TCB13's questions

I came across a network that looks like the following:

In order to have the server access to both the public internet and internal network (but without depending on the internal router) one port of the router is plugged back into the the switch and tagged with another VLAN that is passed alongside the public VLAN to the server.

Consider there's a constant bandwidth usage of around 500Mbps on the internal network. Is that traffic constantly injected back into the port 4 tagged as VLAN 200? Does it limit the available bandwidth for VLAN 101 just because some machines are transferring data on the internal network? If yes, does it also happen if the server doesn't even have an interface configured for VLAN tagging on that tag?

The switch is a cheap TL-SG108E configured as shown in the picture. The router is a GL-MT6000 running OpenWrt that bridges all LAN ports into a single br-lan interface

Thank you.

I've a Debian 12 server (public IP 85.xxx.xxx.xxx at enp6s0) running a bunch of LXC containers on a network bridge cbr0.

Since the public IP is dynamic I had to setup forward + prerouting rules with dnat in order to have incoming requests reach the containers. Eg. port 80/443 are dnatted to container 10.10.0.1. Here are my nftables rules:

flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;

    ct state {established, related} accept
    iifname lo accept
    iifname cbr0 accept
    ip protocol icmp accept
    ip6 nexthdr icmpv6 accept
  }
  chain forward {
    type filter hook forward priority 0; policy accept;
  }
  chain output {
    type filter hook output priority 0;
  }
}

table ip filter {
  chain forward {
    type filter hook forward priority 0; policy drop;

    oifname enp6s0 iifname cbr0 accept
    iifname enp6s0 oifname cbr0 ct state related, established accept
    # Webproxy
    iifname enp6s0 oifname cbr0 tcp dport 80 accept
    iifname enp6s0 oifname cbr0 udp dport 80 accept
    iifname enp6s0 oifname cbr0 tcp dport 443 accept
    iifname enp6s0 oifname cbr0 udp dport 443 accept
  }
}

table ip nat {

  chain postrouting {
    type nat hook postrouting priority 100; policy accept;
  }

  chain prerouting {
    type nat hook prerouting priority -100; policy accept;
    # Webproxy
    iifname enp6s0 tcp dport 80 dnat to 10.10.0.1:80
    iifname enp6s0 udp dport 80 dnat to 10.10.0.1:80
    iifname enp6s0 tcp dport 443 dnat to 10.10.0.1:443
    iifname enp6s0 udp dport 443 dnat to 10.10.0.1:443
  }

}

Now the problem is: hairpin NAT. I've multiple containers hosting websites and sometimes it happens some of them need to communicate with other containers using domain names. When they run a DNS query for those domains they'll get the host IP and communication fails:

How can I fix this situation without resorting to DNS hacks? Is there a way to set nftables to forward request internally while having a dynamic IP? How does the iifname above plays with this?

Thank you.

Debian 12.1 (6.1.0-11-amd64) running LXD/LXC and on an unprivileged container setting security.idmap.isolated=true seems to fail to update the owner/group of the container's files.

Here is an example:

# lxc launch images:debian/12 debian
(...)

# lxc config get debian volatile.idmap.base
296608

# lxc stop debian
Error: The instance is already stopped

# lxc config set debian security.idmap.isolated true

# lxc config get debian security.idmap.isolated
true

# lxc start debian

Now if I list the files on the container volume I'll get they're all owned by the host root user:

# ls -la /mnt/NVME1/lxd/containers/debian/rootfs/
total 24
drwxr-xr-x 1 root   root  154 Sep  5 06:28 .
d--x------ 1 296608 root   78 Sep  5 15:59 ..
lrwxrwxrwx 1 root   root    7 Sep  5 06:25 bin -> usr/bin
drwxr-xr-x 1 root   root    0 Jul 14 17:00 boot
drwxr-xr-x 1 root   root    0 Sep  5 06:28 dev
drwxr-xr-x 1 root   root 1570 Sep  5 06:28 etc

I tried multiple versions of LXD/LXC. This happens with both 5.0.2 from apt as well with 4.0 and 5.17 (latest) from snap.

Interestingly enough I have another Debian 10 (4.19.0-25-amd64) running and older LXD 4 from snap and on that one things work as expected:

# ls -la /mnt/NVME1/lxd/containers/debian/rootfs/
total 0
drwxr-xr-x 1 1065536 1065536  138 Oct 29  2020 .
d--x------ 1 1065536 root      78 Oct 14  2020 ..
drwxr-xr-x 1 1065536 1065536 1328 Jul 24 19:07 bin
drwxr-xr-x 1 1065536 1065536    0 Sep 19  2020 boot
drwxr-xr-x 1 1065536 1065536    0 Oct 14  2020 dev
drwxr-xr-x 1 1065536 1065536 1716 Jul 24 19:08 etc

As you can see on this systems all the files are owned by 1065536:1065536.

Update:

I tried to probe around the maps with lxc config show debian in both machines and I saw this:

Machine running Debian 10:

security.idmap.isolated: "true"
(...)
volatile.idmap.base: "1065536"
volatile.idmap.current: '[{"Isuid":true,"Isgid":false,"Hostid":1065536,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":1065536,"Nsid":0,"Maprange":65536}]'
volatile.idmap.next: '[{"Isuid":true,"Isgid":false,"Hostid":1065536,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":1065536,"Nsid":0,"Maprange":65536}]'
volatile.last_state.idmap: '[{"Isuid":true,"Isgid":false,"Hostid":1065536,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":1065536,"Nsid":0,"Maprange":65536}]'

Machine running Debian 12:

security.idmap.isolated: "true"
(...)
volatile.idmap.base: "231072"
volatile.idmap.current: '[{"Isuid":true,"Isgid":false,"Hostid":231072,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":231072,"Nsid":0,"Maprange":65536}]'
volatile.idmap.next: '[{"Isuid":true,"Isgid":false,"Hostid":231072,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":231072,"Nsid":0,"Maprange":65536}]'
volatile.last_state.idmap: '[]'

Update:

I also tried a fresh install of Debian 11 (5.10.0-25-amd64) and it works as expected:

root@vm-debian-11-cli:~# ls -la /mnt/NVME1/lxd/containers/debian/rootfs/
total 24
drwxr-xr-x 1 1065536 1065536  154 Sep  6 06:28 .
d--x------ 1 1065536 root      78 Sep  6 15:31 ..
lrwxrwxrwx 1 1065536 1065536    7 Sep  6 06:25 bin -> usr/bin
drwxr-xr-x 1 1065536 1065536    0 Jul 14 17:00 boot
drwxr-xr-x 1 1065536 1065536    0 Sep  6 06:28 dev
drwxr-xr-x 1 1065536 1065536 1570 Sep  6 06:28 etc

Why didn't it populate volatile.last_state.idmap: '[]'? As with works with both Debian 10 and 11 apparently this can be related to the new kernel and/or its configuration.

How can I fix it? Thank you.

I've a Debian 10 server (public IP 85.xxx.xxx.xxx at enp6s0) running a bunch of LXC containers on a network bridge cbr0. I've the following iptables rules in place so the containers can communicate to the outside world:

iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i cbr0 -j ACCEPT
iptables -A FORWARD -i cbr0 -o enp6s0 -j ACCEPT
iptables -A FORWARD -i enp6s0 -o cbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -o enp6s0 -j MASQUERADE

I've created a container (10.0.0.1) that has nginx and redirected incoming http traffic to that container:

iptables -t nat -A PREROUTING -i enp6s0 -p tcp --dport 80 -j DNAT --to-destination 10.0.0.1:80
iptables -A FORWARD -i enp6s0 -o cbr0 -p tcp --dport 80 -j ACCEPT

Everything works as expected, I'm able to browse the website on the container etc.

Now I've created a second container (10.0.0.2) that needs fetch some data from the nginx container. If I use the internal 10.0.0.1 IP for the communication my second container is able to wget pages. However if I try to use the server's external IP:

root@second-container:~# nc example.com 80
example.com [85.xxx.xxx.xxx] 80 (http) : Connection refused

My current workaround is to manually add entries at /etc/hosts for all the domains hosted by nginx so they will resolve to 10.0.0.1 instead of their public IP.

What rules do I need to also allow communication using the external server IP?

Thank you.

Here is an additional diagram of the issue:

I've been using the following to share a folder from my LCX host into a container:

lxc config device add containerxyz directoryname disk source=/storage/containerxyz path=/mnt/storage/

This works perfectly fine, I can have the container read and write files to the /storage/containerxyz path in the host, however I see online some people suggesting do to this instead:

lxc.mount.entry = /storage/containerxyz /var/lib/lxc/containerxyz/rootfs/mnt/storage/ none bind 0 0

Whats the practical difference between those two ways to having host directory available to the container and drawbacks of each one?

I've a cloud-init script that is used to create and configure a Debian 10 VM and since I want to install nginx I have to add its repository to APT. I'm trying to do it like this:

apt:
  preserve_sources_list: true
  sources:
    nginx:
      source: "deb http://nginx.org/packages/debian $DEBIAN_RELEASE nginx"
      key: |
          -----BEGIN PGP PUBLIC KEY BLOCK-----
          Version: GnuPG v2.0.22 (GNU/Linux)

          mQENBE5OMmIBCAD+FPYKGriGGf7NqwKfWC83cBV01gabgVWQmZbMcFzeW+hMsgxH
          QxnZZIbETgcSwFtDun0XiqPwPZgyuXVm9PAbLZRbfBzm8wR/3SWygqZBBLdQk5TE
          ...
          =EWWI
          -----END PGP PUBLIC KEY BLOCK-----
packages:
  - nginx

It doesn't work and cloud-init's log file at /run/cloud-init/result.json shows the following:

{
 "v1": {
  "datasource": "DataSourceConfigDrive [net,ver=2][source=/dev/vdb]",
  "errors": [
   "('apt-configure', ProcessExecutionError(\"Unexpected error while running command.\\nCommand: ['apt-key', 'add', '-']\\nExit code: 255\\nReason: -\\nStdout: \\nStderr: E: gnupg, gnupg2 and gnupg1 do not seem to be installed, but one of them is required for this operation\"))"
  ]
 }
}

Why? It complaints it can't use apt-key because gnupg isn't present however how can I make sure it exists? According to /etc/cloud/cloud.cfg cloud-init runs the APT modules before installing packages so how am I supposed to get a working apt-key with gnupg?

Thank you.

I've a Debian 9 server with multiple network interfaces acting as web server connected to an ISP-provided optical network terminal (ONT) @ 1Gbps. The ISP provides us with multiple dynamic IPv4 addresses and optional static addresses.

Currently we're using a single static IPv4 address set at \etc\network\interfaces as:

 iface eth0 inet static
   address 89.xxx.xxx.xxx
   gateway 89.xxx.xxx.xxx
   netmask 255.255.255.0

With IPv6 they are not proving static options yet and they dynamically assign IPv6 blocks via prefix delegation using DHCP. The prefix length is /56 .

How can get one single IPv6 address on the network interface? I believe the server has to request a block and then assign the first IP to itself (or some random IP).

I've tried a simple config \etc\network\interfaces as:

iface eth0 inet6 dhcp
  request_prefix 1
  accept_ra 2

/etc/sysctl.conf with:

net.ipv6.conf.default.disable_ipv6=0
net.ipv6.conf.default.autoconf=1
net.ipv6.conf.default.accept_ra=2
net.ipv6.conf.all.disable_ipv6=0
net.ipv6.conf.all.autoconf=1
net.ipv6.conf.all.accept_ra=2
net.ipv6.conf.eth0.disable_ipv6=0
net.ipv6.conf.eth0.autoconf=1
net.ipv6.conf.eth0.accept_ra=2

But it didn't work, I just got a local link IPv6. Then I tried wide-dhcpv6:

interface eth0{
  send ia-na 0;
  send rapid-commit;
  request domain-name-servers;
  script "/etc/wide-dhcpv6/dhcp6c-script";
};

id-assoc na 0 {
};

Still only getting local link. From my understanding id-assoc na 0 would request an IPv6... however how this works since the ISP only provides everything as /56 block?

I also tried this without any luck:

interface eth0 {
    send ia-na 0;
    send ia-pd 0;
    send rapid-commit;
    request domain-name-servers;
    script "/etc/wide-dhcpv6/dhcp6c-script";
};

id-assoc na 0 { 

};

id-assoc pd 0 {
    prefix ::/56 infinity;
    prefix-interface eth0 {
        sla-len 8;
        sla-id 0;
        ifid 1;
    };
};

My final questions:

1. What should \etc\network\interfaces look like when using wide-dhcpv6?
2. Is any of my wide-dhcpv6 configurations correct?
3. It is possible to get the IPv6 without wide-dhcpv6, using just the Debian dhcp client?
4. ISP uses rapid-commit how can I enable that in \etc\network\interfaces?

Note: one of my colleagues was under the impression that IPv6 was just not working, so we tried to connect a DD-WRT router to the ISP and we set its settings as:

After a reboot we got IPv6 on the router and on the computers connect to it, so the issue must be with the configuration of our Debian server.

I've updated a machine to Debian 9.1 and everything seems to be fine, however I can't disable IPv6 autoconfig.

Background: I only want to use some specific IPv6 addresses on the machine that I'm defining in /etc/systemd/network/10-static-eth0.network:

[Match]
Name=eth0

[Network]
Address=2a04:52c0:xxx:xxx::xxx/48
Address=2a04:52c0:xxx:xxx::xxx/48
Address=2a04:52c0:xxx:xxx::xx/48
Gateway=2a04:52c0:xxx::1

Address=5.2.xxx.xxx/25
Address=5.2.xxx.xxx/25
Address=5.2.xxx.xxx/25
Gateway=5.2.xxx.xxx

To disable IPv6 autoconfig I added the following at the end of /etc/sysctl.conf:

net.ipv6.conf.default.autoconf=0
net.ipv6.conf.all.autoconf=0
net.ipv6.conf.eth0.autoconf=0

net.ipv6.conf.default.accept_ra=0
net.ipv6.conf.all.accept_ra=0
net.ipv6.conf.eth0.accept_ra=0

net.ipv6.conf.default.accept_dad=0
net.ipv6.conf.all.accept_dad=0
net.ipv6.conf.eth0.accept_dad=0

After rebooting there's no dynamic / autoconfig IPv6 address but after a while it appears on ip addr show:

inet6 2a04:52c0:xxxx:xxxx:xxxx:xxx:xxxx:1e3d/64 scope global mngtmpaddr noprefixroute dynamic 
   valid_lft 2590732sec preferred_lft 603532sec

How can I avoid this autoconfig IPv6 address and make sure only the static addresses get to work?

Thank you.

I got the latest version (3.0.1) of the easy-rsa tool from Github in order to generate some certificates for a small VPN. After looking into the documentation I manage to write a vars file that include answers to most questions made by the tool including setting the Common Name:

set_var EASYRSA_REQ_CN          "vpn.machine.dev"

Every other option os correctly loaded / takes the value I set on vars by the easy-rsa tool however EASYRSA_REQ_CN seems to be ignored. Here is an example:

Organizational Unit Name (eg, section) [IT]:
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:
Email Address [[email protected]]:

Why isn't Common Name using the value I set and is defaulting to [Easy-RSA CA]? What did I miss?

Thank you!

So, due to some very poor design choices I'm stuck with a complex and unreplaceable interactive console application running forever on a Debian machine.

This apps does some tasks, repeatedly, and returns to stdout results like:

InvetoryOpt: Finished
PBridged: Finished
FLoot: ERROR

I need to make sure that every x minutes I get the string InvetoryOpt: Finished on the output of the program. If not I need to kill it, run other a script, start the program again and the check.

How may I accomplish this? I was thinking about expect but I don't have much experience with with and I'm not sure I'm able to check if output matches string every x minutes.

Notes:

• The program also outputs lots of other garbage that I don't care about;
• The program can output the same string InvetoryOpt: Finished multiple times in 30 minutes or just don't output anything at all. So tailing the end of a file won't do it because it would match the last output of that string.

Thank you.

I've a situation where some users keep very old messages (+5 years) on their mailboxes that are just a waste of space and due to safety reasons should also be deleted.

I find out that I could use doveadm for this, however running something like:

doveadm expunge -u [email protected] mailbox INBOX savedbefore 1-Jan-2011

Doesn't have any effect. From my understanding email clients mark email for deletion before the expunge is run on the server to actually remove them.

How can I mark them for deletion using doveadm and then run the doveadm command before or directly and completely delete them?

I recently noticed when I add an alias to a Gmail account they ask me for a remote SMTP server, username and password. Then, whenever I try to send an email using that alias it gets relayed by Gmail to the provided SMTP server.

Is there a way I can accomplish this setup on a Postfix install?

To clarify, on my server there's a virtual user [email protected] (with the aliases: [email protected] and [email protected]) if he sends an email:

• With a from address of [email protected] => server will do the default delivery;
• With a from address of [email protected] => server will relay email using smtp.xpto.com (with proper credentials);
• With a from address of [email protected] => server will relay email using smtp.corpx.com (with proper credentials);

Ideally it would be nice If I could have a MySQL table with the external alises (for every virtual user) containing the external SMTP server domain, port, username and password. => This way I could setup a small web interface so my users could all their own external alises...

Thank you.

In the past I had the following config on Lighted that would allow me to redirect some secondary domains I own to my primary domain.

$HTTP["host"] =~ "superdomain\.net|superdomain\.eu" {
    url.redirect = ( "^/(.*)" => "http://mything.com/" )
}

This works fine. If someone tries to go to superdomain.net he'll be redirected to http://mything.com also keeping full URL query.

However, today I was trying to setup the sub-domain webmail.superdomain.net and Lighted matches webmail.superdomain.net on the rule before and redirects the user to http://mything.com.

The config for the subdomain was:

$HTTP["host"] == "webmail.superdomain.net" {
    var.domain = "webmail.superdomain.net"
    include "/var/webconfig/config/template/domain-generic.conf"
}

I place that rule before the other one but still no luck. Is there a way I can change the first rule to only match a domain and not subdomains?

Thank you.

A long time ago I posted a question here: Postfix: Gmail marking my email as spam where I said that although emails send from my servers were passing all the DKIM and SPF tests they were getting deliver to SPAM on Gmail.

Two days ago I was configuring a new system and noticed a very strange thing related to SPF — without any SPF TXT record on the DNS Zone, the email are delivered to Inbox and with SPF defined the are getting delivered on SPAM.

My SPF entries are like this:

domain.dev.             IN      TXT     "v=spf1 ip4:x.x.x.x ip6:x:x:x:x::x -all"

Isn't SPF record for the domain correct? If not what is wrong?

Every time I place that line on my DNS zone, Google starts delivering my email to SPAM, and even more interesting is what Gmail says about the emails.

Test email sent with SPF:

spf=pass (google.com: domain of [email protected] designates x.x.x.x as permitted sender) [email protected];

=> Delivered to SPAM box.

Test Email sent without SPF:

spf=pass (google.com: best guess record for domain of [email protected] designates x.x.x.x as permitted sender) [email protected];

=> Delivered to inbox.

Anyway has experienced this before? Is my SPF wrong? Thank you!

I've been reading some articles about IPv6 and I'm currently playing with some addresses on a VPS.

Recently I was thinking on a typical home/office IPv4 network. We're used to have a local DHCP server running giving private IPs, RFC1918 to our machines and than use NAT to translate the traffic between a public ISP provided IP and our internal network.

I do understand that NAT translation was just a measure to deal with the end of IPv4 and since we've a lot of IPv6 addressing space available we can just give every computer on the world a unique IPv6 and not worry with it — network Security will still be addressed by firewalls in a not block-all NAT fashion.

However... If every host has a public IPv6 what happens to my network if the ISP dies / changes / external network is down for some reason? How can I ensure local communication? How can I avoid having to reconfigure a lot of software in case of ISP change (since the IPv6 prefix will change)?

What would be the correct way to address those concerns? Can I interlay make use a machine always have the same IP? Even if that IP is public? I've heard about a private IP space in IPv6, does that work in the same way as IPv4 or does it "append" to my IPS prefix? How does machines get their IPs after all? Should they configure them as static?

Thank you.

I've a small Master->Slave DNS scheme setup between two machines running Debian 8 + Bind9 in dual IP stack.

The master and the slave both own an IPv4 and IPv6 used by bind, enfored by the configuration parameters listen-on listen-on-v6 transfer-source transfer-source-v6 notify-source notify-source-v6 query-source address query-source-v6 address.

Currently my master is set to notify the slave as:

notify yes;
also-notify { xxxx:xxxx:xxxx:xxxx::xxx5; x.x.x.5; };

As my slave has on a zone configuration something like:

zone "example.dev" {
    type slave;
    masters { xxxx:xxxx:xxxx:xxxx::xxx2; x.x.x.2; };
    file "...";
};

This setup works fine, however by inspecting the log files (and as I expected) the master is notifying the slave twice on every zone change:

May 20 20:57:53 salvedns named[8568]: zone example.dev/IN: notify from x.x.x.2#52041: zone is up to date
May 20 20:57:53 salvedns named[8568]: zone example.dev/IN: notify from xxxx:xxxx:xxxx:xxxx::xxx2#51347: zone is up to date

One time, over IPv4 and another over IPv6.

Is there a way I can tell the bind server that xxxx:xxxx:xxxx:xxxx::xxx5 x.x.x.5 are indeed addresses for the same DNS server and try to notify it first over IPv6, and if it fails retry over IPv4? Also, how to do the same thing on the salve masters declaration?

Thank you.

I've been trying to implement a bind master->slave setup between two machines, but I've a problem regarding the IP address BIND used on the master to notify my slave machine.

Here is my setup:

Master: master.site.com - 10.0.0.2
Slave: slave.site.com - 10.0.0.10

The Master has a authoritative zone for site.com and it's configured to notify all slaves when the zone is changed. The zone is working properly. It replies fine to queries and dig @10.0.0.2 -t SOA site.com

So, on the master I've this named.conf.options:

options {
    directory "/var/cache/bind";

    dnssec-validation auto;
    auth-nxdomain no;

    listen-on { 10.0.0.2; };
    listen-on-v6 { any; };
    allow-query     { any; };
    recursion yes;
    allow-recursion { localhost; };
    allow-notify { localhost; };
    allow-transfer { localhost; 10.0.0.10; };
    version none;

    notify yes;
    also-notify { 10.0.0.10; };

};

On the slave:

options {
    directory "/var/cache/bind";

    dnssec-validation auto;
    auth-nxdomain no;

    listen-on { 10.0.0.10; };
    listen-on-v6 { any; };
    allow-query     { any; };
    recursion yes;
    allow-recursion { localhost; };
    allow-notify { localhost; 10.0.0.2; };
    allow-transfer { localhost; 10.0.0.2; };
    version none;
};

To start, notifications doesn't seem to work, using tcpdump on the slave machine I got this message:

02:32:50.269377 IP 10.0.0.1.15271 > 10.0.0.10.53: 64103 notify [b2&3=0x2400] [1a] SOA? site.com. (85)
02:32:50.269662 IP 10.0.0.10.53 > 10.0.0.1.15271: 64103 notify Refused- 0/0/0 (27)

As you can see although master is set to listen on 10.0.0.2 when sending notifications it is sending them using it's main IP address 10.0.0.1 and logically my slave refused the notification...

Why isn't the master not sending the notifications over 10.0.0.2? Is there any config where I can force that? The machine owns 3 IP's, one for it's website, another for email and another for DNS... I need to make it ONLY use 10.0.0.2 for DNS, but apparently listen-on doesn't seem to work with outgoing traffic...

How can I fix this?

So in my server I'm usually going against a problem, different emails clients call some special folders like Sent and Trash different names like Sent Items and Deleted Items.

My question is, can I in some way "alias" all those names and internally map them to a same Sent folder on the server?

I managed to change my dovecot.conf an include sections like:

mailbox Sent {
    special_use = \Sent
    auto=subscribe
}

mailbox "Sent Messages" {
    special_use = \Sent
}

mailbox "Sent Items" {
    special_use = \Sent
}

Is this the right way to "fix" this annoying issue? It seems to work, at least there's no actually duplication on the server, but some emails clients may pick all the folders duplicated.

Thank you.

I've been running a web platform that needs to send a considerable amount of emails daily. At the implementation date I and my partner decided to setup Postfix on the server and use Swift Mailer class to send the email using a SMTP connection to the local Postfix server.

This allowed us to have multiple email accounts, like [email protected], [email protected], [email protected] and be able to send email with them correctly signed with DKIM.

My question is, can't we configure PHP in some way to avoid a local SMTP connection (which takes time an server resources) and replace with a more direct way to deliver the messages to be sent to the Postfix queue?

Form my understanding I could use PHP mail() function or even Swift Mailer's Swift_SendmailTransport class and deliver the messages directly to Postfix queue. But if so, how can we ensure DKIM? Will changing the "FROM" header to the email accounts on the local server be enough?

Thank you.

I'm been trying to understand why Gmail is treating the email sent from one of my domain/server as SPAM. I found a lot of threads here about this issue, however I checked the usual suspects like domain keys, spf etc.

My email is accepted by Outlook.com, which from my understanding has a lot more aggressive spam filter.

I tested my config using [email protected] and I got this:

SPF check:          pass
DomainKeys check:   neutral
DKIM check:         pass
Sender-ID check:    pass
SpamAssassin check: ham

Everything looks fine.

After sending an email to a gmail account I get this under the headers:

Received-SPF: pass (google.com: domain of [email protected] designates 89.x.x.8 as permitted sender) client-ip=89.x.x.x;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of [email protected] designates 89.x.x.8 as permitted sender) [email protected];
       dkim=pass [email protected]

As you can see, the email is passing on spf and dkim without issues on gmail servers.

Finally I checked my server IP, hostname and domain at http://mxtoolbox.com/blacklists.aspx for RBL blocks and they're not listed anywhere.

Why is gmail treating my emails as SPAM? It makes no sense, I've complied with every single good practice.

Other Note:

• Reverse DNS is also ok;
• Tests at http://www.allaboutspam.com are green except for Email server is not using BATV format;

Thank you.