Hot answers tagged

7

These sites are misconfigured. Roughly 15 years ago such configuration would be a sure pointer to an IT department running on windows without a clue about the internet. This hasn't changed much. Many companies try to cheap out on the expenses for proper IT support and have a random employee with some basic understanding of IT manage their stuff and those ...


6

Just did an upgrade on an AWS Linux instance and dovecot wouldn't start with Address already in use errors (same as original poster). netstat and lsof didn't show any process attached to those TCP ports. Eventually I discovered that as part of the upgrade the portreserve package was installed. It had a config file /etc/portreserve/dovecot which had listed ...


6

As is noted already in the question, there is a conflict between the desire of not accepting incoming email and the idea of being able to contact the domain owner via email by convention-based email addresses. There is just no way around those two goals being in direct conflict, you will have to decide if you are going to accept email or not. If you decide ...


5

Where should I go from here? I'm not trying to be glib or dismissive, but you ought to move your email to a professionally hosted service. Office 365. GSuite. Whatever. There's no good reason your organization should be hosting your email in house in 2020. You can't provide the level of availability, scalability, and reliability that these services can... ...


5

It's by design that DMARC passes if either DKIM or SPF is aligned i.e. matching with the From header. It's known that DKIM alignment survives forwarding, whereas SPF alignment doesn't: a service forwarding the mail should put the mail in another envelope i.e. use a MAIl FROM (Return-Path) address of its own, which will break the alignment despite the SPF ...


5

The a and mx mechanisms do a DNS lookup each, and mx then does an additional or even several more lookups to fetch the MX addresses. So it is possible that this record would exceed the global lookup limit (though it would certainly be surprising to have so many mail exchanges configured in DNS!). The error is about the void lookup limit, however, which is 2,...


4

In many anti-spam systems an IP-address (range) will have a reputation that is either good, neutral or a known spam source. By changing IP-addresses you lost your existing reputation and traded that in for the lack of or even the bad reputation established by the previous usage of that IP-address. (If the previous usage had established a good reputation ...


4

All systems are created differently; nobody knows how Microsoft, Google, Yahoo works internally. Most spam detection systems are score based, and once a score reaches a certain threshold an email is considered spam. Let's just for reference take the open source standard, Spamassassin. SA has a lot of rule based checks in place, and if a score is >= 5 an ...


4

Port 25 is the standard server-side email port. This includes server-to-server relaying, etc. It is the standard. You can set postfix to use a different port, but it's unlikely you'd be able to talk to anyone else. Port 587 is typically what a mail client would use to send mail to a server. In this case, by client, I mean something like an iPhone, or ...


3

Sure. Just remove it. "rua" is optional as per RFC. https://tools.ietf.org/html/rfc7489


3

Quite a lot of questions but the main two ideas to have in mind: the DNS is a hierarchy, or a tree: technically each node works exactly the same way, wherever it is in the tree; for a node to be resolved it has to be connected to some parent node; this is done in the DNS with NS records domain name registrar play no operational role during resolution (...


3

Looks like you lack an AAAA record for smtp with content 2a01:4f8:xxx::2.


3

To remove the sender IP from the Received header for new mail submissions, use the header_checks key instead of the smtp_header_checks option: header_checks = regexp:/etc/postfix/header_checks_submission The smtp_header_checks option only applies to mail that is sent from Postfix to external servers whereas the header_checks option applies to incoming mail ...


3

You can setup an all-to-all "forwarding" rule in your virtual addresses map as follows: example.net DOMAIN @example.net @example.com The only downside to this is that smtpd will accept all e-mails in @example.net before attempting alias expansion and discovering that nonexistent@example.com doesn't exist and bouncing the message. Whether that is worth ...


3

The receiving server blocks you. This can have multiple reasons, like: Your ip or ip-range is being blocked because it's on some abuse list (consumer ip addresses usually are) Reverse lookup on your ip doesn't work your ip is on a blacklist. even more reason But no doubt, the receiving server blocks you. It's just a matter of finding out why. Has been ...


3

If migrating a mail server the first thing you should do ASAP is to set your MX records to a low TTL so they will not be cached for very long. A value of 60-300 seconds is probably low enough most of the time. Given how most sending mail servers will typically retry many times when sending email, this is probably all you need. Just set a low TTL and swap ...


3

You can send outgoing emails from any server you want. You should add that server's IP address to your SPF record, though. Most email services like sendgrid will have instructions on how to do this.


3

A DKIM signature isn't just "a text blob", but it has to be cryptographically calculated using a private key and the headers/body that are signed with it. Also, OpenDKIM isn't just for adding those signatures, but for validating them, too. To be more exact, OpenDKIM implements RFC 6376, RFC 5617, RFC 5518, RFC 6541 & an asynchronous DNS resolver that ...


3

Mail will always be sent to the MX records that are configured for a domain1. It is perfectly suitable to set up a domain with the A record for the bare domain and www pointing towards a web server and the MX record(s) to a different provider. example.com. IN A 10.9.8.7 www.example.com. IN A 10.9.8.7 example.com. IN MX 1 ASPMX.L.GOOGLE.COM example....


3

Every tutorial on the Internet I could find have this in common: installing the IIS 6 Management Compatibility. The SMTP service is configured using the IIS 6.0 Manager! Chris Lazari: Creating an SMTP Service on Windows Server 2016: In fact, Windows Server 2016 still uses IIS 6 tools to host and manage the SMTP service. This is truly remarkable that a ...


3

If you don't want the sending server to re-attempt delivery then you should use an error code indicating that. 4XX error codes generally mean temporary problem, try again later. 5XX error codes generally mean Delivery failed, don't try again. In short, it's retrying because you instructed the server to. Reference: Wikipedia: List of SMTP server return codes


3

Perform your own message trace from the Security and Compliance center and verify that the email originated from your Office 365 tenant. Look at the sign-ins logs in Azure AD for suspicious sign-ins. Look at the Risky users, Risky sign-ins, and Risk detection logs in Azure AD and look for suspicious activity. Create a Display Name Spoofing transport rule ...


2

I'm usually using this command postsuper -r ALL && postqueue -f Parameter: -r ALL is requeue all message -f is Flush the queue: attempt to deliver all queued mail.


2

Just for the record, because I stumbled over this rather old question (because I had a quite similar problem): There is an easy solution: put your check_sender_access directive into smtpd_data_restrictions. Explanation: As far as I checked, smptd_relay|recipient|sender|client_restrictions are evaluated once for each recipient of the message, at least if ...


2

No, there nothing that always works. There's standards sending wuth a null return path (empty envelope sender, SMTP MAIL FROM:<>) should prevent autotoresponders (https://tools.ietf.org/html/rfc5321#section-4.5.5) Implementers of automated email processors should be careful to make sure that the various kinds of messages with a null reverse-...


2

Not a complete answer, but maybe part of a solution: 1. I tried the solution suggested by @joffrey, but could not get it to work. Enabling or disabling TLSv1.3 ciphersuites in ssl_cipher_list seems to be completely ignored by Dovecot 2.3.4.1. The ssl_prefer_server_ciphers does not have any effect on TLSv1.3 either. No matter what Dovecot settings I tried, I ...


2

In /etc/postfix/master.cf configuration file, ensure that the definition of dovecot service, referenced by virtual_transport configuration parameter, is set to suppress the extension part of the recipient address during the call to /usr/lib/dovecot/deliver. For example, this may not work because ${recipient} will be expanded to bob+sometaghere@...


2

This is perfectly possible. And it is not even a strange scenario. In fact, SMTP is not an end to end connection between mail client and final server but the mail client usually submits the mail to some local SMTP server which then delivers the mail to the next server etc. And this can take multiple hops. The connection between these hops might be encrypted ...


2

Internet email is inherently not very secure, and does not encrypt the content of messages. Any service that stores or forwards your email can read it. Whether or not they will read it is a question you need to ask the individual service provider, but there is no technical reason why they could not read it unless you take extra steps to encrypt the message. ...


2

If an MX record does not exist, the SMTP related RFC's specify a "Fallback to A record" mechanism. So, in the absence of MX records an SMTP server may attempt to deliver email to the A record for the domain. In most cases, the email will be rejected unless there happens to be an authoritative SMTP server at the A record.


Only top voted, non community-wiki answers of a minimum length are eligible