Mail not delivering

[John Peace]

None of the domain names below are real . They were changed to protect the innocent. The messages are all correct.

I am having problems getting external domain mail to deliver from my HP. My domain is teller.com. All mail addressed to anybody inside teller.com works. Any mail addressed outside teller.com fails.

This is an example of an error in mail.log



Feb 5 15:54:02 Mast01 sendmail[11979]: PAA11977: to=staefords@token.com, ctladdr=root (0/3), delay=00:00:00, xdelay=00:00:00, mailer=smtp, relay=relay5.token.com. [214.211.134.161], stat=Deferred: Connection reset by relay5.token.com.

When I use verbose mode I get the following:

# sendmail -v staefors@token.com
This is a test
staefords@token.com... Connecting to relay2.token.com. via smtp...
staefords@token.com... Connecting to relay5.token.com. via smtp...
staefords@token.com... Closing connection to relay2.token.com.
staefords@token.com... Deferred: Connection reset by relay5.token.com.
Closing connection to relay5.token.com.

#mailq -v

PAA11977 52 120052 Feb 5 15:54 root
(staefords@token.com... reply: read error from relay2.token.com
.)

I do not have the sendmail daemon running. I am running my HP as a client only. My questions?

Is this a firewall problem? Is it on my end or the distant end? What else can I do to troubleshoot this? I am not the firewall or network administrator.

[Mark Greene_1]

Can you ping eitehr relay2 or relay5 from the HP box? What do you get if you telnet to either relay system to port 25?

You may need to enable domain masquerading on the HP system if you external mailer is not pointing back to your internal hosts and is configured to send to only known systems.

HTH
mark

[John Peace]

Ping and traceroute are restricted through our firewall. I tried to telnet port25 to the host and got:

Connected to 214.211.134.161
Escape character is '^]'.
Connection closed by foreign host.

[Steven E. Protter]

I have had your problem.

in /etc/sendmail.cf (it might be in /etc/mail

you have a DS paramter, for relaying mail

DS
[IP address of mail relay server]

Your problem is your mail relay server is not permitting you to relay mail.

If you control it, configure it to accept mail for relay from your HP-UX box. If not see the mail relay servers admin and get her or him to do it.

Let's say you aren't using a mail relay server.

Different issues. In that case you need to resolve the hostname of the server that is supposed to accept your mail. If its an internal exchange box, you really still have a mail relay issue.

If you are supposed to route your own mail to the Internet look at this:

/etc/resolv.conf

He should point to an internal DNS sever that will provide host resolution so that your sendmail daemon knows where the heck to send your mail.

/etc/nsswithc.conf handles how resolution and such happens. Should look kind of like this:
hosts: dns[notfound=continue unavail=continue tryagain=continue] files

This means DNS first....

Even behind a firewall, to properly route mail you need somebody to handle host resolution for you.




Additional diagnostics:

mailq - displays mail queued to go out.
sendmail -q tries to force immediate delivery of the mail queue

/usr/sbin/sendmail -v -d8.99 -d38.99 stevenprotter@yourdomain.net

Just gets you even more verbose diagnistics, case you need it.



Good Luck.

This can be fixed.

Bet you didn't expect this much of a mouthful.

P

[John Peace]

My resolv.conf is pointing to our DNS. I had the DS macro configured for 1 week and all the mail left the HP and stuck at the smtp server. My network people are looking at that Whenever they don't have something they think is more important.. I was hoping to be able to bypass them and get it to go.

This is my latest try.

sendmail -v -d8.99 -d38.99 stanfors@token.com
seq_map_parse(aliases.files, )
map_init(sequence:aliases.files, NULL, 0)
sequence:aliases.files NULL: valid
map_init(implicit:Alias0, /etc/mail/aliases, 0)
impl_map_open(Alias0, /etc/mail/aliases, 0)
hash_map_open(Alias0, /etc/mail/aliases, 0)
impl_map_lookup(Alias0, @)
db_map_lookup(Alias0, @)
implicit:Alias0 /etc/mail/aliases: valid
map_init(host:host, NULL, 0)
host:host NULL: valid
map_init(switch:aliases, aliases, 0)
switch_map_open(aliases, aliases, 0)
switch_map_find => 1
files
map_stack[0] = sequence:aliases.files
switch:aliases aliases: valid
map_init(dequote:dequote, NULL, 0)
dequote:dequote NULL: valid
getcanonname(token.com), trying dns
dns_getcanonname(token.com, trymx=1)
dns_getcanonname: trying token.com. (ANY)
YES
dns_getcanonname: trying token.com. (A)
NO: errno=2, h_errno=4
dns_getcanonname: trying token.com. (MX)
YES
dns_getcanonname: token.com
getcanonname(token.com), found
Test
getmxrr(token.com., droplocalhost=1)
stanfors@token.com... Connecting to relay2.token.com. via smtp...
stanfors@token.com... Connecting to relay5.token.com. via smtp...
stanfors@token.com... Closing connection to relay2.token.com.
stanfors@token.com... Deferred: Connection reset by relay5.token.com.
Closing connection to relay5.token.com.

[Uday_S_Ankolekar · Accepted solution]

Does your firewall has any blocks for SMTP packets ??

-USA..

[Mark Greene_1]

John,

Are you sure the smtp client is running on your relay servers? When you do the telnet to either of them (be sure to specify port 25), you should get a connection string from the smtp client that looks something like this:

220 mailhost.bogus.org ESMTP Sendmail Switch-2.1.1/Switch-2.1.1; Thu, 06 Feb 2003 14:40:02 -0500

[Kasper Haitsma]

Hi John,

I am curious to your DM (masquerade) setting. I think the remote systems relay[2|5].token.com drop your connection, because they cannot do a reverse lookup of your hp-ux box. This is valid for both a direct connection from you to the internet, as well as an internal (to teller.com) relay. Meaning: The messages are stuck on your companies relay for that same reason. Since you do not have the daemon running on your box, once the message is queued on your box, it stays there (untill you retry with 'sendmail -q[v]'). So I think you need to set the DM parm to teller.com, and the Reply-To in the message you send, to John.Peace@teller.com or appropriate. Bottom line, the domains (DM and Reply-To) should be resolvable from the other end (nslookup -q=mx teller.com should return host/IP pair[s])

HTH
Kasper

[W.C. Epperson]

We've seen this sort of behavior in the past based on the timeout.ident in sendmail.cf. Sometimes the other server is not running an identd and your timeout.ident is greater than a timeout on their end. While you're waiting on the ident response, they decide you're not going to do an SMTP transaction and issue a RST.

You can also get some oddities when your sendmail is behind a proxy firewall. When the proxy accepts the connection request on behalf of the remote mail hub, yours thinks it's actually connected to the remote, which may not be available. You get the appearance that you're connecting to an SMTP server, but you're not, and the proxy eventually times out the connection and you log it as though it were the remote hub.

[John Peace]

I will assign points. I am currently working this issue with my firewall people. All the suggestions are great.