Re: qmail-remote crashed.

On 2/18/19 2:12 PM, Rejaine Silveira Monteiro wrote:
> Hi , John J.
> 
> I renamed all files * .pem, restart qmail, and all pending emails for
> outlook.com were delivered. I'm still trying to understand what
> happened ...  I'll going to do a test generating the keys again (I
> believe that the ones that were in use were only copied from the
> previous server and not generated again)
> 
> thanks!

As many have often pointed out as well as John Simpson himself, having a 
publicly facing mail server is a significant effort.  At the time John's 
patch was maintained that was true and it's even more so today.  Unless 
you are investing quite a bit of time with it, you'll be likely to have 
delivery problems at some point.  As Erwin's suggestions may have given 
the hint to you, TLS today is a moving target for creating 
interoperability problems.

clientcert.pem is for qmail-remote.  servercert.pem is for qmail-smtpd 
so if that has also been renamed you have disabled TLS for qmail-smtpd also.

-
John J.


> Em seg, 18 de fev de 2019 às 15:33, John Johnstone
> <[email protected]> escreveu:
>>
>> On 2/18/19 12:26 PM, Rejaine Silveira Monteiro wrote:
>>> Helo Erwin
>>>
>>> I'm not using TLS and using qmail-1.03-jms1-7.10.patch  (FORCE_TLS=0
>>> and DENY_TLS=1)
>>
>> I can't offer much help with specific ideas for a solution but I can
>> offer some advice about where not to look.
>>
>> In John Simpson's patch FORCE_TLS and DENY_TLS are only used by
>> qmail-smtpd.  They are not used elsewhere.
>>
>>> anyway, I created the tlsdestinations file as you indicated, but it
>>> did not work.
>>>
>>> the only problem is with clients using mail.protection.outlook.com
>>>
>>> in the link below you can read that there may be problems with new
>>> ips, due to some "policy reputation" stuff  (our mta ip was changed
>>> last nigth)  and maybe that is why we can not send it there ..
>>>
>>> https://docs.microsoft.com/pt-br/office365/securitycompliance/removing-a-user-domain-or-ip-address-from-a-block-list-after-sending-spam-email
>>
>> If there is a problem with your IP addresses or domain names being
>> acceptable to Microsoft you will be seeing 4yz or 5yz SMTP reply errors
>> returned by them to you.  Those errors will be in your qmail-send log
>> files.  Those problems wouldn't cause qmail-remote to crash.
>>
>>> I publish SPF, but not DMARC or DKIM ... so I guess I'll have to wait
>>> a little longer ..
>>
>> Any changes with SPF, DKIM, etc will not make a difference with
>> qmail-remote crashing.
>>
>> If you have /var/qmail/control/clientcert.pem you can rename that file
>> out of the way so that qmail-remote won't use it.  It will effectively
>> disable TLS for qmail-remote.  Just be aware that without TLS you may
>> have delivery problems with certain destinations since some will only
>> accept mail transferred with TLS.
>>
>> -
>> John J.
>