Old Pro's questions

I have read the many answers to many similar questions, but have not found exactly this question or any answer that helped.

I have a Postfix 2.11 server (mail-server.example.com) that is strictly for outgoing email. It works fine if it is able to send the email on the first try. However, for performance reasons, if it cannot send the email on the first try and instead wants to defer it, I have configured smtp_fallback_relay so that it forwards the email to another server (deferred-mail.example.com) that handles only deferred emails.

smtp_fallback_relay = [deferred-mail.example.com]

If, from my trusted IP (mynetworks), I send an email to either server destined for [email protected], either server will accept it and try to send it to Gmail. Because my server IP is new, Gmail rejects the email from either server with 421 (temporary deferral). As expected, the deferred-mail server simply puts the message in its deferred queue and tries again later.

The weird part is that while mail-server will send the message to Gmail to begin with, after receiving the 421, it attempts to send the mail to deferred-mail, but gives up and instead bounces the message, saying "mail for gmail.com loops back to myself". I see no logs on the deferred-mail server saying anything about what is going on.

So both servers are configured to accept mail and relay it to Gmail if the client is trusted, and the deferred-mail trusts mail-server (I can send to a Gmail address when directly connecting to deferred-mail from `mail-server), so how is Postfix coming up with this "loop" and why is it bouncing the email instead of relaying it?

Update and clarification about the logs below.

For privacy reasons, I am not posting the actual domain name or IP addresses we are using. Throughout this post and in the log excerpt below, I have replaced the actual root domain name we are using with example.com.

This setup was copied from a working email cluster. I am confident that it is theoretically sound, and suspect it is just a matter of some setting not being correctly replaced or translated. It is just that with this odd behavior and seemingly incorrect error message, I cannot figure out what to change, and that is why I am asking for help.

• "Greeted me with my own hostname" is not a mistake or problem

When sending emails via SMTP, the sender begins by identifying itself by host name. Big mail processors like Gmail and Yahoo take several steps to assess the reputation of the sender. With IPv4, two of the first things they did were

1. Record the IP address of the sender and build up a record of the quality and quantity of emails coming from that specific IP address
2. Verify that the reverse DNS record for that IP address maps back to the host name the sender identified itself with

If the IP address has a bad reputation or the reverse DNS does not match the sender host name, the receiver would be much more likely to mark the email as Spam regardless of anything else.

For both these reasons, both mail-server.example.com and deferred-mail.example.com are behind the same NAT Gateway that

1. Has a static IP address, so all email comes from the same IP address with the same reputation (REDACTED-PUBLIC-IPv4 in the log excerpt below)
2. Has a reverse DNS record that identifies that IP address as mail-server.example.com

For that reason, when deferred-mail.example.com identifies itself in an SMTP session, it identifies itself as mail-server.example.com. This is correct, desired behavior and not an uncommon situation for the reasons stated above. (deferred-mail.example.com points to a private IP address, 10.111.14.181 in the logs below and does not have a reverse DNS record.)

• IPv6 failure is not a mistake or problem

Our server stack does not currently have IPv6 enabled. Because we are using a new domain name, we have zero domain reputation, so we want to stick to IP reputation until we have a solid domain reputation established. (Because IPv6 addresses are disposable, they will never be an adequate basis for reputation.)

Therefore, the failures to reach Gmail's IPv6 servers aspmx.l.google.com and alt2.aspmx.l.google.com are expected and not particularly a problem, although if there is a setting that I can set to keep postfix from even trying to reach IPv6 addresses, please let me know so I can make that change.

Answer to disabling IPv6 attempts: Add this to your main.cf

inet_protocols = ipv4

Per request, here are redacted logs of the error:

postfix/smtpd[26668]: 50F7C5B81: client=ip-10-111-7-75.us-west-2.compute.internal[10.111.7.75]
postfix/cleanup[26682]: 50F7C5B81: message-id=<>
opendkim[36]: 50F7C5B81: can't determine message sender; accepting
postfix/qmgr[143]: 50F7C5B81: from=<REDACTED-SENDER>, size=279, nrcpt=1 (queue active)
postfix/smtp[26686]: 50F7C5B81: host aspmx.l.google.com[74.125.197.26] said: 421-4.7.0 [REDACTED-PUBLIC-IPv4      15] Our system has detected that this message is 421-4.7.0 suspicious ... 
postfix/smtp[26686]: connect to aspmx.l.google.com[2607:f8b0:400e:c07::1a]:25: Cannot assign requested address
postfix/smtp[26686]: connect to alt2.aspmx.l.google.com[2607:f8b0:4001:c56::1a]:25: Cannot assign requested address
postfix/smtp[26686]: 50F7C5B81: host alt2.aspmx.l.google.com[142.250.152.27] said: 421-4.7.0 [REDACTED-PUBLIC-IPv4      15] Our system has detected that this message is 421-4.7.0 suspicious ...
postfix/smtp[26686]: warning: host deferred-mail.example.com[10.111.14.181]:25 greeted me with my own hostname mail-server.example.com
postfix/smtp[26686]: warning: host deferred-mail.example.com[10.111.14.181]:25 replied to HELO/EHLO with my own hostname mail-server.example.com
postfix/smtp[26686]: 50F7C5B81: to=<[email protected]>, relay=deferred-mail.example.com[10.111.14.181]:25, delay=26, delays=24/0.01/1.5/0, dsn=5.4.6, status=bounced (mail for gmail.com loops back to myself)

log messages here about sending bounce email to sender
have been removed 

postfix/bounce[26688]: 50F7C5B81: sender non-delivery notification: AEA8A5B83
postfix/qmgr[143]: 50F7C5B81: removed

I am tracking down what may be a stray or erroneous hard link to a directory, so I want to find all the hard links to a directory to manually verify them. (fsck finds no errors, but the link count appears wrong on casual inspection.)

The normal way to check for hard links to a file is to use find, either find -inum or find -samefile, but neither of those work for directories:

user$ find . -links 3 -name '.*' -ls
user$ ls bar
l1/
user$ ls -iad bar
10541088 bar/
user$ ls -iad bar/.
10541088 bar/./
user$ ls -iad bar/l1/..
10541088 bar/l1/../
user$ find . -inum 10541088 -ls
10541088        0 drwxr-xr-x    3 user             admin                 102 Mar 17 11:36 ./bar
user$ find . -samefile bar -ls
10541088        0 drwxr-xr-x    3 user             admin                 102 Mar 17 11:36 ./bar

Note that although bar, bar/., and bar/l1/.. all are hard links to the same inode, find only lists one of them.

I can use ls -aiR / | grep 10541088 and that will at least find the dot and dot dot links, but I am not positive that there is not some other kind of hidden file that this will miss, plus ls will cross devices, which I do not want.

Is there a better way to find all the hard links to a directory?

I read How does IPv6 subnetting work and how does it differ from IPv4 subnetting? but my question was not answered there.

I'm upgrading our IPv4 network to IPv6. Currently, our NAT gateway splits our one IPv4 address into 2 private subnets, our main subnet and an isolated guest subnet. I want to continue this practice of having 2 separated subnets under IPv6. I read that I should not use a prefix larger than /64 because it will break things, but the delegated prefix my router is picking up (I believe via DHCPv6) is a /64 prefix. So somehow I want to get a /56 prefix automatically assigned (suggestions welcome), but even after I get that, it is still going to be dynamic, so my question is how do I set up 2 subnets based on this dynamic allocation?

I am used to using NAT and statically configured IPv4 private subnets. Now I am going to have to manage 2 public subnets with a firewall between them, but I don't see how I'm supposed to configure a RouterOS router to say "combine the /56 dynamic prefix with this 8-bit static subnet identifier to create /64 subnet". How do I do that (or what should I do instead)?

The nginx documentation on "Configuration file measurement units" at http://nginx.org/en/docs/syntax.html says:

Sizes can be specified in bytes, kilobytes (suffixes k and K) or megabytes (suffixes m and M)

This is unclear, because kilobyte is officially defined as 1000 bytes and megabyte is officially defined as 1000000 bytes, but often it is used to mean 1024 bytes and 1024 * 1024 bytes respectively. Exactly what size kilobyte is used in the nginx configuration files? When the documentation says the default is 1m is that 1000000 or 1048576?

I'm using reprepro to maintain a Private Package Archive of internal packages. There is no straightforward way to keep multiple version of a package available using reprepro (see here), but it does have a snapshot facility that sort of works.

But only sort of. I don't see a good way to go back to a snapshot version. There is a command restore documented, but it doesn't seem to work (reprepro version 4.8.2 on Ubuntu 12.4.1 LTS).

I can access the snapshot via apt-get as described in the man page, by editing sources.list to include something like

deb method://as/without/snapshot codename/snapshots/name main

but this means I need to update all the servers with a new sources.list to change their snapshots.

What I'd like to do is maintain a "safe" distribution that I can configure from any snapshot on "stable" and always have servers pull from "safe". Then to do a rollback I just roll back "safe" and have the servers remove and re-install the packages. (I say remove and reinstall because it seems too hard to get them to downgrade just the private packages without touching the public packages.) Or something like that.

The main goal is to have an automated way to get a server farm to revert to an older version of the packages. I'm open to suggestions.

How are people handling this? Is there a way to get reprepro snapshots to work the way I'd like?