There are some domains that will resolve on the unbound container that will not resolve on the postfix container. An example is **mailcow.email**. I tried to sign up for this forum and I never got the email. I looked in the postfix logs and saw this: ``` 6/29/2020, 11:55:28 AM info disconnect from hosted.mailcow.de[5.1.76.202] ehlo=2 starttls=1 mail=1 rcpt=0/1 data=0/1 rset=1 quit=1 commands=6/8 6/29/2020, 11:55:28 AM info NOQUEUE: reject: RCPT from hosted.mailcow.de[5.1.76.202]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo= 6/29/2020, 11:54:57 AM info Anonymous TLS connection established from hosted.mailcow.de[5.1.76.202]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) 6/29/2020, 11:54:57 AM info connect from hosted.mailcow.de[5.1.76.202] ``` What the heck do you mean "Domain not found"? I was just on the web site! Does mailcow.email resolve on the postfix container? ``` root@my_server:/opt/mailcow-dockerized# docker-compose exec postfix-mailcow /bin/bash root@my_server:/# nslookup mailcow.email Server: 127.0.0.11 Address: 127.0.0.11#53 ** server can't find mailcow.email: SERVFAIL root@my_server:/# ``` Nope. Can other domains be resolved on the postfix container? ``` root@my_server:/# nslookup google.com Server: 127.0.0.11 Address: 127.0.0.11#53 Non-authoritative answer: Name: google.com Address: 172.217.3.174 Name: google.com Address: 2607:f8b0:400a:808::200e root@my_server:/# ``` Yup. OK, will **mailcow.email** resolve on the unbound container? ``` root@my_server:/opt/mailcow-dockerized# docker-compose exec unbound-mailcow /bin/bash bash-5.0# nslookup mailcow.email Server: 127.0.0.11 Address: 127.0.0.11#53 Non-authoritative answer: Name: mailcow.email Address: 5.1.76.57 Name: mailcow.email Address: 2a00:f820:417::e12:892d bash-5.0# ``` Works just fine. So why doesn't it resolve on the postfix container?

Well, this problem went away after I switched to a new server at a new hosting company and now I can resolve everything (including mailcow.email - no more gmail for my mailcow community :-).

problem with unbound

Proton2

Hi,
I know that i’m diggin up an old thread, but this is the only one i found, with the same problem i have.
I’m having trouble with mailcow - mails to recipient that have MX servers in mail.protection.outlook.com domain.
Problem is that ip address is not resolved and all messages to those recipients are deffered.
Error in queue
status=deferred (Host or domain name not found. Name service
error for name=podravka-pl.mail.protection.outlook.com type=A: Host
not found, try again)

I did a simple dns query:
docker-compose exec postfix-mailcow nslookup podravka-pl.mail.protection.outlook.com
Server: 127.0.0.11
Address: 127.0.0.11#53

** server can’t find podravka-pl.mail.protection.outlook.com: SERVFAIL

but on unbound-mailcow container everything works fine
docker-compose exec unbound-mailcow nslookup podravka-pl.mail.protection.outlook.com
Server: 127.0.0.11
Address: 127.0.0.11:53

Non-authoritative answer:
Name: podravka-pl.mail.protection.outlook.com
Address: 104.47.6.36
Name: podravka-pl.mail.protection.outlook.com
Address: 104.47.4.36

Docker is installed on Ubuntu 20.04.1 LTS server.
For now i’ve user docker-compose.override for external dns and it works fine.

Anyone has any idea where might be the problem?

Sławek

Proton2

Strange - i’m replaying to myself 🙂
I installed PDNS Recursor on other machine in my netowrk and pointed all mailcow containers to it, and everything works ok.

HDS-Admin

Proton2 Could you please explain how to direct mailcow containers to another DNS server? I have a recursive DNS server running on another machine i can use.

jcb565

I am having this exact same issue. All emails to outlook fail to resolve the DNS. I can resolve the address if i dumb it down to just “outlook.com” in the test code Proton 2 posted above. but once your add the rest of the string, it fails in postfix. Unbound, however, does work.

So do we fix what is broken in postfix? or do we just setup another recursive dns server Like Proton2? I actually have another recursive DNS server running in my network (pihole) already. could someone give me instructions on how to use that instead?

Side question. Why is postfix so handicapped with outlook. Did someone modify the source code to make it hard to use with outlook? geez.

diekuh

What is broken with Postfix? Can you please explain?

jcb565

diekuh postfix wont resolve outlook domains. WHen you email an outlook recipent, it has to resolve “domain-com.protection.mail.outlook.com” and postfix refuses to do it. “domain-com” is the domain of whomever you emailed. I dont know, techncially speaking, why this happens. All i know is that postfix dns queries to that domain fail with a time out or SERVFAIL error.

diekuh

That’s not true.

Perhaps you are filtering tcp/53 or have a wrong MTU.
There is no problem resolving these domains on any mailcow we manage. :/

jcb565

diekuh

what do you mean its not true? Of course its true. The guy above me posted the exact same problem and had to point postfix to another resolver to fix it. (I dont know how to do that) Unbound is able to resolve it, as well as my pihole, and every other device on my network. Postfix is the only running application that does not. It does resolve “outlook.com” on its own.

Mr_Tom

Having a similar issue with some specific domains (who have previously emailed fine).

Can resolve the domain name fine on the host but not in containers.

If I connect to unbound-mailcow and run the nslookup command I get 2 replies - one says “No answer” the other has the correct IP, but it seems the “No answer” reply is the only being seen by the containers.

HDS-Admin

Same problem. Outlook does not resolve. Fails in postfix only.

Proton2

HDS-Admin
Everything is in the documentation. You have two options:
edit data/conf/unbound/unbound.conf or create docker-compose.override.yml
check this https://mailcow.github.io/mailcow-dockerized-docs/u_e-unbound-fwd/

HDS-Admin

Proton2 I tried both of those options are neither were successful. I accidentally put the wrong IP address in the first time I did the first option and I ran the “up” command without the “-d” and I could clearly see it failing DNS queries. So that tells me the first option is correctly affecting the DNS server choice. However, when I execute and nslookup, specifically on the postfix container, I still receive the “SERVFAIL” error. Unbound does resolve the address, as well as my host machine.

here is what I see

user@server:/opt/mailcow-dockerized$ sudo docker-compose exec postfix-mailcow nslookup domain-com.mail.protection.outlook.com
Server: 127.0.0.11
Address: 127.0.0.11#53

** server can’t find domain-com.mail.protection.outlook.com: SERVFAIL
`

it looks like the postfix container is using the host machine as its DNS source, but the host machine CAN resolve it. so why isnt postfix working?
Im tempted to modify the compose file and map the postfix container port directly to port 53 of the host. But that might break other things.

I am so confused.

HDS-Admin

@Proton2

this is very strange. 4 days now after I attempted the changes you recommend, neither of which worked, my email has started sending to outlook on its own. This morning when I checked the email for my testing, i had a multitude of the rejected emails that I sent for those test. Sending to outlook was verifiably NOT working on friday, (or saturday, sunday, or monday) and today it started to work.

Explain that.

reinistihovs

Hello, the same happened to me, only postfix container cant resolve outlook domains.
First I updated mailcow to latest release, didnt help..
Second I attached to postfix container and tried resolving the adress using 8.8.8.8, then it works, weird huh?

This is an example address, that couldnt be resolved: eurocash1-lv.mail.protection.outlook.com.
Heres an example, when using 127.0.0.1, it doenst work

root@dd5b7e9d003f:/# dig a eurocash1-lv.mail.protection.outlook.com @127.0.0.11

; <<>> DiG 9.11.5-P4-5.1+deb10u6-Debian <<>> a eurocash1-lv.mail.protection.outlook.com @127.0.0.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 30942
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;eurocash1-lv.mail.protection.outlook.com. IN A

;; Query time: 123 msec
;; SERVER: 127.0.0.11#53(127.0.0.11)
;; WHEN: Fri Feb 11 09:50:52 EET 2022
;; MSG SIZE  rcvd: 69

Heres an example using 8.8.8.8:


root@dd5b7e9d003f:/# dig a eurocash1-lv.mail.protection.outlook.com @8.8.8.8

; <<>> DiG 9.11.5-P4-5.1+deb10u6-Debian <<>> a eurocash1-lv.mail.protection.outlook.com @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33801
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;eurocash1-lv.mail.protection.outlook.com. IN A

;; ANSWER SECTION:
eurocash1-lv.mail.protection.outlook.com. 10 IN A 104.47.17.138
eurocash1-lv.mail.protection.outlook.com. 10 IN A 104.47.18.74

;; Query time: 81 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Feb 11 09:52:28 EET 2022
;; MSG SIZE  rcvd: 101

From unbound container, and others it works:

root@pasts:/opt/mailcow-dockerized# docker-compose exec unbound-mailcow nslookup eurocash1-lv.mail.protection.outlook.com
Server:         127.0.0.11
Address:        127.0.0.11:53

Non-authoritative answer:

Non-authoritative answer:
Name:   eurocash1-lv.mail.protection.outlook.com
Address: 104.47.17.74
Name:   eurocash1-lv.mail.protection.outlook.com
Address: 104.47.17.138