[SOLVED] Sendmail rejects all outgoing email, config issue?

seifn06 · Last edited by seifn06 on Thu Jun 06, 2024 6:53 pm; edited 1 time in total

Hello!
I'm setting up a small office email server using mail-mta/sendmail-8.17.1.9 and Sendmail rejects every outbound email not destined for a mailbox on the local server computer running Sendmail. I suspect I've got a configuration issue with either my Gentoo system setup (ex: hostname, hosts or /etc/mail/sendmail.cf) or maybe the latest version of Sendmail has changed from the last time I installed it 2 years ago and has gotten a lot stricter about relaying? Do my server logs below give any clues about how to solve this problem? How do I troubleshoot sendmail to determine if it's correctly reading my access.db file? Is there anything wrong with my configuration? Do file permissions matter on my access.db or other sendmail config files?

I recently installed Gentoo on a new build and am setting up a new server. I have successfully setup older Sendmail versions on older Gentoo systems and suspect I have a configuration issue. I have tried tweaking my /etc/mail/access file many times now and recompiling that and restarting sendmail without success. I get the same results whether I'm using my Thunderbird email reader client on my remote computer or using telnet at the local terminal on the sendmail server.

My server logs show:

szatox · Advocate Joined: 27 Aug 2013 Posts: 3439

Well, I use postfix rather than sendmail, but it's likely to be some common issue.

1) Which port do you use for sending your mail? SMPT or mail submission?
Some servers allow mail submission on either, some require you to use mail submission port for mail sent from its supported domain.

2) Are you sending your mail as an authenticated user? And I mean authenticated in SMTP connection. This is a common requirement, to avoid relying spam.
Are you using a valid accout? With/without domain? Aliases may or may not be considered for authentication, depending on your setup.

3) Do you connect with your mail client directly to the server in question, or does your mail go through another MTA first and then get rejected? Is that other MTA trusted by the server?
Postfix has mynetworks for that, I'd be surprised if sendmail didn't have an equivalent option.
_________________
Make Computing Fun Again

seifn06 · Posted: Thu Jun 06, 2024 12:28 am Post subject:

Hi szatox,

1) I use port 25 (SMTP) for mail submission and confirmed this by telnet'ing into port 25 on my server and interacting with Sendmail that way.

2) No, I'm not sending email as an authenticated user. This is a good idea. I'll look into whether Sendmail requires this now. It has not been a requirement in past versions.

3) I'm connecting directly to my sendmail server both with my Thunderbird email client and using telnet into port 25 on my server. Email sent in both methods is rejected in the same way. Interestingly, when I use telnet to connect to my sendmail server and submit an email message, Sendmail accepts the message but immediately generates a bounce/return message telling me the message was rejected. Whereas, when I try sending the message from Thunderbird, the message never successfully sends and I get a window popup telling me my message was rejected. (Same 550 rejection message in both cases.)

szatox · Advocate Joined: 27 Aug 2013 Posts: 3439

I see. In this case, does your sendmail listen on port 587? If it's available, it is worth a try.
Being an anonymous user is the most likely reason for bounces though; if your server allowed that, it would essentially be an open relay and instantly get blacklisted into oblivion, so rejecting is the only possible sane default.
Another thing that usually is not allowed is plaintext login over insecure channel, so you might need to configure SSL. I don't see any obvious indicators that you already have it. Alternatively, CHAP should be OK-ish even unencrypted, if your server supports it

I don't know why tb and telnet give you different results, you could snoop on the conversation with tcpdump or something, but it would probably be just for sake of curiosity rather than to solve the problem.
_________________
Make Computing Fun Again

Ralphred · l33t Joined: 31 Dec 2013 Posts: 654

There are a bunch of "reasons" for a 5.7.1/550 rejection (just grep 550 sendmail.cf). If you are not getting the full message in the rejection you may be better served temporarily altering some of the error codes to distinguish between them. Unless you have confAUTH_OPTIONS set, setting up auth at this stage would just frustrate things. It might also be worth temporarily setting FEATURE(`accept_unresolvable_domains') to give a direction to start looking in if it works.

seifn06 · Posted: Thu Jun 06, 2024 3:24 pm Post subject:

After some more testing, I determined I'm able to send outgoing email to a hotmail.com email address when I telnet into my Sendmail server's port 25 from the server #/$ prompt (i.e. when my email message originates on and is sent from my local server). I'm still unable to send email to other addresses including Gmail, but this is due to a reverse DNS problem I believe I've fixed. On past working Sendmail servers, I had to make sure I had a correctly configured reverse DNS PTR record setup which mapped my subdomain.domain.com to the static IPv4 address I get from my ISP. I updated this rDNS record this morning through my server's ISP and confirmed that a reverse DNS lookup run on mxtoolbox.com confirmed this record has been updated though I know it can take time for a DNS update to propogate out through the internet.

What tool can I use on my server to test/check reverse DNS? I use nslookup on my Windows computers and can google reverse DNS lookup, but my Gentoo box has no GUI and I want to know if the relaying denied error is due to DNS issues. I don't have nslookup or host commands on my Gentoo box. And emerge --search nslookup does not return anything useful.

I think what's happening is that my Sendmail server is blocking relaying from my Thunderbird mail client running on a separate host on the same LAN as the server AND Gmail is also blocking mail from my domain because until this morning I did not have reverse DNS correctly configured. My suspicion is that when the reverse DNS record is fully updated that I'll be able to send email to Gmail addresses using telnet or a local mail client like alpine running on my server. I understand that my Sendmail access db governs whether/what senders Sendmail allows to relay email. So I'm back to suspecting my sendmail configuration and concerns around my access file causing the relaying denied messages on my Thunderbird client. Is there a way I can get Sendmail to spit out/echo what it read from my access db file?

I tried adding FEATURE(`accept_unresolvable_domains') to my sendmail.mc file, then re-compiled the sendmail.mc to sendmail.cf file with # m4 sendmail.mc > sendmail.cf and restarted sendmail. I still got the same relaying denied message/behavior. (Is this how you would test this feature, Ralphred? If not, can I ask you to elaborate on how I would use this feature to troubleshoot, please?)

How do I use the output from 'grep 550 sendmail.cf' to troubleshoot? Only the third line in the output from that command that seems to match my situation, but I don't know what to do with that information. Would I try to find that particular line in the sendmail.cf file and look for comments around that line to inform my troubleshooting? Can I invoke/run sendmail from the command line to get more debugging information, and if so, how?

szatox · Advocate Joined: 27 Aug 2013 Posts: 3439

Hold on, what machine generates bounces?
I thought it was your server that refused to send mail, not the remote server that refused to accept it. PTR-related issues would suggest the latter case.

The package with DNS-related stuff you're looking for is called "bind-tools"
_________________
Make Computing Fun Again

seifn06 · Posted: Thu Jun 06, 2024 3:52 pm Post subject:

Hi szatox,
Both local and remote servers are bouncing my emails.

Sendmail running on my local server is rejecting outgoing emails sent from a Thunderbird client running on a host on the same LAN as my server for which the destination email address is not on my local network.

And Gmail is rejecting emails my server relays to Gmail addresses due to the reverse DNS issue.

I expect the second issue to be resolved as my reverse DNS record updates take effect. I'm still troubleshooting the first issue.

Thank you for the bind-tools suggestion!

grknight · Retired Dev Joined: 20 Feb 2015 Posts: 1922

While you are at it, setup OpenDKIM and publish DKIM records. The larger companies like Yahoo (and all the branded emails they host) actually require it to receive messages. Gmail highly suggests it and has been enforcing when possible. Not setting up DKIM may cause rejections at any time.

seifn06 · Posted: Thu Jun 06, 2024 6:47 pm Post subject:

Solved!

After some googling, I had to create a new text file in /etc/mail/relay-domains and list my LAN subnets (C network number) as well my domain name I'm masquerading. I'm unsure if it was necessary, but I also revised my /etc/mail/access file.

/etc/mail/relay-domains

szatox · Advocate Joined: 27 Aug 2013 Posts: 3439

Cool, great that you got it. And talking about DKIM, set SPF and DMARC records too.
In theory having either DKIM or SPF should be sufficient, but some big providers require both, and DMARK may or may not give the messages authorized by dkim and spf more credibility in the eyes of spam filters.
AFAIR gmail even has it's own sender's domain authentication method which requires you to add a TXT record provided by them to your DNS to prove that you're the owner, which is functionally a crippled, inferior version of SPF... They used to link to their relevant documentation inside bounce reports; get ready for that too.
_________________
Make Computing Fun Again