Dear Community, recently I have ran the update.sh and got this error. No other errors have been reported during the update process. Of course mailcow doesn't work. I reverted to the previous snapshot of the system and have the 2023-09 mailcow running without issues. I have also pfsense as local resolver. Mailcow is configured to use the pfsense as resolver and it worked for more than a year without issues. I use the docker-compose command. My mailcow VM has 20 GB RAM and 4 cores from Xeon v2699v4. I would appreciate any help. [upl-image-preview url=https://community.mailcow.email/assets/files/2023-10-16/1697451844-346418-bildschirmfoto-2023-10-16-um-111535.png] [upl-image-preview url=https://community.mailcow.email/assets/files/2023-10-16/1697451844-491755-bildschirmfoto-2023-10-16-um-111554.png]

You don't have any unbound logs? or docker (compose) logs?

Timestamps? is that from the failed try? And btw that is not the docker compose log. I guess you need to check there for the reason why dependency is not met and then search from there. e.g. why is unbound unhealthy? It is somewhere in the logs.

@"esackbauer"#p10971 Done it again. Hope the logs can help: mailcowdockerized-unbound-mailcow-1 | Setting console permissions... mailcowdockerized-unbound-mailcow-1 | Receiving anchor key... mailcowdockerized-unbound-mailcow-1 | Receiving root hints... ######################################################################## 100.0% mailcowdockerized-unbound-mailcow-1 | setup in directory /etc/unbound mailcowdockerized-unbound-mailcow-1 | Certificate request self-signature ok mailcowdockerized-unbound-mailcow-1 | subject=CN = unbound-control mailcowdockerized-unbound-mailcow-1 | removing artifacts mailcowdockerized-unbound-mailcow-1 | Setup success. Certificates created. Enable in unbound.conf file to use mailcowdockerized-unbound-mailcow-1 | [1697462461] unbound[1:0] notice: init module 0: validator mailcowdockerized-unbound-mailcow-1 | [1697462461] unbound[1:0] notice: init module 1: iterator mailcowdockerized-unbound-mailcow-1 | [1697462461] unbound[1:0] info: start of service (unbound 1.17.1).

That is again not the docker compose log... Its the log from within the docker cointainer. And by the way, there is a reason why unbound should NOT use any forwarders: https://docs.mailcow.email/manual-guides/u_e-why_unbound/ https://docs.mailcow.email/manual-guides/Unbound/u_e-unbound-fwd/ Read the boxes.

@"esackbauer"#p10974 I have pfBlockerNG running on Pfsense with DNSBL. It should filter spammy IPs and hosts or am I missing something? I am getting the above output by using "docker-compose logs". Sorry for nooby questions and thank you for your help!

> @"vigorio"#p10976 I have pfBlockerNG running on Pfsense with DNSBL. It should filter spammy IPs and hosts or am I missing something? Oh dear. A mailserver is not a browser. Remove the DNS forwarders and let unbound and netfilter do its job. Don't tweak settings you do not fully understand.

@"esackbauer"#p10978 Settings have been reverted to default and the rules in pfsense regarding DNS were disabled too. My system is configured to use strictly pfsense as DNS resolver for all clients inside the network. Still getting the same error with the 2023-10a. BTW it seems like unbound is starting version 1.17.1 instead of updated 18 could this be the clue? > @"esackbauer"#p10978 Don’t tweak settings you do not fully understand. This is a bit confusing since I was not able to install mailcow in my network due to strict firewall rules for DNS. > @"esackbauer"#p10978 Don’t tweak settings you do not fully understand. This is a bit confusing since I was not able to install mailcow in my network due to strict firewall rules for DNS.

Then its a better idea to run the mail server in a DMZ... > @"vigorio"#p10979 BTW it seems like unbound is starting version 1.17.1 instead of updated 18 could this be the clue? Maybe thats from the last start (before the upgrade)

> @"esackbauer"#p10983 Then its a better idea to run the mail server in a DMZ… I don't want to buy a 10Gb switch with the VLAN functionality and to pay extra for the electricity. It is expensive in Austria where I am from. I think we are missing the point. If there is a command I can execute to get the desired logs please paste it. Thank you for your help! > @"esackbauer"#p10983 Maybe thats from the last start (before the upgrade) No, I have deleted the images and the containers of unbound manually after the upgrade and pulled them back by docker-compose up -d. I get the 1.17.1 in logs instead of 18. For me it starts to seem like rather a bug in mailcow than a misconfig on my side because I have updated over the year without any problems and didn't touch the docker-compose.override.yml from the very beginning of using the mailcow a year ago.

ontainer mailcowdockerized-unbound-mailcow-1 Error

DocFraggle

vigorio did you somehow modify your docker-compose.yml file? Have a look at the output of

git status

The latest version in 2023-10a should use

    unbound-mailcow:
      image: mailcow/unbound:1.18

So if you’re still running on 1.17.1 there’s something odd

vigorio

DocFraggle Here is the log from a fresh install of 2023-10a regarding unbound:

mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 ################################### mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 | setup in directory /etc/unbound
| Certificate request self-signature ok
| subject=CN = unbound-control
| removing artifacts
| Setup success. Certificates created. Enable in unbound.conf file to use
| [1697470871] unbound[1:0] notice: init module 0: validator
| [1697470871] unbound[1:0] notice: init module 1: iterator
| [1697470871] unbound[1:0] info: start of service (unbound 1.17.1).
| [1697471678] unbound[1:0] info: service stopped (unbound 1.17.1).
| [1697471678] unbound[1:0] info: server stats for thread 0: 247 queries, 0 answers from cache, 247 recursions, 0 prefetch, 0 rejected by ip ratelimiting
| [1697471678] unbound[1:0] info: server stats for thread 0: requestlist max 4 avg 1.03239 exceeded 0 jostled 0
| [1697471678] unbound[1:0] info: average recursion processing time 0.027722 sec
| [1697471678] unbound[1:0] info: histogram of recursion processing times
| [1697471678] unbound[1:0] info: [25%]=0.00570701 median[50%]=0.00731801 [75%]=0.0128205
| [1697471678] unbound[1:0] info: lower(secs) upper(secs) recursions
| [1697471678] unbound[1:0] info: 0.004096 0.008192 157
| [1697471678] unbound[1:0] info: 0.008192 0.016384 50
| [1697471678] unbound[1:0] info: 0.016384 0.032768 2
| [1697471678] unbound[1:0] info: 0.032768 0.065536 34
| [1697471678] unbound[1:0] info: 0.065536 0.131072 2
| [1697471678] unbound[1:0] info: 1.000000 2.000000 2
| Setting console permissions…
| Receiving anchor key…
| Receiving root hints…
##################################### 100.0%
| setup in directory /etc/unbound
| removing artifacts
| Setup success. Certificates created. Enable in unbound.conf file to use
| [1697530628] unbound[1:0] notice: init module 0: validator
| [1697530628] unbound[1:0] notice: init module 1: iterator
| [1697530628] unbound[1:0] info: start of service (unbound 1.17.1).

As you can see the service is 1.17.1 instead of 1.18

DocFraggle The latest version in 2023-10a should use

unbound-mailcow:
  image: mailcow/unbound:1.18
                if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) {
                    window.hljsLoader.highlightBlocks(document.currentScript.parentNode);
                }

So if you’re still running on 1.17.1 there’s something odd

Absolutely correct. I have the same values. And docker ps shows an 1.18 container running but the container itself seems to run service as 1.17.1.

Looks like it is a bug.

DocFraggle

You are right, I just checked my mailcow, it’s also running on 1.17.1

@DerLinkman should this be unbound 1.18 in your Docker image with tag 1.18 or is it just your version of mailcow/unbound and has no ties to the unbound version?

https://hub.docker.com/layers/mailcow/unbound/1.18/images/sha256-4f7af480ccc263805e5ece0d10c4ad5cd2f4edd16387f341378aa8d488ce4155?context=explore

esackbauer

vigorio I don’t want to buy a 10Gb switch with the VLAN functionality and to pay extra for the electricity

I am also in Austria, and I do not run a Xeon like you 😉 My Xeon uses less power.
You get 1G switches which can do VLANs for about 20 euros on Willhaben and they do not consume much power compared to your CPU 😉

vigorio

After struggling with my version and new version I found out that the container is unhealthy due to: “DNS resolution is not working correctly…\Maybe check your outbound firewall, as it needs to resolve DNS over TCP AND UDP!”

I don’t have any firewall in the mailcow VM.

I tried to change the version of unbound to 1.18 in docker-compose.yml of 2023-09, it pulled 1.18 and started without any issues. I assume that somehow 2023-10a disrespects the DNS settings in docker-compose.override.yml and this is why the container becomes unhealthy.

Still no solution.

accolon

The unbound health check was added only recently:
mailcow/mailcow-dockerizedeb3be80

All it does is running nslookup mailcow.email 127.0.0.1 inside the unbound container, i.e. asking unbound to resolve mailcow.email.

What happens when you run this command manually inside the unbound container? What do you mean by “DNS settings in docker-compose.override.yml”?

vigorio

Solved. I had to additionally add:

forward-zone:
name: “.”
forward-addr: 192.168.3.1

to my unbound.conf

The official documentation is inconsistent. It offers either Method A and Method B. Instead it both A and B have to be done to use an external DNS.

https://docs.mailcow.email/manual-guides/Unbound/u_e-unbound-fwd/

JERKBALL

vigorio

Thank you for your solution here.. just built up a new mailcow-dockerized instance and just like you unbound did not want to start up…

Adding my DNS just like your unbound config provided.. fixed the whole system and everything works as expected…

so many usecases are covered withing the mailcow.conf… why ain’t there no forwarding option to a local dns?

@esackbauer there won’t be any PR from my side… I have just a big mouth just like you 😉

crahier

Hello,

For an unknown reason, Maildcown doesn’t answer anymore to the port 587, for example.

I stopped and restarted all containers but I found an error

I cheked the status of the unbound container

Another command with the listening ports

I’m completely lost :-( Could you help me ?

Many thanks.

Kind regards,

Christophe

esackbauer

Its not only 587, but 25 and 465 are also not bound.
Seems like postfix is not binding. Check the postfix logs.

crahier

Hi,

I installed mailcow to another VPS but I’ve the same issue. It’s a fresh Ubuntu install.

I’m lost, what can I check ? I’m not a Linux expert 😥

When I launch : sudo docker compose up, the last rows are :

mailcowdockerized-nginx-mailcow-1 | 172.22.1.10 - - [14/Dec/2023:11:27:35 +0100] "HEAD /settings.php HTTP/1.1" 304 0 "-" "rspamd-3.7.4" 0 0 0 0 0 0 0 0 --:--:-- 0:00:07 --:--:-- 0curl: (6) Could not resolve host: www.spamassassin.heinlein-support.de mailcowdockerized-dovecot-mailcow-1 | Warning: Problem : timeout. Will retry in 64 seconds. 4 retries left.

Thanks for your help.

Christophe

esackbauer

crahier I’m not a Linux expert

That certainly does not help when installing a complex solution like a mail and groupware server…

Which VPS? Have you read this regarding firewalls? is UFW enabled?
https://docs.mailcow.email/prerequisite/prerequisite-system/

Looks like DNS resolution is broken. Unbound must be able to access the root DNS servers via port 53 UDP and TCP

crahier

esackbauer
I agree with you but my previous install was working very well.

UFW is disabled, the timezone is OK. I check the syslog and I can see :

Dec 14 05:54:48 mail dockerd[8434]: time="2023-12-14T05:54:48.125107650-05:00" level=error msg="[resolver] failed to query DNS server: 172.22.1.254:53, query: ;maps.rspamd.com.\tIN\t AAAA" error="read udp 172.22.1.10:45172->172.22.1.254:53: i/o timeout"

When I stop and restart the unbound container, I’ve this log :

mailcowdockerized-unbound-mailcow-1 | Setting console permissions... mailcowdockerized-unbound-mailcow-1 | Receiving anchor key... mailcowdockerized-nginx-mailcow-1 exited with code 1 mailcowdockerized-unbound-mailcow-1 | Receiving root hints... ######################################################################## 100.0% mailcowdockerized-unbound-mailcow-1 | setup in directory /etc/unbound mailcowdockerized-unbound-mailcow-1 | removing artifacts mailcowdockerized-unbound-mailcow-1 | Setup success. Certificates created. Enable in unbound.conf file to use mailcowdockerized-unbound-mailcow-1 | [1702556295] unbound[1:0] notice: init module 0: validator mailcowdockerized-unbound-mailcow-1 | [1702556295] unbound[1:0] notice: init module 1: iterator mailcowdockerized-unbound-mailcow-1 | [1702556295] unbound[1:0] info: start of service (unbound 1.17.1). mailcowdockerized-ofelia-mailcow-1 | 2023-12-14T13:18:24.037+01:00 common.go:125 ▶ NOTICE [Job "dovecot_imapsync_runner" (298a1e5b720f)] Started - /bin/bash -c "[[ ${MASTER} == y ]] && /usr/local/bin/gosu nobody /usr/local/bin/imapsync_runner.pl || exit 0" mailcowdockerized-ofelia-mailcow-1 | 2023-12-14T13:18:24.068+01:00 common.go:125 ▶ NOTICE [Job "sogo_sessions" (a131ceb5ac1d)] Started - /bin/bash -c "[[ ${MASTER} == y ]] && /usr/local/bin/gosu sogo /usr/sbin/sogo-tool expire-sessions ${SOGO_EXPIRE_SESSION} || exit 0" mailcowdockerized-ofelia-mailcow-1 | 2023-12-14T13:18:24.121+01:00 common.go:125 ▶ NOTICE [Job "sogo_ealarms" (03784b5d940f)] Started - /bin/bash -c "[[ ${MASTER} == y ]] && /usr/local/bin/gosu sogo /usr/sbin/sogo-ealarms-notify -p /etc/sogo/sieve.creds || exit 0" mailcowdockerized-ofelia-mailcow-1 | 2023-12-14T13:18:24.158+01:00 common.go:125 ▶ NOTICE [Job "dovecot_trim_logs" (ea51e8e61764)] Started - /bin/bash -c "[[ ${MASTER} == y ]] && /usr/local/bin/gosu vmail /usr/local/bin/trim_logs.sh || exit 0" mailcowdockerized-ofelia-mailcow-1 | 2023-12-14T13:18:24.701+01:00 common.go:125 ▶ NOTICE [Job "dovecot_imapsync_runner" (298a1e5b720f)] Finished in "664.220126ms", failed: false, skipped: false, error: none mailcowdockerized-ofelia-mailcow-1 | 2023-12-14T13:18:24.872+01:00 common.go:125 ▶ NOTICE [Job "dovecot_trim_logs" (ea51e8e61764)] Finished in "714.334348ms", failed: false, skipped: false, error: none mailcowdockerized-ofelia-mailcow-1 | 2023-12-14T13:18:25.074+01:00 common.go:125 ▶ NOTICE [Job "sogo_sessions" (a131ceb5ac1d)] Finished in "1.006278092s", failed: false, skipped: false, error: none mailcowdockerized-ofelia-mailcow-1 | 2023-12-14T13:18:25.151+01:00 common.go:125 ▶ NOTICE [Job "sogo_ealarms" (03784b5d940f)] Finished in "1.029639711s", failed: false, skipped: false, error: none mailcowdockerized-nginx-mailcow-1 exited with code 1 0 0 0 0 0 0 0 0 --:--:-- 0:00:07 --:--:-- 0curl: (6) Could not resolve host: www.spamassassin.heinlein-support.de mailcowdockerized-dovecot-mailcow-1 | gzip: /tmp/sa-rules-heinlein.tar.gz: No such file or directory mailcowdockerized-dovecot-mailcow-1 | 2023-12-14 13:19:18,201 INFO Set uid to user 0 succeeded mailcowdockerized-dovecot-mailcow-1 | 2023-12-14 13:19:18,207 INFO supervisord started with pid 1 mailcowdockerized-dovecot-mailcow-1 | 2023-12-14 13:19:19,210 INFO spawned: 'processes' with pid 740 mailcowdockerized-dovecot-mailcow-1 | 2023-12-14 13:19:19,217 INFO spawned: 'dovecot' with pid 741 mailcowdockerized-dovecot-mailcow-1 | 2023-12-14 13:19:19,218 INFO spawned: 'syslog-ng' with pid 742 mailcowdockerized-dovecot-mailcow-1 | 2023-12-14 13:19:19,283 INFO exited: dovecot (exit status 89; not expected) mailcowdockerized-dovecot-mailcow-1 | [2023-12-14T13:19:19.301280] WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; mailcowdockerized-dovecot-mailcow-1 | Dec 14 13:19:19 f030bccbdf8c syslog-ng[742]: syslog-ng starting up; version='3.28.1' mailcowdockerized-dovecot-mailcow-1 | 2023-12-14 13:19:20,306 INFO success: processes entered RUNNING state, process has stayed up for > than 1 seconds (startsecs) mailcowdockerized-dovecot-mailcow-1 | 2023-12-14 13:19:20,308 INFO spawned: 'dovecot' with pid 747 mailcowdockerized-dovecot-mailcow-1 | 2023-12-14 13:19:20,308 INFO success: syslog-ng entered RUNNING state, process has stayed up for > than 1 seconds (startsecs) mailcowdockerized-dovecot-mailcow-1 | 2023-12-14 13:19:20,338 INFO exited: dovecot (exit status 89; not expected) dependency failed to start: container mailcowdockerized-unbound-mailcow-1 is unhealthy

Thanks for your help.

Christophe

esackbauer

Are you using DNS forwarders do your DNS server? If so, remove them.

crahier

No, but how could I check that (I’m using Ubuntu) ?

esackbauer

https://docs.mailcow.email/manual-guides/Unbound/u_e-unbound-fwd/
Look at unbound.confand docker-compose.override.yml

crahier

Here are the running services :

xtophe@mail:~$ sudo service --status-all [ - ] apache-htcacheclean [ - ] apache2 [ - ] apparmor [ - ] bind9 [ - ] console-setup.sh [ - ] cron [ + ] dbus [ + ] docker [ - ] exim4 [ - ] fetchmail [ - ] hwclock.sh [ - ] keyboard-setup.sh [ - ] kmod [ ? ] modules_dep.sh [ - ] named [ - ] networking [ + ] procps [ - ] quota [ - ] quotarpc [ - ] rpcbind [ - ] rsync [ - ] saslauthd [ - ] screen-cleanup [ - ] ssh [ + ] udev [ + ] unattended-upgrades [ - ] uuidd [ - ] wide-dhcpv6-client [ + ] xinetd

I reinstalled a fresh Ubuntu. Now, I can see :

xtophe@mail:~$ ss -tlpn | grep -E -w '25|53|80|110|143|443|465|587|993|995|4190' LISTEN 0 128 127.0.0.53%lo:53 0.0.0.0:*

and

xtophe@mail:~$ netstat -lntu Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp6 0 0 :::22 :::* LISTEN udp 0 0 127.0.0.53:53 0.0.0.0:*

Is it OK before installing mailcow ?

esackbauer

nslookup using external DNS servers like 8.8.8.8 is working?

crahier

Yes

`xtophe@mail:~$ nslookup community.mailcow.email
Server: 127.0.0.53
Address: 127.0.0.53#53

Non-authoritative answer:
community.mailcow.email canonical name = web01.kernstock.net.
Name: web01.kernstock.net
Address: 5.1.87.87`

I suppose I can now install mailcow ?

esackbauer

Dont use the local resolver. Use google (8.8.8.8)

crahier

esackbauer This is the result

`xtophe@mail:~$ resolvectl status
Global
Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
resolv.conf mode: stub
Current DNS Server: 1.1.1.1
DNS Servers: 1.1.1.1 8.8.8.8 2001:4860:4860::8888 2001:4860:4860::8844

Link 2 (venet0)
Current Scopes: none
Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

Link 3 (eth0)
Current Scopes: none
Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

Link 5 (docker0)
Current Scopes: none
Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported`

But I still have the same result

`xtophe@mail:~$ nslookup community.mailcow.email
Server: 127.0.0.53
Address: 127.0.0.53#53

Non-authoritative answer:
community.mailcow.email canonical name = web01.kernstock.net.
Name: web01.kernstock.net
Address: 5.1.87.87`

« Previous Page Next Page »