On 6/9/25 05:05, Mark Sapiro wrote:

On 6/8/25 16:04, Florian Sukup wrote:

...

I set up mailman, created a site/domain (lists.yyy.com). My hostname is host.xxx.com . My IP has a RDNS entry: reverse.rrr.com .

Why is the RDNS to reverse.rrr.com and not host.xxx.com. It is important for mail delivery to have full circle DNS. I.e. the sending server should have an A record for its IP and revers DNS for that IP should point back to the sending server's name. I'm guessing that rrr.com is a hosting provider and you don't control the rDNS for that IP, but you should try to get them to change it for you. Without that change, delivery of your outbound mail, at least to large ISPs, will be problematic at best.

The setup has historic reasons. However I can eliminate reverse.rrr.com completely and replace it by host.xxx.com. Right now reverse.rrr.com has an A-record pointing to the host's ip address.

...

When I send an email to my mailing list mylist@lists.yyy.com I receive an error email. The logfile says the following:

... Jun  9 00:23:38 arvak postfix/relay/smtp[]: 094895FADB: to=<mylist@lists.yyy.com>, relay=reverse.rrr.com[m.y.i.p]:25, delay=0.06, delays=0.03/0.01/0.02/0, dsn=5.4.6, status=bounced (mail for lists.yyy.com loops back to myself)

What is the output from postconf -n?

alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases append_dot_mydomain = no biff = no compatibility_level = 2 inet_interfaces = all inet_protocols = all local_recipient_maps = proxy:unix:passwd.byname $alias_maps hash:/var/lib/mailman3/data/postfix_lmtp mailbox_size_limit = 0 message_size_limit = 0 mydestination = localhost, localhost.localdomain, arvak myhostname = host.xxx.com mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128, 192.168.77.0/24 myorigin = /etc/mailname owner_request_special = no readme_directory = no recipient_delimiter = + relay_domains = ${{$compatibility_level} < {2} ? {$mydestination} : {}} hash:/var/lib/mailman3/data/postfix_domains relayhost = smtp_tls_CApath = /etc/ssl/certs smtp_tls_cert_file = /etc/letsencrypt/live/host.xxx.com/fullchain.pem smtp_tls_key_file = /etc/letsencrypt/live/host.xxx.com/privkey.pem smtp_tls_loglevel = 3 smtp_tls_security_level = may smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtp_use_tls = yes smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU) smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination smtpd_tls_cert_file = /etc/letsencrypt/live/host.xxx.com/fullchain.pem smtpd_tls_key_file = /etc/letsencrypt/live/host.xxx.com/privkey.pem smtpd_tls_loglevel = 3 smtpd_tls_security_level = may smtpd_use_tls = yes transport_maps = hash:/var/lib/mailman3/data/postfix_lmtp virtual_alias_domains = 9 different domains, however not host.xxx.com, lists.yyy.com or reverse.rrr.com virtual_alias_maps = hash:/etc/postfix/virtual

...

Jun  9 00:23:38 arvak postfix/smtpd[114119]: disconnect from host.xxx.com[m.y.i.p] ehlo=1 quit=1 commands=2 ...

The MX record of lists.yyy.com points to reverse.rrr.com. Not sure if this is the best idea?

reverse.rrr.com has no A or AAAA record. An MX MUST point to a domain that has an A or AAAA record. The MX should point to host.xxx.com.

Will be resolved (s. above).

...

Can anyone give me a hint where to search for this error?

The output from postconf -n would help. Also, have you set up postfix per https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/docs/mta.ht... ?

Basically yes, but I see a few differences which all worked on my test installation. Here comes my mailman.cfg:

[mailman] site_owner: mailman@... noreply_address: noreply default_language: en sender_headers: from from_ reply-to sender email_commands_max_lines: 10 pending_request_life: 3d cache_life: 7d pre_hook: post_hook: layout: debian filtered_messages_are_preservable: no html_to_plain_text_command: /usr/bin/lynx -dump $filename listname_chars: [-_.0-9a-z]

[shell] prompt: >>> banner: Welcome to the GNU Mailman shell use_ipython: no history_file:

[paths.debian] var_dir: /var/lib/mailman3 queue_dir: $var_dir/queue bin_dir: /usr/lib/mailman3/bin list_data_dir: $var_dir/lists log_dir: /var/log/mailman3 lock_dir: $var_dir/locks data_dir: $var_dir/data cache_dir: $var_dir/cache etc_dir: /etc/mailman3 ext_dir: $var_dir/ext messages_dir: $var_dir/messages archive_dir: $var_dir/archives template_dir: $var_dir/templates pid_file: /run/mailman3/master.pid lock_file: $lock_dir/master.lck

[database] class: mailman.database.sqlite.SQLiteDatabase url: sqlite:///$DATA_DIR/mailman.db debug: no

[logging.debian] format: %(asctime)s (%(process)d) %(message)s datefmt: %b %d %H:%M:%S %Y propagate: no level: info path: mailman.log

[webservice] hostname: localhost port: 8001 use_https: no show_tracebacks: yes api_version: 3.1 admin_user: ... admin_pass: ...

[mta] incoming: mailman.mta.postfix.LMTP outgoing: mailman.mta.deliver.deliver smtp_host: localhost smtp_port: 25 smtp_user: smtp_pass: lmtp_host: 127.0.0.1 lmtp_port: 8024 configuration: python:mailman.config.postfix

Thanks for your help, Florian.

On 6/9/25 20:54, Mark Sapiro wrote:

On 6/9/25 05:06, Florian Sukup wrote:

...

The setup has historic reasons. However I can eliminate reverse.rrr.com completely and replace it by host.xxx.com. Right now reverse.rrr.com has an A-record pointing to the host's ip address.

Eliminating reverse.rrr.com completely and replacing it by host.xxx.com would be good. This will help.

First step is done: I replaced reverse.rrr.com by host.xxx.com the DNS zones of all domain I use. Tomorrow I will have the rDNS record be rewritten by my ISP.

Also if I look up the A record for reverse.rrr.com either locally or at aaron.ns.cloudflare.com there isn't one. This will be moot if you replace reverse.rrr.com with host.xxx.com.

reverse.rrr.com is not the real name ...

...

...

What is the output from postconf -n?

alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases append_dot_mydomain = no biff = no compatibility_level = 2 inet_interfaces = all inet_protocols = all local_recipient_maps = proxy:unix:passwd.byname $alias_maps hash:/var/lib/mailman3/data/postfix_lmtp mailbox_size_limit = 0 message_size_limit = 0 mydestination = localhost, localhost.localdomain, arvak

This needs to include $myhostname

I don't want to receive any emails like ...@host.xxx.com . So I thought removing host.xxx.com from $mydestination is a good idea. Is there any other solution for that?

Florian.

I have now elimiated reverse.rrr.com. But there isn't much change:

vvvvvvvvvvvvvvvvvvvvvvvvv Jun 11 22:19:57 arvak postfix/relay/smtp[1015580]: initializing the client-side TLS engine Jun 11 22:19:57 arvak postfix/smtpd[1015581]: initializing the server-side TLS engine Jun 11 22:19:57 arvak postfix/smtpd[1015581]: connect from host.xxx.com[m.y.i.p] Jun 11 22:19:57 arvak postfix/relay/smtp[1015580]: warning: host host.xxx.com[m.y.i.p]:25 greeted me with my own hostname host.xxx.com Jun 11 22:19:57 arvak postfix/relay/smtp[1015580]: warning: host host.xxx.com[m.y.i.p]:25 replied to HELO/EHLO with my own hostname host.xxx.com Jun 11 22:19:57 arvak postfix/relay/smtp[1015580]: 29FCF5F867: to=<mylists@lists.yyy.com>, relay=host.xxx.com[m.y.i.p]:25, delay=0.2, delays=0.06/0.01/0.13/0, dsn=5.4.6, status=bounced (mail for lists.yyy.com loops back to myself) Jun 11 22:19:57 arvak postfix/smtpd[1015581]: disconnect from host.xxx.com[m.y.i.p] ehlo=1 quit=1 commands=2 ^^^^^^^^^^^^^^^^^^^^^^^^^^

Is there anything else I can do to find the error?

Thank you. Florian.

On 6/12/25 05:08, Mark Sapiro wrote:

On 6/11/25 13:51, Florian Sukup wrote:

...

I have now elimiated reverse.rrr.com. But there isn't much change:

vvvvvvvvvvvvvvvvvvvvvvvvv Jun 11 22:19:57 arvak postfix/relay/smtp[1015580]: initializing the client-side TLS engine Jun 11 22:19:57 arvak postfix/smtpd[1015581]: initializing the server-side TLS engine Jun 11 22:19:57 arvak postfix/smtpd[1015581]: connect from host.xxx.com[m.y.i.p] Jun 11 22:19:57 arvak postfix/relay/smtp[1015580]: warning: host host.xxx.com[m.y.i.p]:25 greeted me with my own hostname host.xxx.com Jun 11 22:19:57 arvak postfix/relay/smtp[1015580]: warning: host host.xxx.com[m.y.i.p]:25 replied to HELO/EHLO with my own hostname host.xxx.com Jun 11 22:19:57 arvak postfix/relay/smtp[1015580]: 29FCF5F867: to=<mylists@lists.yyy.com>, relay=host.xxx.com[m.y.i.p]:25, delay=0.2, delays=0.06/0.01/0.13/0, dsn=5.4.6, status=bounced (mail for lists.yyy.com loops back to myself) Jun 11 22:19:57 arvak postfix/smtpd[1015581]: disconnect from host.xxx.com[m.y.i.p] ehlo=1 quit=1 commands=2

I think you need to add host.xxx.com to mydestinations.

I did that now but no change.

When I look into the log, first the smtpd receives the message from my mail client. Then the email is queued. And then the smtp initiates a TLS layer to send it to the smtpd on the same machine. For my understanding this cannot be correct. The smtpd at first should hand it to mailman and not relay it to itself. Is that correct?

Here is the complete log up to the point when the error email is created:

vvvvvvvvvvvvvvvvvvvvvvvvvvvv Jun 12 12:22:24 arvak postfix/smtpd[1197617]: connect from host.xxx.com[192.168.77.100] Jun 12 12:22:24 arvak postfix/smtpd[1197617]: 53E665F8D2: client=host.xxx.com[192.168.77.100] Jun 12 12:22:24 arvak postfix/cleanup[1197827]: 53E665F8D2: message-id=<35c8a748-b410-46a6-91fc-5cee9f31fc39@email.addr> Jun 12 12:22:24 arvak postfix/qmgr[1147234]: 53E665F8D2: from=<my@email.addr>, size=598, nrcpt=1 (queue active) Jun 12 12:22:24 arvak postfix/relay/smtp[1197829]: initializing the client-side TLS engine Jun 12 12:22:24 arvak postfix/smtpd[1197830]: initializing the server-side TLS engine Jun 12 12:22:24 arvak postfix/smtpd[1197830]: connect from host.xxx.com[m.y.i.p] Jun 12 12:22:24 arvak postfix/relay/smtp[1197829]: warning: host host.xxx.com[m.y.i.p]:25 greeted me with my own hostname host.xxx.com Jun 12 12:22:24 arvak postfix/relay/smtp[1197829]: warning: host host.xxx.com[m.y.i.p]:25 replied to HELO/EHLO with my own hostname host.xxx.com Jun 12 12:22:24 arvak postfix/relay/smtp[1197829]: 53E665F8D2: to=<mylists@lists.yyy.com>, relay=host.xxx.com[m.y.i.p]:25, delay=0.31, delays=0.12/0.01/0.18/0, dsn=5.4.6, status=bounced (mail for lists.yyy.com loops back to myself) Jun 12 12:22:24 arvak postfix/smtpd[1197830]: disconnect from host.xxx.com[m.y.i.p] ehlo=1 quit=1 commands=2

On 6/12/25 19:48, Mark Sapiro wrote:

That is not correct. Postfix should receive the initial connect and smtp for the list and then transport_maps should tell it to relay the message via lmtp to the configured lmtp_host and lmtp_port (127.0.0.1:8024 per your previously posted mailman.cfg). You have also posted that Postfix main.cf contains

transport_maps = hash:/var/lib/mailman3/data/postfix_lmtp

What is the content of that file? In particular does it contain

mylists@lists.yyy.com                        lmtp:[127.0.0.1]:8024

Yes, that's exactly the case.

and is the timestamp of /var/lib/mailman3/data/postfix_lmtp.db >= that of /var/lib/mailman3/data/postfix_lmtp, and have you restarted/reloaded Postfix since updating main.cf? And, is Mailman core running and listening on port 8024?

# ls -rtl total 296 -rw-rw---- 1 list list 270336 Jun 8 21:58 mailman.db -rw-rw---- 1 list list 1123 Jun 12 08:43 postfix_lmtp -rw-rw---- 1 list list 367 Jun 12 08:43 postfix_domains -rw-r----- 1 list list 12288 Jun 12 08:43 postfix_lmtp.db -rw-r----- 1 list list 12288 Jun 12 08:43 postfix_domains.db

# lsof -i :8024 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME python3 1146914 list 23u IPv4 78503106 0t0 TCP localhost:8024 (LISTEN)

I always restart mailman3 after changing main.cf

if there is any interest, postfix_domains contains this line:

lists.yyy.com lists.yyy.com

Florian.

On 6/13/25 01:58, Mark Sapiro wrote:

On 6/12/25 15:05, Florian Sukup wrote:

...

I always restart mailman3 after changing main.cf

I asked if you restarted/reloaded Postfix. I would assume that you had,

Sorry, I meant postfix which I restart after changing main.cf or master.cf.

but I'm at a loss to understand the issue, unless your /etc/postfix/master.cf is missing an uncommented entry for lmtp like

lmtp      unix  -       -       y       -       -       lmtp

I found it there, here is my master.cf: vvvvvvvvvvvvvvvvvvvvvvvvvvvvvv smtp inet n - y - - smtpd submission inet n - y - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth -o smtpd_tls_auth_only=yes -o smtpd_reject_unlisted_recipient=no pickup unix n - y 60 1 pickup cleanup unix n - y - 0 cleanup qmgr unix n - n 300 1 qmgr tlsmgr unix - - y 1000? 1 tlsmgr rewrite unix - - y - - trivial-rewrite bounce unix - - y - 0 bounce defer unix - - y - 0 bounce trace unix - - y - 0 bounce verify unix - - y - 1 verify flush unix n - y 1000? 0 flush proxymap unix - - n - - proxymap proxywrite unix - - n - 1 proxymap smtp unix - - y - - smtp relay unix - - y - - smtp -o syslog_name=postfix/$service_name showq unix n - y - - showq error unix - - y - - error retry unix - - y - - error discard unix - - y - - discard local unix - n n - - local virtual unix - n n - - virtual lmtp unix - - y - - lmtp anvil unix - - y - 1 anvil scache unix - - y - 1 scache postlog unix-dgram n - n - 1 postlogd maildrop unix - n n - - pipe flags=DRXhu user=vmail argv=/usr/bin/maildrop -d ${recipient} uucp unix - n n - - pipe flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient) ifmail unix - n n - - pipe flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient) bsmtp unix - n n - - pipe flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient scalemail-backend unix - n n - 2 pipe flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension} mailman unix - n n - - pipe flags=FRX user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user} ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Is the last line a problem? It seems to be from mailman2.

Is there a possibility to debug in more detail? To find out when and where it takes the wrong turn?

The system running has grown over many years and even if the hardware changed the configuration was kept. So there may a flaw outside the postfix/mailman configuration which causes the error, ie. network configuration.

Another thing I can do is to upgrade from bullseye to bookworm. Which I haven't done yet because I was with mailman2/sendmail. That's the reason to change to mailman3/postfix. Since, mailman2 doesn't work anymore I could do it and hope for a miracle ... . This would mean postfix 3.5.25 -> 3.7.11 and mailman3 3.3.3 -> 3.3.8 . That's more an act of desperation.

Thanks for your help, Florian.