Anthony Geoghegan's questions

For the past while, I’ve been learning PowerShell to administrate our Office 365 tenancy instead of using the web interface.

After adding a new domain and confirming ownership of the domain name (all done through PowerShell), I was wondering if there’s a cmdlet that can be used to obtain the zone records that should be configured for a domain that is to be managed by Office 365.

Gather the information you need to create Office 365 DNS records explains how to obtain this information using the web interface but I’d prefer to do as much as possible using PowerShell.

At the moment, I can use the Get-DkimSigningConfig to determine the correct CNAME record to enable DKIM, e.g.,

Get-DkimSigningConfig -Identity contoso.com | fl Selector?CNAME

This should generally be of the form selector1-contoso-com._domainkey.contoso.onmicrosoft.com but I found that for one of our managed domains the DKIM CNAME had to be set to selector1-contoso-com0i._domainkey.contoso.onmicrosoft.com (an additional 0i).

For the MX record, I’d expect it to be contoso-com.mail.protection.outlook.com but I’d like to be certain so I’m wondering if there’s a PowerShell cmdlet or Azure object that lists the DNS records that should be configured for a managed domain (in particular what to use for the MX record).

I spent a lot of time searching the web and Microsoft’s own documentation but I only found references to how to determine this information using the web interface.

I’m a Unix administrator who also has to work with various MS Windows servers. For various tasks, I’m a lot more productive using the Unix tools that I’m familiar with and for a long time, I’ve been using Cygwin on my local workstation. Now, I’d like to set up Cygwin on certain Windows servers so that I can SSH into them and use the same tools for administrative tasks.

In previous versions, Cygwin would map Windows to POSIX users and permissions from a /etc/passwd and /etc/groups files but now it directly uses Active Directory on the domain controller to authenticate users. The Cygwin FAQ has been updated with instructions for setting up SSHD on a domain:

First of all, create a new domain account called "cyg_server". This account must be an administrative account, so make sure it's in the "Administrators" group.

Now create a domain policy which is propagated to all machines which are supposed to run an sshd service. This domain policy should give the following user rights to the "cyg_server" account:

Act as part of the operating system (SeTcbPrivilege)
Create a token object               (SeCreateTokenPrivilege)
Replace a process level token       (SeAssignPrimaryTokenPrivilege)

I have administrator access to the AD domain controller (which runs on Windows Server 2008 R2) and I’ve created the cyg_server domain account as a member of the Administrators group. However, I don’t know enough about Windows administration to follow the remaining instructions.

I presume “domain policy” refers to group policies but I really don’t know anything about group policies. I thought this question seemed relevant but it didn’t have enough detail for me to make use of it.

I’m trying to understand how exactly an email is processed by Postfix – and some of the finer details of SMTP mail transactions. My short-term goal is to debug a proprietary (binary, closed source) SMTP client but I first thought I’d examine what happens in a successful SMTP transaction.

I plan on blocking outgoing SMTP (port 25) at our LAN firewall so I configured Postfix as an internal mail server to accept mails from (primitive) local client software which can only send email via non-authenticated SMTP (over Port 25).

I turned on debugging of the Postfix smtpd process by appending the -v verbose flag in master.cf as described in Troubleshooting with Postfix Logs. I then sent an email from my own workstation using Cygwin Mutt with sSMTP (a minimal implementation of sendmail).

The Postfix logs show that after the RCPT TO: line was successfully processed and the recipient address was acceptable, Postfix’s smtpd assigned the transaction a Queue ID and responded to the SMTP client (sSMTP) with a 250 OK.

However, instead of issuing a DATA command, the SMTP client issued a RSET to reset / abort the current mail transaction and Postfix replied with a 250 OK.

I did some research on what this command command does and unsurprisingly, the Simple Mail Transfer Protocol, RFC 2821 provided the most comprehensive information:

This command specifies that the current mail transaction will be aborted. Any stored sender, recipients, and mail data MUST be discarded, and all buffers and state tables cleared. The receiver MUST send a "250 OK" reply to a RSET command with no arguments. A reset command may be issued by the client at any time. It is effectively equivalent to a NOOP (i.e., if has no effect) if issued immediately after EHLO, before EHLO is issued in the session, after an end-of-data indicator has been sent and acknowledged, or immediately before a QUIT. An SMTP server MUST NOT close the connection as the result of receiving a RSET; that action is reserved for QUIT (see section 4.1.1.10).

Since EHLO implies some additional processing and response by the server, RSET will normally be more efficient than reissuing that command, even though the formal semantics are the same.

There are circumstances, contrary to the intent of this specification, in which an SMTP server may receive an indication that the underlying TCP connection has been closed or reset. To preserve the robustness of the mail system, SMTP servers SHOULD be prepared for this condition and SHOULD treat it as if a QUIT had been received before the connection disappeared.

All of the above happened within the space of a second so there shouldn’t be any issues with time-outs.

In the next second, the client sent another RSET but the client then waited a whole 10s before restarting with MAIL FROM:, RCPT TO: but this time it follows through and issues the DATA command and the transaction completes (all within the same second according to the logs).

Essentially, I’m wondering why a SMTP client would interrupt its own transaction by issuing RSET commands instead of a DATA command.

Notes:

1. I can edit the question to include extract from the mail log file but with the -v debugging, they’re very verbose and I don’t want to overwhelm people with a firehose of irrelevant data.

2. I searched the sSMTP source code but I didn’t find any mention of RSET.