Re: IPv6 recap

Hi Adam,

thanks for sharing your thoughts and experience.

I ended up setting two new IPv6 addresses.  One for outgoing mail, in ip6out 
and SPF record.  The other for incoming, set in esmtpd's PORT variable and 
published as a secondary MX which only has an AAAA address.

Thus far neither happened to be used.  I prefer it so, because people is picky 
about unknown email addresses, and I don't send so much mail as to make my 
address(es) known.  Increasing the number of addresses worsens low volume 
senders reputation.

That differs from IPv6 usage for the web, where I regularly get IPv6 
connection, sometimes reaching percentages as high as 4%.


Best
Ale


On Sat 23/Mar/2024 00:49:52 +0100 Adam Augustine wrote:
> Hello Ale,
> 
> I have some practical experience with IPv6 environments.
> 
> "Is it advisable to use different numbers (in the same /64) for outgoing 
> (ip6out) and incoming MX, esmtpd, esmtpd-msa, esmtpd-ssl, pop3d, pop3d-ssl, 
> imapd and imapd-ssl?"
> 
> Short answer, do whatever makes things easy for you.
> 
> Longer answer:
> Despite what people say about "Everything is different in IPv6!" my experience 
> has been that 90% if not more of everything is exactly the same, just with 
> longer addresses. The remaining 10% or so that does change has mostly to do 
> with how IPv6 addresses get assigned in dynamic environments (cases where you 
> would use DHCP in the IPv4 world). You don't have to use those functions if you 
> don't want to. IPv6 was meant to be a drop-in replacement for IPv4, and it 
> actually works that way, assuming the applications are coded correctly.
> 
> I may or may not have tested IPv6 with Courier a few times on a production 
> system with a light but non-trivial load. It just worked. I may possibly have 
> accidentally left my test running for more than a year or so before someone 
> noticed and said something about the funny addresses.
> 
> If you are already hosting all those services (SMTP, POP, IMAP, and their 
> encrypted counterparts) on a single IPv4 address and that is working for you 
> today, then follow the same operational pattern with IPv6. Think of it like 
> adding another network interface with a second IPv4 address. Would you do 
> anything different from what you are doing today in that scenario? Probably 
> not. So don't change anything and do IPv6 the same way.
> 
> At least, at first. There /is/ a psychological barrier that you are going to 
> need to get over to get used to IPv6, and that barrier is just unfamiliarity. 
> Once you get comfortable and are used to looking at those addresses as normal 
> and fully accept that things work exactly the same as they did with IPv4, start 
> imagining what you could do if you had all the IPv4 addresses you could ever 
> possibly want and could waste them in embarrassing ways. IPv6 gives you that, 
> you just have a longer address.
> 
> If it would makes your life easier to have a separate IPv4 address for each 
> service, then you can do that with IPv6.
> 
> If it would make sense for you to have a separate IP address for /each and 
> every incoming and outgoing connection and never _ever_ re-use that address 
> again/, you can do that with IPv6. And only after 3,928 years would you need 
> another /64 subnet. And that is assuming a 100 gigabit ethernet network and a 
> single 64 byte packet representing each connection. So that's a lower bound.
> 
> It is hard to break out of the "I must conserve" mindset of IPv4, so exercises 
> like that help open the mind to the possibilities.
> 
> One bit of production roll-out advice I would give. You won't get traffic on 
> IPv6 until you publish the "AAAA" equivalent of the DNS "A" record for your MX 
> record. So don't create the "AAAA" record until you are ready to take traffic 
> on your IPv6 address. And when you do, set the TTL to something short (60 
> seconds maybe). That way, if you do make a mistake in the configuration 
> somewhere, you can remove the "AAAA" and figure things out at your leisure. 
> Minimal impact. It is helpful in situations like if you forgot to open the 
> inbound port 25 on IPv6 in addition to the already open port 25 on IPv4 on the 
> firewall. Just an example.
> 
> Anyway, I hope that is at least somewhat useful. And thanks for all the work 
> you do to keep my email flowing. You don't know it, but some of your posts have 
> really helped me over the years.
> 
>   Adam Augustine
> 
> 
> On 3/20/24 09:18, Alessandro Vesely wrote:
>> Hi all,
>>
>> I've always compiled Courier using the --without-ipv6 option.  Now I've got 
>> some IPv6 addresses, so I'd try and enable IPv6 for mail.  In order to keep 
>> behavioral changes to a minimum, I've already set IPv4 preference in 
>> /etc/gai.conf, and will leave courierd's ESMTP_PREFER_IPV6_MX commented out.
>>
>> What else?
>>
>> Is it advisable to use different numbers (in the same /64) for outgoing 
>> (ip6out) and incoming MX, esmtpd, esmtpd-msa, esmtpd-ssl, pop3d, pop3d-ssl, 
>> imapd and imapd-ssl?
>>
>> TIA for any hint
>>
>> Best
>> Ale



_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users