0

I cannot find why masquerading isn't working for our server. I have been through a few dozen online explanations of the subject, here and on other forums, and according to them we are taking all the right steps. I hope someone can tell me what I have missed. To avoid typos in editing I will use the name of the real domain here.

We are trying to use masquerading, to set fully qualified hostnames for From: addresses on a machine without a locally set hostname. This is for a web host whose email addresses are all hosted by our ISP, delivered and spooled on separate machine defined by our domain MX records.

We haven't set a Fully Qualified hostname on the machine itself, since when we did that we couldn't stop our web host from trying to deliver email locally instead of to our MX servers.

To get around blacklisting we have set HELO to our domain actionphotography.ie (confirmed by helocheck@helocheck.abuseat.org) and we are masquerading all our local hostnames / domains to our fully qualified name, via these settings in sendmail.mc (confirmed it compiles OK before restarting sendmail, & note the affected host is on Amazon / AWS EC2 and may start off with a non-standard sendmail configuration):

define(`confDONT_PROBE_INTERFACES', `True')dnl
define(`confHELO_NAME', `actionphotography.ie')dnl
MASQUERADE_AS(`actionphotography.ie')dnl
FEATURE(masquerade_envelope)dnl
FEATURE(masquerade_entire_domain)dnl
MASQUERADE_DOMAIN(localhost)dnl
MASQUERADE_DOMAIN(localhost.localdomain)dnl
MASQUERADE_DOMAIN(apl)dnl

Yet the masquerading doesn't appear to be changing the domain name for either the Header Sender or the Envelope Sender; it's still being written as "localhost.localdomain":

[25] apl% mail -v john@actionphotography.ie
Subject: foo
EOT
Null message body; hope that's ok
john@actionphotography.ie... Connecting to [127.0.0.1] via relay...
220 localhost.localdomain ESMTP Sendmail 8.14.4/8.14.4; Tue, 4 Aug 2015 18:41:55 GMT
>>> EHLO localhost.localdomain
250-localhost.localdomain Hello apl [127.0.0.1], pleased to meet you ...
>>> MAIL From:<ec2-user@localhost.localdomain> SIZE=229
250 2.1.0 <ec2-user@localhost.localdomain>... Sender ok
>>> RCPT To:<john@actionphotography.ie>
>>> DATA
250 2.1.5 <john@actionphotography.ie>... Recipient ok
354 Enter mail, end with "." on a line by itself
>>> .
250 2.0.0 t74Ifte9002551 Message accepted for delivery
john@actionphotography.ie... Sent (t74Ifte9002551 Message accepted for delivery)
Closing connection to [127.0.0.1]
>>> QUIT
221 2.0.0 localhost.localdomain closing connection

We are told by our ISP that the mail is bouncing back from our server since we still don't have a qualified domain name in our From: address, with the following response:

----- Transcript of session follows -----
... while talking to mx1.reg365.net.:
>>> DATA
<<< 550 Sender could not be verified, please check your from address
550 5.1.1 <john@actionphotography.ie>... User unknown
<<< 503-All RCPT commands were rejected with this error:
<<< 503-Sender could not be verified, please check your from address
<<< 503 Valid RCPT command must precede DATA

(Note the address above before "User unknown" is valid on the mail server, so I can only assume this is a "feature" telling spammers to get lost in case they are submitting From: addresses with unqualified hostnames. Please let me know if I could be wrong about that.)

I can confirm that both the Header Sender and Envelope Sender should be rewritten with a proper domain name, so don't know why only the local From: address is appearing in the above dialogue:

[root@apl mail]# sendmail -bt
...
>  /tryflags HS
> /try esmtp ec2-user@localhost.localdomain
... Rcode = 0, addr = ec2-user@actionphotography.ie
...
> /tryflags ES
> /try esmtp ec2-user@localhost.localdomain
... Rcode = 0, addr = ec2-user@actionphotography.ie

My question(s): Isn't it true that if masquerading is working we shouldn't be seeing "localhost.localdomain" at all in the mail dialogue? What else should I be seeing to make sure masquerading is working correctly? ... and what can I do to achieve this?

0

As I understand you modified sendmail.mc/sendmail.cf. You reported SMTP dialogue with 127.0.0.1:25 - it is controlled by submit.mc/submit.cf. Masquerading in sendmail.cf should act later when message leaves 127.0.0.1:25.

Execute the following command/script as root to see SMTP dialogue with MXes of the domain.

#!/bin/sh
RECIPIENT=john@actionphotography.ie
SENDER=ec2-user@localhost.localdomain

/usr/sbin/sendmail -i -v -Am -f$SENDER $RECIPIENT <<END
Subject: foo test
From: $SENDER    

foo test
END

man sendmail:

-Am    Use  sendmail.cf even if the operation mode indicates an initial
       mail submission.
| improve this answer | |
  • thank you; I didn't know there was a separate set of parameters (submit.mc) for the local messages. Messages were leaving the originating host with masquerading OK (via sendmail.cf)... but then the MX host was bouncing them because the "ec2-user" account didn't exist as a user over there. This showed up in their logfiles, but also would have been apparent from "SMTP dialogue with MXes" as you suggest. – rphair Aug 6 '15 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.