also due to a power failure. Apparently, power failures occur at least anually, and no action has previously been required for mail to resume working – carlpett Aug 23 '11 at 6:33

This may be of help.


In short:

Updated sendmail.mc with:


And then configure the mail.switch file:

 # cat /etc/mail/service.switch
  hosts files

EDIT: let's see the output of resolv.conf. Also, can we get the output of named.conf as well?

EDIT2: It looks like this machine has it own master DNS server with specific zone records in "hosts.domain.com" that were resolving prior to the reboot. I would imagine that if you look at that zone file, you'll see that the domains in that zone file match the domains that sendmail could not resolve. Of course, considering that name server was commented out in /etc/resolv.conf, it is not really likely. But just case, uncomment that line and see if sendmail will resolve the domains.

  • If I understand the answer to the SO question correctly, that would force me to keep a /etc/hosts file for all hosts I want to send mail to? That does not seem like a solution to me, there are quite a few mail servers out there... – carlpett Aug 22 '11 at 20:00
  • Okay, fair enough, I think I misunderstood the question to an extent. However, it does seem to point to a name resolution someplace outside of sendmail. Can we get the output of the .conf files I mentioned? – Rilindo Aug 22 '11 at 20:20
  • Sure, I'll edit them into the question. – carlpett Aug 22 '11 at 21:29

I've run into issues with sendmail and incorrect name resolution before...

The problem was that my "public" ip address wasn't assigned to any interface on my sendmail box. Sendmail would try & do a resolution of the domain in my emails to direct to the proper mail server... and would re-try to forward the incomming messages to it's publically NAT'd address. The only fix was to setup a bind server locally, and give it entries that resolve to the private address on that box.

I am just now reading Rilindo's answer... and that sounds like a better solution. I might have to try that one out sometime.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.