Sendmail, DNS, MX records configuration
James Szabadics
I have installed sendmail 8.11 on SCo 5.0.5. This system is a gateway
and is intended to relay mail only for our ourdomain.com to and from
our exchange 5.5 server. It has two interfaces - on on an internal
network and one connected to a router connected to ISP.
I can send from the exchange server to outside addresses. It relays
to the internal 10.x.x.x address on the gateway and sendmail on the
gateway uses the nameserver on our ISP to resolve and establish smtp
transfer. Outgoing mail works.
The ISP has an MX record for ourdomain.com to go to our gateway server
mail.ourdomain.com on 203.x.x.x and I want such messages to be relayed
by our gateway to exchange server on the 10.x.x.x network. I have the
exchange box in the /etc/hosts file with alias ourdomin.com and
mail.ourdomin.com but the gateway sendmail seems to not care about the
entries in /etc/hosts it seems to only refer to the ISP nameserver
which sends it back to the gateway based on the MX record there.
If I log in as root on the gateway and type
/usr/lib/sendmail -v user...@ourdomain.com < /dev/null
instead of saying helo to the exchange server it says helo to itself.
I think I need a local MX record for ourdomain.com. I looked around
on Tonys FAQ and think I just need to add two lines for MX records to
an appropriate area possibly named.conf??? Is this correct I am
really not sure as I am a complete newbie to MX records and DNS.
ourdomain.com. IN MX 10 mx.ourdomain.com.
mx.ourdomain.com. IN A 10.x.x.x
where x.x.x are valid numbers for the exchange server
Thanks in advance
James
John Schmidt
On 15 Nov 2002, James Szabadics wrote:
> I think I need a local MX record for ourdomain.com. I looked around
> on Tonys FAQ and think I just need to add two lines for MX records to
> an appropriate area possibly named.conf??? Is this correct I am
> really not sure as I am a complete newbie to MX records and DNS.
>
> ourdomain.com. IN MX 10 mx.ourdomain.com.
> mx.ourdomain.com. IN A 10.x.x.x
>
> where x.x.x are valid numbers for the exchange server
This will only work if you're running your a seperate DNS view the
rest of the world can't see - i.e. a DNS server limited so that only
your internal masqueraded 10.*.*.* hosts can see it. Please don't
propogate any DNS info containing dummy IP information to the
rest of the world. If you're comfortable running DNS servers, this
wouldn't be that big a deal to implement.
However, it would probably be easier to set this up in sendmail
itself. Three possible solutions:
1) Have the gateway box set up to accept *local* delivery for all
mail addressed to your domain, then set up aliases on the gateway
box for each user pointing to their account on the exchange
server. This would be technically the easiest to implement,
but could be a maintainence nightmare depending on the number
of accounts needed to be set up.
2) Use the "virtusertable" feature in sendmail. This would probably
require a rebuild from source of your sendmail.cf file. This has
the same basic weakness as the alias method, but does give a bit
more fine-grained control.
3) Use the "mailertable" feature in sendmail. This would almost
certainly require the above mentioned rebuild of sendmail.cf, but
would allow you to build a rule stating 'all mail with a
recipient address in domain.com gets delivered to server.domain.com
regardless of MX refcord information.'
For the sendmail methods, the documentation bundled with the sendmail
source gives specifics for all three methods. The sendmail.org
website also has an awful lot of good information.
JS
Bill Vermillion
>> I think I need a local MX record for ourdomain.com. I looked around
>> on Tonys FAQ and think I just need to add two lines for MX records to
>> an appropriate area possibly named.conf??? Is this correct I am
>> really not sure as I am a complete newbie to MX records and DNS.
>> ourdomain.com. IN MX 10 mx.ourdomain.com.
>> mx.ourdomain.com. IN A 10.x.x.x
>> where x.x.x are valid numbers for the exchange server
>This will only work if you're running your a seperate DNS view the
>rest of the world can't see - i.e. a DNS server limited so that only
>your internal masqueraded 10.*.*.* hosts can see it. Please don't
>propogate any DNS info containing dummy IP information to the
>rest of the world. If you're comfortable running DNS servers, this
>wouldn't be that big a deal to implement.
>However, it would probably be easier to set this up in sendmail
>itself. Three possible solutions:
[deletia]
>2) Use the "virtusertable" feature in sendmail. This would probably
> require a rebuild from source of your sendmail.cf file. This has
********************* see note
> the same basic weakness as the alias method, but does give a bit
> more fine-grained control.
>
>3) Use the "mailertable" feature in sendmail. This would almost
> certainly require the above mentioned rebuild of sendmail.cf, but
****** see note
> would allow you to build a rule stating 'all mail with a
> recipient address in domain.com gets delivered to server.domain.com
> regardless of MX refcord information.'
>For the sendmail methods, the documentation bundled with the sendmail
>source gives specifics for all three methods. The sendmail.org
>website also has an awful lot of good information.
You might not have to rebuild sendmail depending on how it was
built the first time. Look at the existing sendmail.cf and
see if in the top lines there is a reference to mailertable
and virtusertable. If there then there is no need for rebuilding
the sendmail.cf.
I don't think I've ever seen a sendmail without the mailer table
entry in the past 15 years. That was what you needed to get email
transfered with uucp - which was pretty much the standard then.
Bill
--
Bill Vermillion - bv @ wjv . com
James Szabadics
Where you say
> This will only work if you're running your a seperate DNS view the
> rest of the world can't see - i.e. a DNS server limited so that only
> your internal masqueraded 10.*.*.* hosts can see it.
Does a DNS server propagate by default to the rest of the net? I
thought this feature would require specific configuration in some kind
of DNS heirachy? I havent configured it for propagation - will it
auto propogate if I experiment with MX records?
> 3) Use the "mailertable" feature in sendmail. This would almost
> certainly require the above mentioned rebuild of sendmail.cf, but
> would allow you to build a rule stating 'all mail with a
> recipient address in domain.com gets delivered to server.domain.com
> regardless of MX refcord information.'
>
> For the sendmail methods, the documentation bundled with the sendmail
> source gives specifics for all three methods. The sendmail.org
> website also has an awful lot of good information.
>
> JS
Mailertable sounds most promising - Thanks. I had another thought
passed my way by a friend that I will try on Monday when back in the
office - If I stopped running named on the gateway would sendmail
refer to the /etc/hosts file? Nobody uses the DNS on this gateway
server - I just use the ISP nameserver for DNS. The ISP nameserver is
listed as the nameserver entry in resolv.conf. I have no need for DNS
internally (yet) due to limited number of hosts.
Can it be said that sendmail does not care about entries in the
/etc/hosts file?
What is the heirachy for sendmail to resolve a destination for a mail?
John Schmidt
On 16 Nov 2002, James Szabadics wrote:
> Thanks for the reply,
>
> Where you say
>
> > This will only work if you're running your a seperate DNS view the
> > rest of the world can't see - i.e. a DNS server limited so that only
> > your internal masqueraded 10.*.*.* hosts can see it.
>
> Does a DNS server propagate by default to the rest of the net? I
> thought this feature would require specific configuration in some kind
> of DNS heirachy? I havent configured it for propagation - will it
> auto propogate if I experiment with MX records?
No danger there at all, as long as the box isn't listed by a
registrar (or delegated by a listed machine) as authoritative
for either your domain or IP address space. DNS doesn't (generally)
broadcast information, but rather DNS servers are queried.
> Mailertable sounds most promising - Thanks. I had another thought
> passed my way by a friend that I will try on Monday when back in the
> office - If I stopped running named on the gateway would sendmail
> refer to the /etc/hosts file?
It depends on what is in the machine's /etc/resolv.conf file.
Runnning named on a machine doesn't make that same machine use
itself for queries, it's all based on what is in resolv.conf.
> Can it be said that sendmail does not care about entries in the
> /etc/hosts file?
It depends on the resolver library functionality of your OS, as
well as machine specific configuration. Sendmail will look at
/etc/hosts under specific circumstances.
> What is the heirachy for sendmail to resolve a destination for a mail?
In its default configuration, sendmail will first try a DNS lookup
for an MX record associated with the recipient's domain. If there's
no MX record, it will then try to deliver to an A record for the
recipient's domain.
JS
John Schmidt
On Sat, 16 Nov 2002, Bill Vermillion wrote:
> I don't think I've ever seen a sendmail without the mailer table
> entry in the past 15 years. That was what you needed to get email
> transfered with uucp - which was pretty much the standard then.
It all depends on the site. None of the 90 odd machines I run
sendmail on have mailertable support, and I don't believe it's
included by default in any of the OS specific .mc files bundled
with current versions of the sendmail source.
Vendor supplied sendmail installations may be a different story,
but I'd never even *consider* running sendmail I didn't build and
configure myself.
JS
Bill Vermillion
You did see my paragraph that you didn't quote to see if the
mailertable was listed in the .cf file didn't you?
John Schmidt
On Sat, 16 Nov 2002, Bill Vermillion wrote:
> You did see my paragraph that you didn't quote to see if the
> mailertable was listed in the .cf file didn't you?
Yes. But since I wasn't addressing the content of that paragraph,
I didn't include it as quoted text. Excessive included text in
a usenet or email reply drives me up the wall, so it's entirely
possible that I sometimes snip *too* aggressively.
JS
Bill Vermillion
>> You did see my paragraph that you didn't quote to see if the
>> mailertable was listed in the .cf file didn't you?
>... I wasn't addressing ... content of ... paragraph,
>I didn't include it ... . Excessive included text ...
> drives me up the wall, so it's ...
>possible .. I i.. snip *too* aggressively.
OIC
))))
))))
:::: ))))
:::: ))))
---- ))))
---- ))))
:::: ))))
:::: ))))
))))
))))
James Szabadics
> > passed my way by a friend that I will try on Monday when back in the
> > office - If I stopped running named on the gateway would sendmail
> > refer to the /etc/hosts file?
>
> It depends on what is in the machine's /etc/resolv.conf file.
> Runnning named on a machine doesn't make that same machine use
> itself for queries, it's all based on what is in resolv.conf.
>
> > Can it be said that sendmail does not care about entries in the
> > /etc/hosts file?
>
> It depends on the resolver library functionality of your OS, as
> well as machine specific configuration. Sendmail will look at
> /etc/hosts under specific circumstances.
I have resolv.conf with
hostresorder local bind
When I ping ourdomain.com or mail.ourdomain.com I get replies from
10.x.x.x
When I use sendmail to user...@ourdomain.com it seems to only use DNS
and ends up in a loop to itself.
Bill Vermillion
James Szabadics <jm...@wespine.com.au> wrote:
>> > Mailertable sounds most promising - Thanks. I had another thought
>> > passed my way by a friend that I will try on Monday when back in the
>> > office - If I stopped running named on the gateway would sendmail
>> > refer to the /etc/hosts file?
>>
>> It depends on what is in the machine's /etc/resolv.conf file.
>> Runnning named on a machine doesn't make that same machine use
>> itself for queries, it's all based on what is in resolv.conf.
>>
>> > Can it be said that sendmail does not care about entries in the
>> > /etc/hosts file?
>>
>> It depends on the resolver library functionality of your OS, as
>> well as machine specific configuration. Sendmail will look at
>> /etc/hosts under specific circumstances.
>
>
>I have resolv.conf with
>hostresorder local bind
>When I ping ourdomain.com or mail.ourdomain.com I get replies from
>10.x.x.x
>When I use sendmail to user...@ourdomain.com it seems to only use DNS
>and ends up in a loop to itself.
In your hosts file do you have both the FQDN and the short name?
eg
10.x.x.x mail.ourdomain.com mail
And would you explain the line "ends up in a loop to itself".
But let me make a wild guess and that you paraphrased a message.
If this is part of an error message that really says "points back
to itself" then you don't have the domain the machine is supposed
to receive mail for in sendmail.cw or local-host-names [depending
on which version of sendmail you have] The file name is
pointed to by the Fw variable in sendmail.cf.
If is is the case mail comes to the machine, you don't have the
domain listed so that sendmail knows it is the machine for that
domains so it sends it on , and the MX record sends it back.
Also depending on version you are running it can do this several
times and on even older version you will get a too many hops
error message as it goes back and forth.
Does any of this help.
BTW - no need to anonomize the 10.x.x.x. You can safely put the
full dotted-quad there as the 10's aren't routeable and no one can
get to it.
Bill
James Szabadics
I read a Linux How-to and they described using the mailertable.
My sendmail.cf was not set up for mailertable so I reran the sendmail
m4 with the feature turned on to make a .cf with mailertable.
Added
ourdomain.com SMTP:[10.155.1.1]
to the mailertable - did the makemap hash to it. Restarted the server
and things got interesting
Using
sendmail -v us...@ourdomain.com < /dev/null
It successfully sent a blank message to the user on the 10.155.1.1
exchange server
But! when I tried sending mail from an external account I still had
the bounce message
554 5.0.0 MX list for ourdomain.com. points back to
gateway.ourdomain.com
554 5.3.5 <us...@ourdomain.com>... Local configuration error
I looked into sendmail.cf and found a line
# name resolver options
O ResolverOptions=-DNSRCH -DEFNAMES
I edited this to read
# name resolver options
# O ResolverOptions=-DNSRCH -DEFNAMES
O ResolverOptions=-DEFNAMES -DNSRCH
I restarted and its working (so far).....
The mailertable was a crucial step although for relaying it still
seemed to use DNS until I changed the sendmail.cf name resolver
options and restarted the server again. It could be that the
mailertable was wholly responsible and that the restart sorted out the
relaying or it could be the "name resolver options" was a factor - I
will experiment some more when I have the time and report back.
b...@wjv.comREMOVE (Bill Vermillion) wrote in message news:<H5rC9...@wjv.com>...
Bill Vermillion
James Szabadics <jm...@wespine.com.au> wrote:
>I read a Linux How-to and they described using the mailertable.
>My sendmail.cf was not set up for mailertable so I reran the sendmail
>m4 with the feature turned on to make a .cf with mailertable.
>Added
>ourdomain.com SMTP:[10.155.1.1]
>to the mailertable - did the makemap hash to it. Restarted the server
>and things got interesting
>Using
>sendmail -v us...@ourdomain.com < /dev/null
>It successfully sent a blank message to the user on the 10.155.1.1
>exchange server
>But! when I tried sending mail from an external account I still had
>the bounce message
>554 5.0.0 MX list for ourdomain.com. points back to
>gateway.ourdomain.com
>554 5.3.5 <us...@ourdomain.com>... Local configuration error
That's what I was trying to get at before. Look for the variable
Fw in the sendmail.cf and see the name of the file it points
too. Add the name gateway.ourdomain.com to that list. If it's not
there just create it with vi. Older versions pointed to a
sendmail.cw file newer versions usually use local-host-names
which is more intuitive. You can name it what you want.
Conversely you can always add your real name to the Cw variable
that is normally just 'localhost'. That's crude however.
I have 69 domains in my local-host-names. I get the message
you get when I set up an MX pointing to the machine and forget
to add it to that file. ;-) ;-) I don't do that too often
anymore.
The problem is the MX is pointing to gateway.ourdomain.com but
gateway.ourdomain.com doesn't know it is designated to receive
mail destined for itself. Since it now looks like a loop you get
that error. In the older version you'd get the message bounced
up the programmed limit and then get the message.
>I looked into sendmail.cf and found a line
>
># name resolver options
>O ResolverOptions=-DNSRCH -DEFNAMES
>I edited this to read
># name resolver options
># O ResolverOptions=-DNSRCH -DEFNAMES
>O ResolverOptions=-DEFNAMES -DNSRCH
>I restarted and its working (so far).....
I've not used that. Mine defaults to
O ResolverOptions=WorkAroundBrokenAAAA
>
>The mailertable was a crucial step although for relaying it still
>seemed to use DNS until I changed the sendmail.cf name resolver
>options and restarted the server again. It could be that the
>mailertable was wholly responsible and that the restart sorted out the
>relaying or it could be the "name resolver options" was a factor - I
>will experiment some more when I have the time and report back.
I stopped using 'mailertable' when I stopped using UUCP for mail.
But you have it working and that's what counts.