Home / server / Questions / 1133945
Accepted
Bombe
Asked: 2023-06-15 13:37:05 +0800 CST

Amazon SES Unable to Deliver Mails to My Exim

  • 772

I am constantly finding lines like these in my exim logfile:

17:42:56 [6063] 1q9ScJ-0001Zn-SJ DKIM: d=slack.com s=s4xolb5s7tnx6yxtrm4adems7glgsuyf c=relaxed/simple a=rsa-sha256 t=1686757138 [invalid - public key record (currently?) unavailable]
17:42:56 [6063] 1q9ScJ-0001Zn-SJ DKIM: d=amazonses.com s=224i4yxa5dv7c2xz3womw6peuasteono c=relaxed/simple a=rsa-sha256 t=1686757138 [invalid - public key record (currently?) unavailable]
17:42:56 [6063] 1q9ScJ-0001Zn-SJ DKIM test passed (address=01000188ba8f5fb3-3091cee3-ea59-43bc-a0ef-97ab87419b59-000000@mail.slack.com domain=slack.com), but signature is invalid.
17:42:56 [6063] 1q9ScJ-0001Zn-SJ DKIM test passed (address=01000188ba8f5fb3-3091cee3-ea59-43bc-a0ef-97ab87419b59-000000@mail.slack.com domain=amazonses.com), but signature is invalid.
17:42:56 [6063] 1q9ScJ-0001Zn-SJ TLS error on connection from a35-21.smtp-out.amazonses.com [54.240.35.21]:42401 I=[<my-ip>]:25 (recv): The TLS connection was non-properly terminated.
17:42:56 [6063] 1q9ScJ-0001Zn-SJ SMTP connection lost after final dot H=a35-21.smtp-out.amazonses.com [54.240.35.21]:42401 I=[<my-ip>]:25 P=esmtps

According to https://serverfault.com/a/932770/142936 the last line should mean that the email has already been delivered; however, none of the mails ever show up in my inbox. No, they’re not spam, either. It’s basically every mail from Slack, from Amazon themselves, and a couple of other services that don’t run their own email servers anymore. Other large email services, like Gmail, have no trouble at all delivering mails to my server.

I suspect that the second-to-last line somehow plays in role in this, I just have no idea how to debug this any further… is there something I can do? Does Amazon have to fix their SES? Will I never get any mails from Amazon SES anymore? ?

exim

1 Answers

  1. Best Answer

    It looks like its struggling to get the public key for signature verification. I'd fix this first - does your server have internet access (or at least access to the public DNS)? You should be able to run this on the server to verify you can get those keys:

    dig s4xolb5s7tnx6yxtrm4adems7glgsuyf._domainkey.slack.com TXT

    This should get you a response similar to this:

    ;; ANSWER SECTION:
s4xolb5s7tnx6yxtrm4adems7glgsuyf._domainkey.slack.com. 595 IN CNAME s4xolb5s7tnx6yxtrm4adems7glgsuyf.dkim.amazonses.com.
s4xolb5s7tnx6yxtrm4adems7glgsuyf.dkim.amazonses.com. 1821 IN TXT "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCilRDx9q7IahVGmFQr32aEx2Uj0Joa9h4S3TARPL/NxvfnbnEiEhf5iHYagNw4cIQ11ctEu1do8Scj6jcIiRMOnojyO1sna/rj/T+Rg8ezQoOdRvN+o0miYxf1cWC7xpCo3nBGDRh/w7kYGylLlLUrOd+BQ80CKrfYnSnDFiAJMQIDAQAB"

    If you dont see that, you've found at least part of the problem, and will want to fix your DNS client on the box

    • 1