1 Topic by pompeiisneaks

  • pompeiisneaks
  • Member
  • Offline
  • Registered: 2024-04-30
  • Posts: 5

Topic: Intermittent blockage of my inbound SMTP server that is on mydomains

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.6.8 OPENLDAP
- Deployed with iRedMail Easy or the downloadable installer? Yes
- Linux/BSD distribution name and version:  Rocky Linux release 9.3 (Blue Onyx)
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):  LDAP
- Web server (Apache or Nginx): nginx
- Manage mail accounts with iRedAdmin-Pro? Y (and an ldap client for adding shadowAccount)
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

<<< 554 5.7.1 <user@oneofmydomains.com>: Recipient address rejected: SMTP AUTH is required for users under this sender domain
554 5.0.0 Service unavailable
<<< 554 5.5.1 Error: no valid recipients

This error is intermittent, some days only one or two of my domains has this error, other days all of them fail with it, but it is from an IP address that is my external mail spam/virus/etc scanner that is in my trusted mydomains list.  I.e. in theory it should never need to smtp auth, but randomly it's rejecting mail from it with this error. 

What confuses me is that these are a daily digest email generated by my trusted external gateway and those are, as far as I can tell, the only mail being rejected, even though ALL mail comes through this server and all other mail is arriving.  Here's a quick mail flow path, it's pretty simple:

Cloud senders -> MX record SMTP server that is my gateway (gw) -> iredmail host.

outbound mail is the reverse.  flow.  This failure is very confusing in that I 100% trust this gw host, and 99% of the time so does iredmail admin service, but randomly it doesn't?

We have SPF, DKIM, Domain Keys all types of the right stuff setup on this host and it has been working for a long while as well.

(I just recently migrated from zimbra to iredmail because I'm tired of their badly performing system.  iredmail is way faster/lighter weight so far, so thanks for that!)

~Phil

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by pompeiisneaks

  • pompeiisneaks
  • Member
  • Offline
  • Registered: 2024-04-30
  • Posts: 5

Re: Intermittent blockage of my inbound SMTP server that is on mydomains

Just a note, happened again today, but only to one of maybe 20 email that came from the gateway hosts generated email. the rest of them delivered just fine.

3 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,134

Re: Intermittent blockage of my inbound SMTP server that is on mydomains

FYI https://docs.iredmail.org/errors.html#r … der-domain

4 Reply by pompeiisneaks

  • pompeiisneaks
  • Member
  • Offline
  • Registered: 2024-04-30
  • Posts: 5

Re: Intermittent blockage of my inbound SMTP server that is on mydomains

I'd seen that, but I guess due to the intermittent nature of the issue, i.e. my trusted server is trusted sometimes and not others for the exact same email type, that maybe it's a bug with a known fix and/or you'd like me to help find the root cause.  If there's no way to fix it and it's just to hard whitelist the host in the python iredadm script/daemon I can definitely do that.

5 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,134

Re: Intermittent blockage of my inbound SMTP server that is on mydomains

pompeiisneaks wrote:

This error is intermittent, some days only one or two of my domains has this error, other days all of them fail with it, but it is from an IP address that is my external mail spam/virus/etc scanner that is in my trusted mydomains list.  I.e. in theory it should never need to smtp auth, but randomly it's rejecting mail from it with this error. 

How did you whitelist this server IP address?
Did you add it in "MYNETWORKS =" parameter in /opt/iredapd/settings.py by following our tutorial here https://docs.iredmail.org/errors.html#r … der-domain ?

6 Reply by pompeiisneaks

  • pompeiisneaks
  • Member
  • Offline
  • Registered: 2024-04-30
  • Posts: 5

Re: Intermittent blockage of my inbound SMTP server that is on mydomains

ZhangHuangbin wrote:
pompeiisneaks wrote:

This error is intermittent, some days only one or two of my domains has this error, other days all of them fail with it, but it is from an IP address that is my external mail spam/virus/etc scanner that is in my trusted mydomains list.  I.e. in theory it should never need to smtp auth, but randomly it's rejecting mail from it with this error. 

How did you whitelist this server IP address?
Did you add it in "MYNETWORKS =" parameter in /opt/iredapd/settings.py by following our tutorial here  ?

I whitelisted it in the mynetworks part of postfix.  It was accepting all mail excepting a few random ones.  I added it to the whitelist in the python app as well and it seems 'resolved' but I'm still confused about why the 'lack of a whitelist of that server' in the python script worked almost every time from teh same server, even the same locally generated digests 'most of the time'  it seems like the python daemon is failing to catch the massive majority of the 'mail' that wasn't whitelisted and not doing any SMTP auth.   Does that make sense?

7 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,134

Re: Intermittent blockage of my inbound SMTP server that is on mydomains

pompeiisneaks wrote:

Does that make sense?

It doesn't make any sense to me. According to the error message, it's very clear that the email was not smtp authenticated, that's why iRedAPD rejected it.

pompeiisneaks wrote:

<<< 554 5.7.1 <user@oneofmydomains.com>: Recipient address rejected: SMTP AUTH is required for users under this sender domain

8 Reply by pompeiisneaks

  • pompeiisneaks
  • Member
  • Offline
  • Registered: 2024-04-30
  • Posts: 5

Re: Intermittent blockage of my inbound SMTP server that is on mydomains

I manually added the line:

MYNETWORKS = ['up.stream.server.ip']

to the /opt/iredapd/settings.py file and still had a bounce last night. 

I don't really like the idea of setting

ALLOW_FORGED_SENDERS

because I don't want anyone just randomly able to forge a sender now and be able to deliver bad mail to my server... sounds like a recipe for disaster.  Is there no other fix?