topic Re: sendmail: why doesn't it resolve? in Operating System - HP-UX

sendmail: why doesn't it resolve?

Fred Martin_1 — Thu, 27 Mar 2003 21:15:45 GMT

Running sendmail version 11.1 on HP-UX 11.0...DNS also running on the same box.

I can resolve a particular domain name thus:

# nslookup windflite.com
....
Name: windflite.com
Address: 216.166.249.146

But an email sent to me from windflite.com is rejected:

sendmail[6397]: h2RL1Ul06397: ruleset=check_mail, arg1=, relay=[216.166.249.146], reject=451 4.1.8 Domain of sender address andy@windflite.com does not resolve

And to complicate it, if he sends the email a few more times, eventually it will resolve and gets delivered. nslookup -always- returns the address so I'm having a hard time believing that's simply DNS.

This began happening with 11.1, never happened when I was on 8.9.3 ...

Help! I'm rejected needed mail....

Re: sendmail: why doesn't it resolve?

Jeff Schussele — Thu, 27 Mar 2003 21:22:00 GMT

Hi Fred,

Sendmail deals with special DNS entries known as MX (Mail eXchanger) records.

So lookup as follows
nslookup
> set type=mx
> windflite.com

Then you should get responses indicating the mail exchanger as well as preferences for each. If you don't get response, well then there's your trouble....
If you get responses then reverse lookup (by IP) the IPs for these MX entries - they MUST resolve as well.
Sendmail is very, very picky about lookups - they MUST resolve & resolve corectly in both directions.

HTH,
Jeff

Re: sendmail: why doesn't it resolve?

John Dvorchak — Thu, 27 Mar 2003 21:25:07 GMT

I don't know if this helps or not, but when I do an nslookup on windflite.com I get 216.166.249.146 but when I do an nslookup on the address I get:

nslookup 216.166.249.146
Name Server: sldns.sbc.com
Address: 132.201.90.250

Trying DNS
Name: 216-166-249-146.clec.peknil.madisonriver.net
Address: 216.166.249.146

Evidently that address resolves to two different domains. Is that person using a 3rd part domain service like gotdns.com where he has a DSL/Cable attached server but has the domain name resolving to an address owned by peknil.madisonriver.net?

I think what is happening is that to your email server it looks like a spoofed name or spammer name and is rejecting them. You could try putting an /etc/hosts entry for this person if that is the only one that you are having
trouble with:
216.166.249.146 windflite.com

Good luck

Re: sendmail: why doesn't it resolve?

Fred Martin_1 — Thu, 27 Mar 2003 21:30:25 GMT

OK, did this:

> set type=mx
> windflite.com

And got:

Trying DNS
Authoritative answers can be found from:
windflite.com
origin = ns1.dnswiz.com
mail addr = hostmaster.dnswiz.com
serial = 12050
refresh = 1800 (30 mins)
retry = 900 (15 mins)
expire = 604800 (7 days)
minimum ttl = 900 (15 mins)

Not sure what it means but why would it go through OK with sendmail, every third or fourth attempt, though?

If I just set sendmail to allow non-resolving names am I opening myself up to all kinds of trash?

Re: sendmail: why doesn't it resolve?

Wilfred Chau_1 — Thu, 27 Mar 2003 21:41:55 GMT

Do you have an account on windflite.com?

Try connect to the mail server directly.
mail addr = hostmaster.dnswiz.com

telnet hostmaster.dnswiz.com 25
helo
mail from: <>
rcpt to:
data

.

See if you could get past rcpt to. If you get "571 we do not relay", which means the mail server does not relay mail for you sender host.

Re: sendmail: why doesn't it resolve?

Fred Martin_1 — Thu, 27 Mar 2003 21:44:33 GMT

I get this when I try to resolve the address:

# nslookup 216.166.249.146
Name: 216-166-249-146.clec.peknil.madisonriver.net
Address: 216.166.249.146
#

So the name resolves but not the address.

I'm looking through the logs and I see several very big venders of ours that are getting rejected and so it seems that this is not a unique case.

I'm thinking I'll need to allow unresolvable addresses?

Re: sendmail: why doesn't it resolve?

Steven E. Protter — Thu, 27 Mar 2003 21:46:58 GMT

Results from my web/mail server on the public Internet.

Sounds to me like you aren't getting reliable answers from your DNS server. You aren't using mail relay it seems.

[invest@jerusalem invest]$ dig windflite.com

; <<>> DiG 9.2.1 <<>> windflite.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6311
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;windflite.com. IN A

;; ANSWER SECTION:
windflite.com. 900 IN A 216.166.249.146

;; Query time: 305 msec
;; SERVER: 216.231.41.2#53(216.231.41.2)

[invest@jerusalem invest]$ nslookup
Note: nslookup is deprecated and may be removed from future releases.
Consider using the `dig' or `host' programs instead. Run nslookup with
the `-sil[ent]' option to prevent this message from appearing.
> set type=mx
> windflite.com
Server: 216.231.41.2
Address: 216.231.41.2#53

Non-authoritative answer:
*** Can't find windflite.com: No answer

Authoritative answers can be found from:

Based on these results it looks like THEIR DNS server isn't working right. I don't think its your setup.

SEP
;; WHEN: Thu Mar 27 15:44:47 2003
;; MSG SIZE rcvd: 47

Re: sendmail: why doesn't it resolve?

Fred Martin_1 — Thu, 27 Mar 2003 21:52:05 GMT

Accck! Forgot to mention, and this seems a pretty big part of the puzzle to me, my domain is applicatorssales.com, but I also accept mail for another domain name of ours - paradigmwindows.com .... both companies use the same server...but all the same users on the same machine.

When you send an email to fmartin@paradigmwindows.com, 3 out of 4 get rejected as described above.... but an email to fmartin@applicatorssales.com will always work.

???

Re: sendmail: why doesn't it resolve?

Steven E. Protter — Thu, 27 Mar 2003 21:53:22 GMT

Cute tag line.

I thought of another test, though I'm now convinced its their DNS server.

Ran this test on my mail server which is running its own firewall but not behind one.

[root@jerusalem root]# sendmail -v -d38 -d8 andy@windflite.com
Steve was here
.
getmxrr: res_search(windflite.com.) failed (errno=0, h_errno=4)
andy@windflite.com... Connecting to windflite.com. via esmtp...
220 mail.windflite.com ESMTP Merak 4.00.80; Thu, 27 Mar 2003 16:54:01 -0600
>>> EHLO investmenttool.com
250-mail.windflite.com Hello investmenttool.com [66.92.143.194], pleased to meet
you.
250-SEND
250-SOML
250-SAML
250-SIZE
250-EXPN
250-ETRN
250-DSN
250-CHUNKING
250-CHECKPOINT
250-STARTTLS
250 HELP
>>> MAIL From: SIZE=15
250 OK ... Sender ok
>>> RCPT To:
250 OK ... Recipient ok
>>> DATA
354 Enter mail, end with "." on a line by itself
>>> .
250 OK 327 bytes received in 00:00:00; Message accepted for delivery
andy@windflite.com... Sent (OK 327 bytes received in 00:00:00; Message accepted
for delivery)
Closing connection to windflite.com.
>>> QUIT
221 mail.windflite.com closing connection

I'm not going to send multiple mail's but this did not work every time I ran it. I hope Andy isn't pissed with me.

In HP-UX the syntax should be:
/usr/sbin/sendmail -v -d8.99 -d38.99 andy@windflite.com

type in a tag line
hit enter
type a dot(period)
.
hit enter

It is not working reliably, its his DNS server.

SEP

SEP

Re: sendmail: why doesn't it resolve?

Fred Martin_1 — Thu, 27 Mar 2003 21:54:25 GMT

Sorry "when you send an email" should read "when andy@windflite.com" sends an email" ...

Re: sendmail: why doesn't it resolve?

Steven E. Protter — Thu, 27 Mar 2003 21:56:26 GMT

sounds like I'm clueless.

Sorry.

If you are the DNS admin for that server, please upload the configuration of the zone record for both domains.

Also the /etc/aliases file would be useful.

Name server for windflite.com is not giving consistent answers for mx requests lookup requests. That much I am certain of.

SEP

Re: sendmail: why doesn't it resolve?

Fred Martin_1 — Thu, 27 Mar 2003 21:57:56 GMT

Please let's not actually use windflite.com as a test thanks, they're a business partner of ours.

Re: sendmail: why doesn't it resolve?

Steven E. Protter — Thu, 27 Mar 2003 22:03:00 GMT

Okay, I sent one mail, that was accepted. Please relay my deepest apologies.

SEP

Re: sendmail: why doesn't it resolve?

Fred Martin_1 — Thu, 27 Mar 2003 22:22:44 GMT

I just sent an email to that address from my server; the mail was deferred and is in my mailq ... reason host map lookup deferred.

So sendmail doesn't send to that domain, I would assume for the same reason.

This makes me believe that turning off the feature that rejects unresolvable names for incoming mail won't fix my problem, but I will test it.

There's got to be some other difference between sendmail 8.9.3 and 11.1 ...

fred

Re: sendmail: why doesn't it resolve?

Steven E. Protter — Thu, 27 Mar 2003 22:38:57 GMT

Nope, I'm convinced its the DNS server configuration on the target of your email. I've had similar problems with my mx server when I had a syntax record in the zone record.

If you have control, I'm uploading a valid zone record that includes an mx record from one of the domains I host.

Hope it helps.

[invest@jerusalem named]$ more ilcba.org.zone

$TTL 86400
@ IN SOA @ ilcba.org (
4 ; serial
28800 ; refresh
7200 ; retry
604800 ; expire
86400 ; ttl
)

@ IN NS dns1.investmenttool.com.
@ IN NS dns2.investmenttool.com.
@ IN MX 10 ilcba.org. ; primary mail exchanger

@ A 66.92.143.199
www A 66.92.143.199
news A 66.92.143.199
shell A 66.92.143.199
smtp A 66.92.143.199
dns1 A 66.92.143.194
dns2 A 66.92.143.195
localhost CNAME ilcba.org.
ftp CNAME investmenttool.com.
mail CNAME ilcba.org.

If I'm still not getting it, I apologize, but that DNS server isn't giving me good answers.

SEP

Re: sendmail: why doesn't it resolve?

Fred Martin_1 — Fri, 28 Mar 2003 11:31:09 GMT

I don't agree that it's their problem, and am pretty convinced it's mine. Here's another log entry, form just yesterday:

Mar 27 16:56:36 corp sendmail[8847]: h2RLual08847: ruleset=check_mail, arg1=,
relay=atlrel7.hp.com [156.153.255.213], reject=451 4.1.8 Domain of sender address itrc_forums1@hp.com does not resolve

Sorry, I gotta believe HP's domain is good to go. This has to be a configuration issue in my sendmail, or my DNS server.

Re: sendmail: why doesn't it resolve?

Fred Martin_1 — Fri, 28 Mar 2003 13:54:13 GMT

And, it's not consistent - sometimes, the same address will resolve, other times it won't (according to sendmail) ... using nslookup at a shell prompt, it always resolves.

Re: sendmail: why doesn't it resolve?

Fred Martin_1 — Fri, 28 Mar 2003 14:07:50 GMT

Going back to something John said above, I'm wondering - if sendmail requires that it resolves in both directions, what happens when a domain name returns more than one address? i.e. hp.com will return several, but when you query each address you get individual hosts at hp.com. Still, the domain part is correct.

I really need more discussion on this as this must be resolved. I'd hate to have to go back to 8.9.3 ....

Re: sendmail: why doesn't it resolve?

Ron Kinner — Fri, 28 Mar 2003 16:45:58 GMT

I think you are just running a foul of the antispamming improvements in 11.1.

Have you tried putting an entry in /etc/mail/access for windflite.com (and any others which are a bit shaky)?

windflite.com OK

or

windflite.com RELAY

should let it work even if it doesn't resolve. Note you have to run

makemap hash /etc/mail/access < /etc/mail/access

after creating your access file or it own't work. And of course you have to have turned the feature on in the config file:

FEATURE(`access_db')

http://www.sendmail.org/m4/anti_spam.html#access_db for more details.

Ron

Re: sendmail: why doesn't it resolve?

Fred Martin_1 — Fri, 28 Mar 2003 19:34:59 GMT

Ron,

This is the makemap I'm doing:

makemap dbm /etc/mail/access < /etc/mail/access

I had been using that for sendmail 8.9.3...Is that not correct? Your example is using hash.

Also, I didn't put any entries in for the sticky ones because I'm sure there's something else going on; for instance, that hp.com record shown above, and the fact that they do occasionally resolve and get through.

Fred