Some quick qmail questions

[slylos]

1. Does qmail resolve domain names before looking in 'locals' and 'virtualdomains' when receiving an SMTP connection? That is to say, when it receives a connection does it wait to receive the 'rcpt' command before a DNS resolve occurs, and also when it attempts to deliver the email message (remotely or local).
2. Does qmail allow you to change the way it displays information in the logs, that is to say, can I configure it to display IP addresses instead of domains for remote messages only?
3. Does qmail perform a DNS lookup when you telnet to port 25? It appears the DNS cache on my linksys router is damaged, and when I changed the DNS servers in /etc/resolve.conf to an external DNS server, I got a response back immediately displaying the host name, but when its configured to use the linksys router, the response is extremely slow (it took about 65 seconds to display '220 server.hatlaw.com' when configured for the linksys).
4. I had a ton of messages addressed to 'carlos' with no domain, and qmail attempted to deliver it to 'carlos@server.hatlaw.com', but that is not an existing domain (I use vpopmail with virtual domains), I had 'defaultdomain' specified as 'hatlaw.com', but it seemed qmail ignored that. Should I get rid of 'me' so 'defaultdomain' is read?
5. qmail seems to be accepting messages for remote domains without prior SMTP authentication (I'm using the smtp-auth patch, but this began before I applied that patch), why would qmail attempt to deliver mail to remote domains not specified in 'rcpthosts'? When I attempt to deliver messages to remote domains not specified in rcpthosts, and without smtp-auth, I get a message stating 'that domain is not in my rcpthosts', which is what I expect. But I still have mail queued for remote domains not listed in rcpthosts, what am I missing?
6. Am I asking too many questions?

 

[thedaver]

1) To my knowledge, no. The rcpthosts is the file that determines whether a qmail install will receive the mail for further handling or whether it will reject the message with a "not serviced here" message.
2) Yup, you have the full source code, change at will. No formatting control files available to my knowledge.
3) Sorry, I don't know your network and cannot comment without more discussion about which side the router supports.
4) Not sure.
5) Mail you accepted before correcting your configuration may be waiting to expire.
6) No, they are a sign that you're trying and learning. Just be sure to ask well formed questions for best results.


D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[slylos]

What do you mean by "which side the router supports"?

The emails bound for remote domains appear on a regular basis, I have an rcpthosts file, and have gone through extensive (initial) measures to ensure I am not running an open relay. Yet despite my best efforts, I still have mail sitting in the outbound queue for domains I do not allow.

Thanks for your help, I love working with qmail thus far, but of course its power can cause it to become a bit overwhelming.

 

[thedaver]

My 99% confidence guess is that your email queue messages for odd domains are bounce responses to fictitious "senders" typically from spamming being sent into your valid domains....

Remember that "sadfkerotqbe@yahoo.cn" is a fabricated sender who sends to "jerome@yourdomain.com", who may be a valid user or not. An invalid recipient will result in an outgoing message back to "sadfkerotqbe@yahoo.cn" to say the message bounced, bad recipient. Odds are that the yahoo.cn user will be invalid too which starts a sequence called double-bouncing.

I suggest you validate my theory by doing this:
"qmailctl queue"
note one of the invalid recipients
"cd /var/qmail/queue/mess"
"grep -ir sadfkerotqbe *" which would be a file search for my fictional @yahoo.cn user

Note the folder and filename in which the string appears
"cd [folder number]"
"more [filename]"

You should be able, by inspection, to understand the nature of the message and whether it's spam.

Do this a couple of times to understand what's going on.


D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[slylos]

That makes sense, bounce mail sitting in the queue . . . any idea's on the DNS issue, as in, why would it take forever for a response with the host name in a telnet to port 25 session?

 

[thedaver]

I'm sorry, I'm not able to follow your dilemma without a more concrete example of the problem behavior... can you provide a sample?

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[slylos]

When I telnet to port 25 on my server, I get the typical "ESMTP Escape Character is '[^'" - if I configure my linksys router as the DNS server, it takes about 60 seconds for the server to respond with "220 server.hatlaw.com" after which it will respond as normal to 'helo' and 'mail' commands, however, if I configure the DNS server as one of the bellsouth DNS servers, it responds with "220 server.hatlaw.com" literally almost immedately (along with all normal response to 'helo' and 'mail') . . .

 

[thedaver]

Why don't you spend some time using 'dig' and/or 'nslookup' against your linksys router's DNS and see if you can pinpoint why it seems to have name resolution issues. More than likely the first resolver it has in its list is not responding.

also, I would try another experiment by telnetting to your server @ port 25 by IP address while the linksys is doing your DNS.

The reality is that after the first attempt is completed, subsequent lookups should go quickly. I tried reaching "server.hatlaw.com" from a public IP of my own. The first attempt took about 3 seconds to complete. The next attempt right after that took no time at all to bring up the screen.

None of this has any bearing on what qmail is doing, IMHO. There's no lookup by qmail to decide what to call itself. This is a client-side issue.

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[slylos]

hatlaw.com has been moved back to our hosting company temporarily until we get some issues worked out with Bellsouth.
Thanks thedaver!

 

[slylos]

Is there a way to private message anyone on this board? I posted my email address so you could contact me directly, but apparently thats not a good idea.

 

[thedaver]

The website in my sig contains ways to reach me, if I'm the one you're trying to reach.

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/