Showing posts with label Sendmail. Show all posts
Showing posts with label Sendmail. Show all posts

Monday, August 13, 2012

smtp-vs-esmtp

SkyHi @ Monday, August 13, 2012

Following trends of my previous posts Differences IPv4 Vs IPv6,Differences Routing Vs Routed protocol and Load Testing Vs Stress Testing, below is another one for differences SMTP Vs ESMTP.
SMTP
ESMTP
Stands for Simple Mail Transfer ProtocolStands for Extended Simple Mail Transfer Protocol
First command in SMTP session:
HELO techsutram.com
First command in ESMTP session:
EHLO techsutram.com
RFC 821RFC 1869
SMTP ‘MAIL FROM’ and “RCPT TO’ allows size only of 512 characters including .ESMTP ‘MAIL FROM’ and “RCPT TO’ allows size greater than 512 characters.
SMTP alone cannot be extended with new commands.ESMTP is framework that enhances capability to extend existing SMTP commands
If you are aware of any improvements to above differences or want to add to the above list then please post your comments below.


REFERENCES
http://www.techsutram.com/2010/03/smtp-vs-esmtp.html

Migrating without downtime

SkyHi @ Monday, August 13, 2012
Using DNS, you can migrate your website, email, or other internet services to different servers with minimal downtime, here's the steps: 

(To minimize the chance that you would lose inbound email for your domain, we recommend our Mail Pathfinder service. With Mail Pathfinder, our servers become your MX records and accept mail for your domain and relay it to your mail server. When the old mail server goes offline, Mail Pathfinder will queue your mail, so that change will be transparent to the rest of the world. When the new mail server is online, all you need to do is reconfigure Mail Pathfinder to point to the new IP and your queued mail will be delivered.)

72 Hours prior to the migration:
Set the TTLs of each DNS record that will be changed down to 60 seconds.

24 Hours prior to the move:
Verify that your services are functioning on the new server(s). You may have to modify your local hosts file, or use a browser plugin that will let you modify your HTTP headers in order to see your web site on the new IP prior to migration.
Query the SOA record for your domain and record it.

At migration time:
Update all appropriate DNS records to point to the new IP addresses.
Empty all local DNS caches, including your local system DNS cache and yodur network/domain's DNS cache.

5 minutes after migration:
Query the SOA record for your domain and verify the Serial Number has been updated.
Query the DNS records directly against our nameservers to confirm our nameservers are advertising the new IP addresses.
Query your local DNS to verify it has picked up the new IP addresses.
Check your services directly, either by browsing to your web site from different locations, or checking that mail is flowing, etc.

If you observe any issues with your services, you can always revert back to the old IPs (assuming the servers are still available) and with the 60 second TTLs the records will revert very quickly.

24 hours after migration:
Increase the TTLs on all changed records back to 3600 seconds.

(NOTE: These time windows above are simple recommendations. The conditions of your migration may differ and require you to perform the above steps at different intervals.)

REFERENCES
https://dnspark.zendesk.com/entries/21424146-migrating-without-downtime

Obscure Tips for Sendmail Admins

SkyHi @ Monday, August 13, 2012

Intro
Sendmail is an amazing program. The O’Reilly Sendmail book is its equal, coming in well over 1000 pages. I constantly marvel at how it was possible to pack so much knowledge into one book written by one person. Having run sendmail for over 10 years, I’ve built up a few inside tips that can be extremely hard to find out by yourself, even with the book’s help. I just learned one today, in fact, so I thought I’d put it plus some others in one place where their chances of being useful is slightly greater.
Tip 1: Multiple IPs in a Mailertable Entry, No MX Record Required
Today I learned that you can specify multiple domains in a mailertable entry even when you’re using IP addresses, as in this example:
drjohnstechblog.com       smtp:[50.17.188.196]:[10.10.10.11]
I tested it by putting 50.17.188.196 behind a firewall where it was unreachable. Sure enough, the smtp mail delivery agent of sendmail tried 10.10.10.11 next. You can continue to extend this with additional IPs
Why is this important? If someone has provided you a private IP to forward mail to, say because of a company-to-company VPN, you cannot rely on the usual DNS lookups to do the routing. And a big outfit may have two MTAs reachable in this way. Now you’ve got redundancy built-in to your delivery methods. Just as you have for organizations with multiple MX records. I paged through the book this morning and did not find it. Maybe it’s there. But it’s in an obscure spot if it is.
Tip 2: Error message Containing Punctuation
I also don’t think it’s obvious how to include multiple punctuation marks in a custom error message, even after reading the book. Here’s an example for your access table:
To:hotimail.com   ERROR:"550 You sent an email to hotimail.com.  You probably meant hotmail.com?"
So it’s the quotes that allow you to include the several punctuation marks. The 550 at the beginning will be seen as the error number.
Tip 3: Smarttable for Sender-Based Routing Decisions
Have you ever wanted to make routing decisions based on sender address rather than recipient address? Well, you can! The key is to use smarttable. In my MC file I have:
dnl Define an enhancement, smarttable, from Andrzej Filip
dnl now at http://jmaimon.com/sendmail/anfi.homeunix.net/sendmail/smarttab.html
FEATURE(`smarttable',`hash -o /etc/mail/smarttable')dnl
It’s sufficiently well documented at that page. You need his smarttable.m4 file. So this is not for beginners, but it’s not that hard, either. Although it looks like smarttable hasn’t been updated since 2002, I want to mention that it still works with the latest versions of sendmail. You can route based on the sender domain, or an individual sender address. I use it to send some messages to an encryption gateway. My smarttable entries tend to look like this:
drjohn@drjohnstechtalk.com          relay:[192.168.12.34]
What’s First: Routing Based on Sender or Recipient??
What if your recipient’s domain is in the mailertable and your sender’s address is in the smarttable? What takes precedence in that case? The mailertable entry does. I do not know a way to change that. I actually did experience that conflict and found one way around it.
In my case I had some mailertable entries like this one:
drjohnstechblog.com            relay:drjohnstechtalk.com
with my smarttable entry as above. So I get into this conflict when drjohn@drjohnstechtalk.com wants to send email to someone@drjohnstechblog.com. What I did is run a private BIND DNS server and remove the mailertable entry. My private DNS server is mostly a cache-only server with the usual Internet root servers. But since the public Internet value for the MX record for drjohnstechblog.com is not what I wanted for mail delivery purposes, I created a zone for drjohnstechblog.com on my private DNS server and created the MX record
drjohnstechblog.com            IN   MX   0 drjohnstechtalk.com.
thus overwriting the public MX value for drjohnstechblog.com. Then, of course, I have my server where I am running sendmail set to use my private DNS server as nameserver in /etc/resolv.conf, i.e.,
nameserver 127.0.0.1
since I ran my private DNS server on the same box. Without the mailertable entry sendmail uses DNS to determine how to deliver email unless of course the sender matches a smarttable entry! If my server relies on resolving other resource records within drjohnstechblog.com for other purposes then I have to redefine them, too.
This trick works for individual domains. What if you feel the need for an “everythnig else” entry in your mailertable, i.e.,
.                     relay:relayhost.drjohnstechtalk.com
Well, you’re stuck! I don’t have a solution for you. My DNS trick above could be extended to work for mail with some wildcard entries, but it will break so many other things that you don’t want to go there.
Tip 4: How to send the same email to two (or more) different servers
Someone claimed to need this unusual feature. See the discussion in the comment section about how I believe this is possible to do and an outline of how I would do it.
The blog posting I reference about running sendmail in queue-only mode is here.
Conclusion
Hopefully these sendmail tips will make your life as a sendmail admin toiling away in obscurity (not that I know anyone like that : ) ), just a little easier.

Sendmail’s Mailertable and Backup MX
When a backup MX server is setup, it’s needed to configure the destination server for the domain being backed up.
For example:
domain.tld.            172800 IN MX 10 mail.domain.tld.
domain.tld.            172800 IN MX 20 backup.domain.tld.
In our mailertable we have:
domain.tld     esmtp:[mail.domain.tld]
Simple, isn’t it? We’re using the brackets to avoid MX resolution, and hence undesirable loops because we’re in the MX records ourselves (backup.domain.tld).
But, What if the master server has two 10 MX records to load balancing? We can’t remove the brackets because of a possible loop… Sendmail has two solutions (although not very well documented).

Simulate MX Failover

Setup different servers separated with :, for example:
domain.tld     esmtp:[mail1.domain.tld]:[mail2.domain.tld]
When mail1.domain.tld fails, mail2.domain.tld is used.

Simulate DNS Round-Robin

Setup different servers separated with ,, for example:
domain.tld     esmtp:[mail1.domain.tld],[mail2.domain.tld]
The mail submittion will be balanced between the provided servers.
REFERENCES

Configuring sendmail as a backup relay

SkyHi @ Monday, August 13, 2012

The relay_based_on_MX feature is not needed. 

1) Add an entry to your mailertable file:

mydomain.com    esmtp:[ip of primary mail server]

2) Then add mydomain.com to /etc/mail/relay-domains.

Whatever you do... do NOT add mydomain.com to /etc/mail/local-host-names.

3) Rebuild the mailertable database and then restart sendmail


FWIW: There is a second option (this is what I do). Use the DSMTP mailer.

1) add mydomain.com to /etc/mail/mailertable:
mydomain.com    dsmtp:[ip of primary mail server]

2) add my domain.com to /etc/mail/relay-domains.

3) Rebuild the mailertable database and then restart sendmail
makemap hash /etc/mail/mailertable.db < /etc/mail/mailertable
m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf
kill -HUP `head -1 /var/run/sendmail.pid`

The difference is now sendmail will queue all e-mail for mydomain.com
instead of trying to deliver to the primary (which is down). Plus the normal
sendmail queue runs will be ignored for e-mails that were queued with the
DSMTP mailer. i.e. No DSN's are issued should your primary be down for an
extended amount of time.

There is an added step to using the DSMTP mailer. To release the queued
e-mail from the backup server, you will need to issue an ETRN against the
backup mailer server from the primary when its backup and running. I simply
have a cronjob do this once an hour. Example:

Using the supplied etrn.pl script supplied with the sendmail source... from
the primary:

etrn.pl backup.mydomain.com mydomain.com




http://serverfault.com

We do exactly this.
You need to make entries in two configuration files.
First, enter the domains you are going to relay for in /etc/mail/relay-domains, one per line. Include any variations.
Second, in /etc/mail/mailertable, you have to tell sendmail what to do with mail destined for that domain.
Example:
/etc/mail/relay-domains:
exampledomain.com
otherdomain.com
/etc/mail/mailertable:
exampledomain.com    relay:mailboxes.exampledomain.com
Remember to run make in /etc/mail so that the changes to mailertable take effect.
Note that if you don't put an entry in mailertable for a domain, it will consult DNS and try to send to a 'better' MX; if DNS has nothing of use, it will try to deliver the mail locally (and fail, unless you've doctored/etc/mail/local-host-names).


REFERENCES
http://www.mail-archive.com/redhat-list@redhat.com/msg116319.html
http://serverfault.com/questions/93977/configuring-sendmail-as-a-multi-domain-relay-server

Wednesday, April 18, 2012

Sendmail High Volume Mail

SkyHi @ Wednesday, April 18, 2012
# Copyright (c) 2001 Sendmail, Inc. and its suppliers.
# All rights reserved.
#
# By using this file, you agree to the terms and conditions set
# forth in the LICENSE file which can be found at the top level of
# the sendmail distribution.
#
# $Id: TUNING,v 1.16 2001/08/19 21:03:38 gshapiro Exp $
#

********************************************
** This is a DRAFT, comments are welcome! **
********************************************


If the default configuration of sendmail does not achieve the
required performance, there are several configuration options that
can be changed to accomplish higher performance.  However, before
those options are changed it is necessary to understand why the
performance is not as good as desired.  This may also involve hardware
and software (OS) configurations which are not extensively explored
in this document.  We assume that your system is not limited by
network bandwidth because optimizing for this situation is beyond
the scope of this guide.  In almost all other cases performance will
be limited by disk I/O.


This text assumes that all options which are mentioned here are
familiar to the reader, they are explained in the Sendmail Installation
and Operations Guide; doc/op/op.txt.

There are basically three different scenarios which are treated
in the following:
* Mailing Lists and Large Aliases (1-n Mailing)
* 1-1 Mass Mailing
* High Volume Mail

Depending on your requirements, these may need different options
to optimize sendmail for the particular purpose.  It is also possible
to configure sendmail to achieve good performance in all cases, but
it will not be optimal for any specific purpose.  For example, it
is non-trivival to combine low latency (fast delivery of incoming
mail) with high overall throughput.

Before we explore the different scenarios, a basic discussion about
disk I/O, delivery modes, and queue control is required.


* Disk I/O
-----------------------------------------------

In general mail will be written to disk up before a delivery attempt
is made.  This is required for reliability and should only be changed
in a few specific cases that are mentioned later on.  To achieve
better disk I/O performance the queue directories can be spread
over several disks to distribute the load.  This is some basic tuning
that should be done in all cases where the I/O speed of a single
disk is exceeded, which is true for almost every high-volume
situation except if a special disk subsystem with large (NV)RAM
buffer is used.

Depending on your OS there might be ways to speed up I/O, e.g.,
using softupdates or turning on the noatime mount option.  If this
is done make sure the filesystem is still reliable, i.e., if fsync()
returns without an error, the file has really been committed to
disk.


* Queueing Strategies and DeliveryMode
-----------------------------------------------

There are basically three delivery modes:

background: incoming mail will be immediately delivered by a new process
interactive: incoming mail will be immediately delivered by the same process
queue: incoming mail will be queued and delivered by a queue runner later on

The first offers the lowest latency without the disadvantage of the
second, which keep the connection from the sender open until the
delivery to the next hop succeeded or failed.  However, it does not
allow for a good control over the number of delivery processes other
than limiting the total number of direct children of the daemon
processes (MaxChildren) or by load control options (RefuseLA,
DelayLA).  Moreover, it can't make as good use as 'queue' mode can
for connection caching.

Interactive DeliveryMode should only be used in rare cases, e.g.,
if the delivery time to the next hop is a known quantity or if the
sender is under local control and it does not matter if it has to
wait for delivery.

Queueing up e-mail before delivery is done by a queue runner allows
the best load control but does not achieve as low latency as the
other two modes.  However, this mode is probably also best for
concurrent delivery since the number of queue runners can be specified
on a queue group basis.  Persistent queue runners (-qp) can be used
to minimize the overhead for creating processes because they just
sleep for the specified interval (which shold be short) instead of
exiting after a queue run.


* Queue Groups
-----------------------------------------------

In most situations disk I/O is a bottleneck which can be mitigated
by spreading the load over several disks.  This can easily be achieved
with different queue directories.  sendmail 8.12 introduces queue
groups which are collections of queue directories with similar
properties, i.e., number of processes to run the queues in the
group, maximum number of recipients within an e-mail (envelope),
etc.  Queue groups allow control over the behaviour of different
queues.  Depending on the setup, it is usually possible to have
several queue runners delivering mails concurrently which should
increase throughput.  The number of queue runners can be controlled
per queue group (Runner=) and overall (MaxQueueChildren).


* DNS Lookups
-----------------------------------------------

sendmail performs by default host name canonifications by using
host name lookups.  This process is meant to replace unqualified
host name with qualified host names, and CNAMEs with the non-aliased
name.  However, these lookups can take a while for large address
lists, e.g., mailing lists.  If you can assure by other means that
host names are canonical, you should use

  FEATURE(`nocanonify', `canonify_hosts')

in your .mc file.  For further information on this feature and
additional options see cf/README.  If sendmail is invoked directly
to send e-mail then either the -G option should be used or

 define(`confDIRECT_SUBMISSION_MODIFIERS', `C')

should be added to the .mc file.


* Mailing Lists and Large Aliases (1-n Mailing)
-----------------------------------------------

Before 8.12 sendmail delivers an e-mail sequentially to all its
recipients.  For mailing lists or large aliases the overall delivery
time can be substantial, especially if some of the recipients are located
at hosts that are slow to accept e-mail.  Some mailing list software
therefore "split" up e-mails into smaller pieces with fewer recipients.
sendmail 8.12 can do this itself, either across queue groups or
within a queue directory.  For the former the option SplitAcrossQueueGroups
option must be set, the latter is controlled by the 'r=' field of
a queue group declaration.

Let's assume a simple example: a mailing lists where most of
the recipients are at three domains: the local one (local.domain)
and two remotes (one.domain, two.domain) and the rest is splittered
over several other domains.  For this case it is useful to specify
three queue groups:

QUEUE_GROUP(`local', `P=/var/spool/mqueue/local, F=f, R=2, I=1m')dnl
QUEUE_GROUP(`one', `P=/var/spool/mqueue/one, F=f, r=50, R=3')dnl
QUEUE_GROUP(`two', `P=/var/spool/mqueue/two, F=f, r=30, R=4')dnl
QUEUE_GROUP(`remote', `P=/var/spool/mqueue/remote, F=f, r=5, R=8, I=2m')dnl
define(`ESMTP_MAILER_QGRP', `remote')dnl
define(`confSPLIT_ACROSS_QUEUEGROUPS', `True')dnl
define(`confDELIVERY_MODE', `q')dnl
define(`confMAX_QUEUE_CHILDREN', `50')dnl
define(`confMIN_QUEUE_AGE', `27m')dnl

and specify the queuegroup ruleset as follows:

LOCAL_RULESETS
Squeuegroup
R$* @ local.domain $# local
R$* @ $* one.domain $# one
R$* @ $* two.domain $# two
R$* @ $*  $# remote
R$*   $# mqueue

Now it is necessary to control the number of queue runners, which
is done by MaxQueueChildren.  Starting the daemon with the option
-q5m assures that the first delivery attempt for each e-mail is
done within 5 minutes, however, there are also individual queue
intervals for the queue groups as specified above.  MinQueueAge
is set to 27 minutes to avoid that entries are run too often.

Notice: if envelope splitting happens due to alias expansion, and
DeliveryMode is not 'i'nteractive, then only one envelope is sent
immediately.  The rest (after splitting) are queued up and queue
runners must come along and take care of them.  Hence it is essential
that the queue interval is very short.


* 1-1 Mass Mailing
-----------------------------------------------

In this case some program generates e-mails which are sent to
individual recipients (or at most very few per e-mail).  A simple
way to achieve high throughput is to set the delivery mode to
'interactive', turn off the SuperSafe option and make sure that the
program that generates the mails can deal with mail losses if the
server loses power.  In no other case should SuperSafe be set to
'false'.  If these conditions are met, sendmail does not need to
commit mails to disk but can buffer them in memory which will greatly
enhance performance, especially compared to normal disk subsystems, e.g.,
non solid-state disks.


* High Volume Mail
-----------------------------------------------

For high volume mail it is necessary to be able to control the load
on the system.  Therefore the 'queue' delivery mode should be used,
and all options related to number of processes and the load should
be set to reasonable values.  It is important not to accept mail
faster than it can be delivered otherwise the system will be
overwhelmed.  Hence RefuseLA should be lower than QueueLA, the number
of daemon children should probably be lower than the number of queue
runnners (MaxChildren vs. MaxQueueChildren).  DelayLA is a new option
in 8.12 which allows delaying connections instead of rejecting them.
This may result in a smoother load distribution depending on how
the mails are submitted to sendmail.


* Miscellaneous
-----------------------------------------------

Other options that are interesting to tweak performance are
(in no particular order):

SuperSafe: if interactive DeliveryMode is used, then this can
be set to the new value "interactive" in 8.12 to save some disk
synchronizations which are not really necessary in that mode.


REFERENCES

/etc/sysconfig/sendmail

SkyHi @ Wednesday, April 18, 2012
Next up is /etc/sysconfig/sendmail. This file is used to assign some simple variables for the sendmail initialization script. By default it contains the following information:
DAEMON=yes
    QUEUE=1h
    
Quite simply this information is passed to the sendmail initscripts telling sendmail to run as a daemon and that it should process its queue once an hour. Depending on your environment you may need to change these values. If you're running a 24x7 net host, you should know that the SMTP RFCs specify a minimum queue time of 5 minutes so a queue run frequency of one minute would violate the RFC specifications.

Change the Queue Runner Interval in Sendmail
The default in CentOS 5.x is 1 hour:
# pgrep -lf "Queue runner"
12443 sendmail: Queue runner@01:00:00 for /var/spool/clientmqueue
You can change it editing /etc/sysconfig/sendmail (ie. set 30 minutes):
DAEMON=yes
QUEUE=30m
It’s easy, isn’t it? Useful for mail backup MXs that may need shorter queue run times.


REFERENCES
http://www.redhat.com/support/resources/howto/RH-sendmail-HOWTO/x95.html
http://www.redhat.com/support/resources/faqs/RH-sendmail-FAQ/x190.html
http://www.cyberciti.biz/tips/force-sendmail-to-deliver-a-message-in-sendmails-mail-queue.html

Friday, March 9, 2012

Configure Xinetd

SkyHi @ Friday, March 09, 2012

Step 3:  Configure Xinetd

Since the POP3 server runs from xinetd, you will need to make some configuration changes and then restart/start xinetd. First, we will need to edit the pop3sconfiguration file:
[root@zip root]# cd /etc/xinetd.d
[root@zip xinetd.d]# ls -l *pop3*
-rw-r--r--    1 root     root          359 Jan 25  2003 ipop3
-rw-r--r--    1 root     root          335 Jan 25  2003 pop3s

[root@zip xinetd.d]# vi pop3s
Edit the /etc/xinetd.d/pop3s config file until it looks like this:
# default: off
# description: The POP3S service allows remote users to access their mail \
#              using an POP3 client with SSL support such as fetchmail.
service pop3s
{
        socket_type             = stream
        wait                    = no
        user                    = root
        server                  = /usr/sbin/ipop3d
        log_on_success  += HOST DURATION
        log_on_failure  += HOST
        instances               = 150
        cps                     = 70 30
        disable                 = no
}
The extra settings for "instances" and "cps" are performance limits. I raised them from the defaults, but these can be tweaked as you see fit. See man xinetd.conf for details. Defaults are located in the /etc/xinetd.conf config file.
Now start (or restart) xinetd:
[root@zip xinetd.d]# /etc/init.d/xinetd restart
Stopping xinetd:                                           [FAILED]
Starting xinetd:                                           [  OK  ]



REFERENCES

Wednesday, February 1, 2012

Redundant Servers and Load Balancing using MX Records

SkyHi @ Wednesday, February 01, 2012
The normal mail delivery process looks up DNS Mail Exchange (MX) records to determine the destination host. A MX record tells the sending system where to deliver mail for a certain domain. It is also possible to have several MX records for a single domain, they can have different priorities. For example, our MX record looks like that:

Code:
> dig -t mx proxmox.com

;; ANSWER SECTION:
proxmox.com.            22879   IN      MX      10 mail.proxmox.com.

;; ADDITIONAL SECTION:
mail.proxmox.com.       22879   IN      A       213.129.239.114
Please notice that there is one single MX record for the Domain proxmox.com, pointing to mail.proxmox.com. The 'dig' command automatically puts out the corresponding address record if it exists. In our case it points to "213.129.239.114". The priority of our MX record is set to 10 (preferred default value).

Hot Standby with backup MX Records

Many people do not want to install two redundant mail proxies, instead they use the mail proxy of their ISP as fallback. This is simply done by adding an additional MX Record with a lower priority (higher number). With the example above this looks like that:

Code:
proxmox.com.            22879   IN      MX      100 mail.provider.tld.
Sure, your provider must accept mails for your domain and forward received mails to you.

You will never lose mails with such a setup, because the sending Mail Transport Agent (MTA) will simply deliver the mail to the backup server (mail.provider.tld) if the primary server (mail.proxmox.com) is not available.

Load Balancing wit MX Records

Using your ISPs mail server is not always a good idea, because many ISPs do not use advanced spam prevention techniques like greylisting. It is often better to run a second server yourself to avoid lower spam detection rates.

Anyways, it's quite simple to set up a high performance load balanced mail cluster using MX records. You just need to define two MX records with the same priority. I will explain this using a complete example to make it clearer.

First, you need to have 2 working proxmox mail gateways (mail1.example.com and mail2.example.com), each having its own IP address (the rest of the setting should be more or less equal, i.e. you can use backup/restore to copy the rules). Let us assume the following addresses (DNS address records):

Code:
mail1.example.com.       22879   IN      A       1.2.3.4
mail2.example.com.       22879   IN      A       1.2.3.5
Btw, it is always a good idea to add reverse lookup entries (PTR records) for those hosts. Many email systems nowadays reject mails from hosts without valid PTR records. Then you need to define your MX records:

Code:
example.com.            22879   IN      MX      10 mail1.example.com.
example.com.            22879   IN      MX      10 mail2.example.com.
This is all you need. You will receive mails on both hosts, more or less load balanced. If one host fails the other is used.

Other ways

Multiple Address Records: Using several DNS MX record is sometime clumsy if you have many domains. It is also possible to use one MX record per domain, but multiple address records:

Code:
example.com.            22879   IN      MX      10 mail.example.com.
mail.example.com.       22879   IN      A       1.2.3.4
mail.example.com.       22879   IN      A       1.2.3.5
Using Firewall features: Many firewalls can do some kind of RR-Scheduling when using DNAT. See your firewall manual for more details.




REFERENCES
http://forum.proxmox.com/threads/73-Redundant-Servers-and-Load-Balancing-using-MX-Records

Monday, January 9, 2012

redeliver or resend all mails in queue

SkyHi @ Monday, January 09, 2012

How to force Sendmail to redeliver or resend all mails in queue ?

Here is the command
**You must be root to execute this command.
sendmail -q -v

Postfix queue tools

 

Here are a few handy items for Postfix email server users:
1. If your system is acting as a spam / antivirus / relay server for secondary internal servers, and your destination mail server is down, postfix will queue your messages to resend at a later time. In order for postfix to instantly re-queue these messages you use:


postqueue -f
2. The mailq equivilant specific to postfix is


postqueue -p
3. If you want to delete specific messages in your queue, use an ncurses based open source software called pfqueue. It will give you a menu that shows mail currently queued, and allows you to delete specific emails.


REFERENCES

http://tech.ebugg-i.com/2009/02/how-to-force-sendmail-to-redeliver-or.html 
http://systembash.com/content/postfix-queue-tools/

Tuesday, December 6, 2011

Error opening or locking INBOX user

SkyHi @ Tuesday, December 06, 2011

iPhone and POP3 Accounts


iphone4As providers of email facilities to business, Toucan Internet LLP is called upon to offer additional support for the many mobile devices that hang on the end of our services. Most of these have their own little foibles that, if you’re unaware of, can cost hours of lost time, raise your blood pressure to dangerous levels and leave you wondering why you ever upgraded in the first place. Don’t worry you’re not alone.
Some clients have issues connecting the iPhone to POP3 accounts, not because of the product itself, but rather the lack of configuration advice available to users. Having helped clients recently, this basic information may well be helpful to many.
If you have another device such as a main PC that is also collecting your email, then there can be clashes as the POP3 protocol that handles your mail can only service one device at one time, therefore if one is connected and the other one polls the mail box it will return an error as it cannot get access.
These are typical log errors that show the issue and your sysadmin people will be able to spot this:
May 19 12:54:35 toucan ipop3d[32387]: Login user=mrmail host=[212.183.140.122] nmsgs=10/10
May 19 12:58:56 toucan ipop3d[725]: Error opening or locking INBOX user=mrmail host=yourco.co.uk [83.104.167.229]
Here we see the iPhone log in at 12:54:35 from IP address 212.183.140.122 and before that mail session has closed the office PC log has attempted a connection to the same account from 83.104.167.229. The office pc would report a connection error.
To avoid this being a continual issue one solution would be to only have the office PC collecting when you are there. There are countless other ways email accounts can be configured that we’ll not debate them all here, but rather flag up this iPhone/Mobile device and POP3 issue.
Particularly with the iPhone and the above configuration with an office PC on the same account it is important to set the iPhone push facility to “off”. From our experience if this is set to “on” the iPhone doesn’t close the session after polling the POP3 account therefore locking the mail box from access by other devices, such as the office PC.
Specific to Toucan Internet LLP POP3 accounts in the advanced settings set “SSL” to off. The SMTP authentication should be set to “password”.
Hi Simon
Thank you for your help and assistance with the iPhone4 queries, you have achieved in 5 minutes what Vodafone have taken over 2 hours to not resolve! I have discussed with them just now about Outlook needing to be closed to get emails on the iPhone and they have advised altering the Outlook settings to ‘keep the mail on the server’ which I have done and it appears to be working OK but goodness knows what else it will put out of sync!
 

REFERENCES
http://blog.toucan-group.com/2011/05/19/iphone-and-pop3-accounts/

Thursday, August 11, 2011

sendmail use of clientmqueue and mqueue folders

SkyHi @ Thursday, August 11, 2011
The flag for flushing the queue is -q (issue sendmail -q). However, I presume you are having sendmail run as a daemon, therefore, you would want to start it as sendmail -bd -q5m. If RH8.0 is configured as RH7.3, the startup flags are in /etc/sysconfig/sendmail and should look as follows:

DAEMON=yes
QUEUE=5h

The script in /etc/init.d (sendmail) will read this file for the options.

-db starts sendmail as a daemon, -q5m says flush every five minutes. Note that most mail is sent and forwarded immediately, flushing is needed only if for some reason the route to intended recipient (and intended mail exchangers) is down (most usually for me, my own internet connection), or if you are acting as a MX for another mail server. In those cases, mailed is spooled in /var/spool/mqueue until it either timesout (usually about 5 days, depending on setup) or can be sent on.


=======================================================================

When submitting mail by using sendmail as a mail submission program, sendmail copies all messages to "/var/spool/clientmqueue" first. Sendmail is a setgid smmsp program and thus gives any user the permission to do so (/var/spool/clientmqueue belongs to user and group smmsp). Later, another sendmail process, the sendmail mail transfer agent (MTA) copies the messages from /var/spool/clientmqueue to /var/spool/mqueue and sends them to their destination.

/var/spool/clientmqueue is thus the holding area used by the MSP (Mail Submission Protocol) sendmail instance before it injects the messages into the main MTA (Mail Transport Agent) sendmail instance.

Sendmail will save the message in /var/spool/clientmqueue for safe keeping before trying to connect to the MTA to get the message delivered. Normally there would be a 'queue runner' MSP sendmail instance which every half hour would retry sending any message that couldn't be sent immediately. Each message will generate a 'df' (message routing info) and 'qf' (message headers and body) file. You can list out all of the messages and their status by:
# mailq -v -Ac

When files accumulate in /var/spool/clientmqueue, this is probably due to sendmail localhost MTA not running, and thus the mails don't get send.

=======================================================================
 The E-mail Message's Way from Client to Client


 After you have sent the e-mail message to the SMTP server that communicates with your computer the message still has a long way to travel before it reaches your recipient's computer. The moment after the e-mail message has been successfully transferred to your SMTP server; the server must find your recipient's mail server and transfer the message to that server. To locate the server that the recipient uses, the recipient's e-mail address will be examined and the domain name extracted by reading the information after the "@" character (the domain name is always found after the "@" character in the e-mail address). By using this domain name and then checking with a Domain Name Server (DNS), the location (the IP number) of this server will be found. After that, a communication line will be established between your mail server and your recipient's mail server.

The communication between these two mail servers are basically the same as the communication between your computer and your SMTP server. The SMTP protocol is used and the port number 25 (at your recipient's mail server) is used. The commands used are normally also the same and the e-mail message is transferred in similar way as when it was transferred from your computer to your SMTP server.

However, sometimes there can be technical problems at the recipient's server and the e-mail message can not be transferred. To handle such a situation the message goes into a queue. The SMTP server on most machines uses a program called sendmail to do the actual sending, so this queue is called the sendmail queue. Sendmail will periodically try to resend the messages in its queue. For example, it might retry every 15 minutes. After 4 hours, it will usually send you a piece of mail that tells you there is some sort of problem. After 5 days, most sendmail configurations give up and return the mail to you undelivered.
 
If the message have been successfully transferred to your recipient's mail server, it will then be stored in his/her POP3 server and when the recipient start downloading his/her e-mails, your e-mail message will appear in the inbox of the recipient's e-mail client program.


=======================================================================

# service sendmail stop
# cd /var/spool/mqueue
# for ML in `grep 
-l "misspelled_address\@gmail.com" *`; do sed -i -e 
's/misspelled_address\@gmail.com/postmaster\@localhost/g' $ML; done
# service sendmail start
# sendmail -q -v 



REFERENCES

http://emailitis.com/support/faqs/email-faqs/76-what-is-greylisting-spam
 http://www.samlogic.net/articles/smtp.htm
http://arstechnica.com/civis/viewtopic.php?f=16&t=1111517

Wednesday, August 10, 2011

Change the Queue Runner Interval in Sendmail

SkyHi @ Wednesday, August 10, 2011
The default in CentOS 5.x is 1 hour:
# pgrep -lf "Queue runner"
12443 sendmail: Queue runner@01:00:00 for /var/spool/clientmqueue
 
You can change it editing /etc/sysconfig/sendmail (ie. set 30 minutes):
DAEMON=yes
QUEUE=30m
 
It’s easy, isn’t it? Useful for mail backup MXs that may need shorter queue run times.

REFERENCES
http://rambleon.usebox.net/post/317857580/change-the-queue-runner-interval-in-sendmail

Thursday, July 7, 2011

How to change source SMTP IP address in sendmail

SkyHi @ Thursday, July 07, 2011

How to change source SMTP IP address in sendmail


Follow the steps below, if you want to change the source SMTP ip address in sendmail.
1) change the line below in sendmail.cf
#O ClientPortOptions=Family=inet, Address=x.x.x.x
to
O ClientPortOptions=Family=inet, Address=
3) restart sendmail
Send a test mail and check its header. The source IP address should have changed


REFERENCES
http://mohammednv.wordpress.com/2008/04/24/how-to-change-source-smtp-ip-address-in-sendmail/

Thursday, June 2, 2011

HOWTO: Configure linux sendmail to use external ISP as SMTP mail relay

SkyHi @ Thursday, June 02, 2011
Many server based applications on linux need to send email from the localhost. Unfortunately "out-of-the-box", linux sendmail doesn't work as expected.  Additionally, if you are hosting a server on an in-house machine and use a dynamically assigned IP address e.g. a Joomla website using dynDNS.org, but you use an external ISP to handle email, you need to setup sendmail on your local machine so that it will relay email through your ISP. My example here is for a server that is hosted locally but email is handled by an ISP, namely Network Solutions. This article describes the basic steps you need to carry out to get sendmail working so that applications on your localhost can send email.

To setup sendmail on redhat, centos or fedora so that mail can be dispatched using local smtp that relays through your ISP (e.g. PHP mail() function for Joomla, Trac, sugarCRM etc)  you need to perform the following steps.

Step 1 - Install all the packages that you are going to need

Use yum to install all the packages that you are going to need. If they are already installed yum will tell you so, if they are not already installed, then yum will install them for you.
# yum install sendmail sendmail-devel sendmail-cf  bind bind-chroot 

NOTE: omit the Step3 for non-SMTP auth ISP(telus,shaw) on same network

Step 2 - Setup sendmail client-side SMTP AUTH

sendmail client-side SMTP AUTH allows us to authenticate in order to relay all outgoing mail to our ISP's SMTP mail server and have them send the mail on our behalf via SMART_HOST. Note that you can have SMART_HOST work just fine without SMTP AUTH if your ISP's SMTP server doesnt require authentication.

Now edit /etc/mail/sendmail.mc to contain the following. I have removed all lines that are commented out to make this more human readable.
divert(-1)dnl
include(`/usr/share/sendmail-cf/m4/cf.m4')dnl
VERSIONID(`setup for linux')dnl
OSTYPE(`linux')dnl
define(`SMART_HOST', `smtp.katriatechnology.com.netsolmail.net')dnl
define(`confDEF_USER_ID', ``8:12'')dnl
define(`confTO_CONNECT', `1m')dnl
define(`confTRY_NULL_MX_LIST', `True')dnl
define(`confDONT_PROBE_INTERFACES', `True')dnl
define(`PROCMAIL_MAILER_PATH', `/usr/bin/procmail')dnl
define(`ALIAS_FILE', `/etc/aliases')dnl
define(`STATUS_FILE', `/var/log/mail/statistics')dnl
define(`UUCP_MAILER_MAX', `2000000')dnl
define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl
define(`confAUTH_OPTIONS', `A')dnl
define(`confTO_IDENT', `0')dnl
FEATURE(`authinfo',`hash -o /etc/mail/authinfo.db')dnl
FEATURE(`no_default_msa', `dnl')dnl
FEATURE(`smrsh', `/usr/sbin/smrsh')dnl
FEATURE(`mailertable', `hash -o /etc/mail/mailertable.db')dnl
FEATURE(`virtusertable', `hash -o /etc/mail/virtusertable.db')dnl
FEATURE(redirect)dnl
FEATURE(always_add_domain)dnl
FEATURE(use_cw_file)dnl
FEATURE(use_ct_file)dnl
FEATURE(local_procmail, `', `procmail -t -Y -a $h -d $u')dnl
FEATURE(`access_db', `hash -T -o /etc/mail/access.db')dnl  
FEATURE(`blacklist_recipients')dnl 
EXPOSED_USER(`root')dnl  
FEATURE(`accept_unresolvable_domains')dnl  
FEATURE(`relay_based_on_MX')dnl  
LOCAL_DOMAIN(`localhost.localdomain')dnl  
MASQUERADE_AS(`katriatechnology.com')dnl  
FEATURE(masquerade_envelope)dnl  
FEATURE(masquerade_entire_domain)dnl  
MASQUERADE_DOMAIN(`katriatechnology.com')dnl  
MAILER(smtp)dnl  
MAILER(procmail)dnl

Step 3 -  Setup the authinfo file

Now edit /etc/mail/authinfo to contain the following.
AuthInfo:katriatechnology.com "U:user @ katriatechnology.com" "P:password" "M:PLAIN"AuthInfo: "U:user @ katriatechnology.com" "P:password" "M:PLAIN"
# chmod 660 /etc/mail/authinfo
# makemap hash /etc/mail/authinfo < /etc/mail/authinfo

Step 4 - Setup the access file

Now edit the /etc/mail/access file so that it contains the following.
# by default we allow relaying from localhost...
Connect:localhost.localdomain       RELAY
Connect:localhost                            RELAY 
Connect:127.0.0.1                           RELAY
# chmod 660 /etc/mail/access
# makemap hash /etc/mail/access < /etc/mail/access

Step 5 - Now you need to install bind to get sendmail to work

For some reason sendmail does not use /etc/hosts for local name resolution, so it always fails (and is unbearably slow on system boot as it cannot find localhost.localdomain). To solve this problem you need to run bind on your local machine.

Now edit the /etc/named.conf file so that it contains the following.
options {
       listen-on port 53 { 127.0.0.1 };
};
As we are using bind-chroot we need to copy the named.conf to where it expects t to be.
# cp -f /etc/named.conf /var/named/chroot/etc/
Now edit /etc/resolv.conf so that it contains the following. Change 192.168.2.50 to be the IP address of your primary DNS
nameserver 127.0.0.1
nameserver 192.168.2.50
domain localdomain

Step 6 - Start the required services

# chkconfig named on
# chkconfig saslauthd on
# chkconfig sendmail on
# service named restart
# service saslauthd restart
# service sendmail restart

Test that it works

To check that sendmail is working properly, login to your server and fire up a terminal window.
# mailq
The mailq command will display a list of messages that are held in the outgoing mail queue. It should be empty. Now send an email, and then check the mail queue using mailq.

You can also get better diagnostic information by manually sending a message like this:
# sendmail -Am -t -v 
to:user @ domain.com
from:user @ domain.com
.
 
REFERENCES
http://www.recital.com/index.php?option=com_content&view=article&id=71%3Ahowto-configure-linux-sendmail-to-use-external-isp-as-smtp-mail-relay&Itemid=59

Wednesday, May 11, 2011

Log All Email for Sendmail in CentOS 5

SkyHi @ Wednesday, May 11, 2011
Do you ever wanted to copy each and every incoming and outgoing email in Sendmail automatically to a single email acccount transparently? Thanks to Axel Reinhold’s logall.c module. Now, we can do it. In the below HOWTO, we will configure Sendmail to copy each and every incoming and outgoing email to an email account called “logall”.
Requirement: Sendmail, logall.c and CentOS 5

1. Please make sure the following are installed: -
cpp-4.1.1-52.el5.i386.rpm
elfutils-0.125-3.el5.i386.rpm
elfutils-libs-0.125-3.el5.i386.rpm
gcc-4.1.1-52.el5.i386.rpm
libgomp-4.1.1-52.el5.i386.rpm
rpm-build-4.4.2-37.el5.i386.rpm


2. Download the sendmail source rpm using the link below: -
http://mirrors.kernel.org/centos/5/os/SRPMS/sendmail-8.13.8-2.el5.src.rpm

3. Go to “Subject: Q4.20 — How can I automatically copy messages based on sender or recipient addresses?” in Sendmail.org website using the link below: -
http://www.sendmail.org/faq/section4.html#4.20

4. Download the Axel Reinhold’s logall.c module using the link below: -
http://www.freakout.de/logall.c

5. Install the sendmail source rpm using the command below: -
rpm -ivh sendmail-8.13.8-2.el5.src.rpm

6. Extract the sendmail source file using the command below: -
tar xvfz /usr/src/redhat/SOURCES/sendmail.8.13.8.tar.gz -C /tmp

7. Add the following line into this file /tmp/sendmail-8.13.8/sendmail/conf.c at line 1312 as below: -
#include "/tmp/logall.c"

8. Below is the partial content of /tmp/sendmail-8.13.8/sendmail/conf.c file: -
if (tTd(49, 1))
sm_dprintf("checkcompat(to=%s, from=%s)\n",
to->q_paddr, e->e_from.q_paddr);
#include "/tmp/logall.c"


9. Save the file and create a new sendmail archive using the command below: -
cd /tmp
tar cvfz sendmail.8.13.8.tar.gz sendmail-8.13.8


10. Backup the original sendmail archive using the following command below: -
cd /usr/src/redhat/SOURCES
mv sendmail.8.13.8.tar.gz /tmp/sendmail.8.13.8.tar.gz-ori

11. Copy the new sendmail archive into the installed source sendmail rpm using the following command below: -
cp sendmail.8.13.8.tar.gz /usr/src/redhat/SOURCES

12. Let’s build the sendmail binary package only from the spec file using the command below: -
cd /usr/src/redhat/SPECS/
rpmbuild -bb sendmail.spec


13. Let’s install the new sendmail binary package using the following command below: -
cd /usr/src/redhat/RPMS/i386
rpm --force -Uvh sendmail-8.13.8-2%{dist}.i386.rpm sendmail-cf-8.13.8-2%{dist}.i386.rpm


14. Edit the sendmail config file /etc/mail/sendmail.cf and add the following line below before this line “# level 10 config file format”: -
# logall.c
D{LogAll}/var/spool/mail/logall


15. Below is the partial content of /etc/mail/sendmail.cf file: -
# logall.c
D{LogAll}/var/spool/mail/logall

# level 10 config file format
V10/Berkeley


16. Restart the sendmail service using the following command below: -
service sendmail restart

17. Create the email accout called “logall” using the following command below: -
useradd logall
passwd logall
touch /var/spool/mail/logall
chown logall:logall /var/spool/mail/logall


18. Let’s send an email to a user using the following command below: -
echo "Test" | mail -s "TEST" wlsiew

19. Let’s check the content of the file /var/spool/mail/logall using the following command below: -
cat /var/spool/mail/logall

20. Below is the content of /var/spool/mail/logall file: -
From root Wed Sep 12 20:37:13 2007
Return-Path:
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
by localhost.localdomain (8.13.8/8.13.8) with ESMTP id l8CDbDAV008813
for ; Wed, 12 Sep 2007 20:37:13 +0800
Full-Name: root
Received: (from root@localhost)
by localhost.localdomain (8.13.8/8.13.8/Submit) id l8CDbDR2008812
for wlsiew; Wed, 12 Sep 2007 20:37:13 +0800
Date: Wed, 12 Sep 2007 20:37:13 +0800
From: root
Message-Id: <200709121337.l8CDbDR2008812@localhost.localdomain>
To: wlsiew@localhost.localdomain
Subject: TEST
X-Logged: Logged by localhost.localdomain as l8CDbDAV008813 at Wed Sep 12 20:37:13 2007



REFERENCES
http://wingloon.com/2007/09/12/log-all-email-for-sendmail-in-centos-5/
http://serverfault.com/questions/131730/configure-sendmail-to-clone-all-outgoing-email