ontainer mailcowdockerized-unbound-mailcow-1 Error

vigorio

Dear Community,

recently I have ran the update.sh and got this error. No other errors have been reported during the update process. Of course mailcow doesn’t work. I reverted to the previous snapshot of the system and have the 2023-09 mailcow running without issues. I have also pfsense as local resolver. Mailcow is configured to use the pfsense as resolver and it worked for more than a year without issues. I use the docker-compose command. My mailcow VM has 20 GB RAM and 4 cores from Xeon v2699v4. I would appreciate any help.

esackbauer

You don’t have any unbound logs? or docker (compose) logs?

vigorio

esackbauer docker compose logs are:

root@mailcow:/opt/mailcow-dockerized# docker logs mailcowdockerized-unbound-mailcow-1
Setting console permissions…
Receiving anchor key…
Receiving root hints…
######################################################################## 100.0%
setup in directory /etc/unbound
Certificate request self-signature ok
subject=CN = unbound-control
removing artifacts
Setup success. Certificates created. Enable in unbound.conf file to use
[1697404471] unbound[1:0] notice: init module 0: validator
[1697404471] unbound[1:0] notice: init module 1: iterator
[1697404471] unbound[1:0] info: start of service (unbound 1.17.1).
root@mailcow:/opt/mailcow-dockerized#

I don’t have the unbound logs. I reverted to the previous version but I can start over again. How can I get the unbound logs?

esackbauer

Timestamps? is that from the failed try?
And btw that is not the docker compose log. I guess you need to check there for the reason why dependency is not met and then search from there. e.g. why is unbound unhealthy? It is somewhere in the logs.

vigorio

esackbauer Done it again. Hope the logs can help:

mailcowdockerized-unbound-mailcow-1 | Setting console permissions…
mailcowdockerized-unbound-mailcow-1 | Receiving anchor key…
mailcowdockerized-unbound-mailcow-1 | Receiving root hints…
######################################################################## 100.0%
mailcowdockerized-unbound-mailcow-1 | setup in directory /etc/unbound
mailcowdockerized-unbound-mailcow-1 | Certificate request self-signature ok
mailcowdockerized-unbound-mailcow-1 | subject=CN = unbound-control
mailcowdockerized-unbound-mailcow-1 | removing artifacts
mailcowdockerized-unbound-mailcow-1 | Setup success. Certificates created. Enable in unbound.conf file to use
mailcowdockerized-unbound-mailcow-1 | [1697462461] unbound[1:0] notice: init module 0: validator
mailcowdockerized-unbound-mailcow-1 | [1697462461] unbound[1:0] notice: init module 1: iterator
mailcowdockerized-unbound-mailcow-1 | [1697462461] unbound[1:0] info: start of service (unbound 1.17.1).

esackbauer

That is again not the docker compose log… Its the log from within the docker cointainer.

And by the way, there is a reason why unbound should NOT use any forwarders:
https://docs.mailcow.email/manual-guides/u_e-why_unbound/
https://docs.mailcow.email/manual-guides/Unbound/u_e-unbound-fwd/
Read the boxes.

vigorio

esackbauer I have pfBlockerNG running on Pfsense with DNSBL. It should filter spammy IPs and hosts or am I missing something? I am getting the above output by using “docker-compose logs”. Sorry for nooby questions and thank you for your help!

esackbauer

vigorio I have pfBlockerNG running on Pfsense with DNSBL. It should filter spammy IPs and hosts or am I missing something?

Oh dear. A mailserver is not a browser. Remove the DNS forwarders and let unbound and netfilter do its job. Don’t tweak settings you do not fully understand.

vigorio

esackbauer Settings have been reverted to default and the rules in pfsense regarding DNS were disabled too. My system is configured to use strictly pfsense as DNS resolver for all clients inside the network. Still getting the same error with the 2023-10a.

BTW it seems like unbound is starting version 1.17.1 instead of updated 18 could this be the clue?

esackbauer Don’t tweak settings you do not fully understand.

This is a bit confusing since I was not able to install mailcow in my network due to strict firewall rules for DNS.

esackbauer Don’t tweak settings you do not fully understand.

This is a bit confusing since I was not able to install mailcow in my network due to strict firewall rules for DNS.

esackbauer

Then its a better idea to run the mail server in a DMZ…

vigorio BTW it seems like unbound is starting version 1.17.1 instead of updated 18 could this be the clue?

Maybe thats from the last start (before the upgrade)

vigorio

esackbauer Then its a better idea to run the mail server in a DMZ…

I don’t want to buy a 10Gb switch with the VLAN functionality and to pay extra for the electricity. It is expensive in Austria where I am from. I think we are missing the point. If there is a command I can execute to get the desired logs please paste it. Thank you for your help!

esackbauer Maybe thats from the last start (before the upgrade)

No, I have deleted the images and the containers of unbound manually after the upgrade and pulled them back by docker-compose up -d. I get the 1.17.1 in logs instead of 18. For me it starts to seem like rather a bug in mailcow than a misconfig on my side because I have updated over the year without any problems and didn’t touch the docker-compose.override.yml from the very beginning of using the mailcow a year ago.

DocFraggle

vigorio did you somehow modify your docker-compose.yml file? Have a look at the output of

git status

The latest version in 2023-10a should use

    unbound-mailcow:
      image: mailcow/unbound:1.18

So if you’re still running on 1.17.1 there’s something odd

esackbauer

vigorio I don’t want to buy a 10Gb switch with the VLAN functionality and to pay extra for the electricity

I am also in Austria, and I do not run a Xeon like you 😉 My Xeon uses less power.
You get 1G switches which can do VLANs for about 20 euros on Willhaben and they do not consume much power compared to your CPU 😉

vigorio

DocFraggle Here is the log from a fresh install of 2023-10a regarding unbound:

mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 ################################### mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 mailcowdockerized-unbound-mailcow-1 | setup in directory /etc/unbound
| Certificate request self-signature ok
| subject=CN = unbound-control
| removing artifacts
| Setup success. Certificates created. Enable in unbound.conf file to use
| [1697470871] unbound[1:0] notice: init module 0: validator
| [1697470871] unbound[1:0] notice: init module 1: iterator
| [1697470871] unbound[1:0] info: start of service (unbound 1.17.1).
| [1697471678] unbound[1:0] info: service stopped (unbound 1.17.1).
| [1697471678] unbound[1:0] info: server stats for thread 0: 247 queries, 0 answers from cache, 247 recursions, 0 prefetch, 0 rejected by ip ratelimiting
| [1697471678] unbound[1:0] info: server stats for thread 0: requestlist max 4 avg 1.03239 exceeded 0 jostled 0
| [1697471678] unbound[1:0] info: average recursion processing time 0.027722 sec
| [1697471678] unbound[1:0] info: histogram of recursion processing times
| [1697471678] unbound[1:0] info: [25%]=0.00570701 median[50%]=0.00731801 [75%]=0.0128205
| [1697471678] unbound[1:0] info: lower(secs) upper(secs) recursions
| [1697471678] unbound[1:0] info: 0.004096 0.008192 157
| [1697471678] unbound[1:0] info: 0.008192 0.016384 50
| [1697471678] unbound[1:0] info: 0.016384 0.032768 2
| [1697471678] unbound[1:0] info: 0.032768 0.065536 34
| [1697471678] unbound[1:0] info: 0.065536 0.131072 2
| [1697471678] unbound[1:0] info: 1.000000 2.000000 2
| Setting console permissions…
| Receiving anchor key…
| Receiving root hints…
##################################### 100.0%
| setup in directory /etc/unbound
| removing artifacts
| Setup success. Certificates created. Enable in unbound.conf file to use
| [1697530628] unbound[1:0] notice: init module 0: validator
| [1697530628] unbound[1:0] notice: init module 1: iterator
| [1697530628] unbound[1:0] info: start of service (unbound 1.17.1).

As you can see the service is 1.17.1 instead of 1.18

DocFraggle The latest version in 2023-10a should use

unbound-mailcow:
  image: mailcow/unbound:1.18
                if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) {
                    window.hljsLoader.highlightBlocks(document.currentScript.parentNode);
                }

So if you’re still running on 1.17.1 there’s something odd

Absolutely correct. I have the same values. And docker ps shows an 1.18 container running but the container itself seems to run service as 1.17.1.

Looks like it is a bug.

DocFraggle

You are right, I just checked my mailcow, it’s also running on 1.17.1

@DerLinkman should this be unbound 1.18 in your Docker image with tag 1.18 or is it just your version of mailcow/unbound and has no ties to the unbound version?

https://hub.docker.com/layers/mailcow/unbound/1.18/images/sha256-4f7af480ccc263805e5ece0d10c4ad5cd2f4edd16387f341378aa8d488ce4155?context=explore

vigorio

After struggling with my version and new version I found out that the container is unhealthy due to: “DNS resolution is not working correctly…\Maybe check your outbound firewall, as it needs to resolve DNS over TCP AND UDP!”

I don’t have any firewall in the mailcow VM.

I tried to change the version of unbound to 1.18 in docker-compose.yml of 2023-09, it pulled 1.18 and started without any issues. I assume that somehow 2023-10a disrespects the DNS settings in docker-compose.override.yml and this is why the container becomes unhealthy.

Still no solution.

accolon

The unbound health check was added only recently:
mailcow/mailcow-dockerizedeb3be80

All it does is running nslookup mailcow.email 127.0.0.1 inside the unbound container, i.e. asking unbound to resolve mailcow.email.

What happens when you run this command manually inside the unbound container? What do you mean by “DNS settings in docker-compose.override.yml”?

vigorio

Solved. I had to additionally add:

forward-zone:
name: “.”
forward-addr: 192.168.3.1

to my unbound.conf

The official documentation is inconsistent. It offers either Method A and Method B. Instead it both A and B have to be done to use an external DNS.

https://docs.mailcow.email/manual-guides/Unbound/u_e-unbound-fwd/

JERKBALL

vigorio

Thank you for your solution here.. just built up a new mailcow-dockerized instance and just like you unbound did not want to start up…

Adding my DNS just like your unbound config provided.. fixed the whole system and everything works as expected…

so many usecases are covered withing the mailcow.conf… why ain’t there no forwarding option to a local dns?

@esackbauer there won’t be any PR from my side… I have just a big mouth just like you 😉

crahier

Hello,

For an unknown reason, Maildcown doesn’t answer anymore to the port 587, for example.

I stopped and restarted all containers but I found an error

I cheked the status of the unbound container

Another command with the listening ports

I’m completely lost :-( Could you help me ?

Many thanks.

Kind regards,

Christophe