Host or domain name not found. Name service error

invaliduser

With some hosts, I get this error when trying to send emails so far the only hosts I have received this error from are citaq.com and phomemo.com things like gmail.com or another mailcow instance i manage work fine and i can send emails

here is the full error the system emailed me:

This is the mail system at host mail.mydomain.com.

####################################################################
# THIS IS A WARNING ONLY.  YOU DO NOT NEED TO RESEND YOUR MESSAGE. #
####################################################################

Your message could not be delivered for more than 4 hour(s).
It will be retried until it is 5 day(s) old.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

                   The mail system

<info@citaq.com>: Host or domain name not found. Name service error for
    name=citaq.com type=MX: Host not found, try again

and here is what i get in the postfix log:

NNLLLLNLNL: to=<info@citaq.com>, relay=none, delay=10678, delays=10670/0.06/8/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=citaq.com type=MX: Host not found, try again)

piperino

checked the domains in questions and they’re looking fine in terms of their DNS entries.
if this issue still persists you have a DNS issue on your end.

invaliduser

piperino yep they all look fine doing a dig domain MX returns an ip too so im not sure why mailcow is giving this issue

piperino

your host system can resolve the domain/s mx records?
what does:
docker-compose exec postfix-mailcow dig mx citaq.com
do?

invaliduser

piperino

root@vps2:/opt/mailcow-dockerized# docker compose exec postfix-mailcow dig mx citaq.com

; <<>> DiG 9.16.44-Debian <<>> mx citaq.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 51245
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;citaq.com.                     IN      MX

;; Query time: 4004 msec
;; SERVER: 127.0.0.11#53(127.0.0.11)
;; WHEN: Sat Mar 16 20:20:35 GMT 2024
;; MSG SIZE  rcvd: 27

root@vps2:/opt/mailcow-dockerized# dig citaq.com MX

; <<>> DiG 9.16.48-Ubuntu <<>> citaq.com MX
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42630
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;citaq.com.                     IN      MX

;; ANSWER SECTION:
citaq.com.              600     IN      MX      5 mxbiz1.qq.com.
citaq.com.              600     IN      MX      10 mxbiz2.qq.com.

;; Query time: 292 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sat Mar 16 20:21:11 GMT 2024
;; MSG SIZE  rcvd: 87

piperino

invaliduser

same against unbound

docker compose exec unbound-mailcow dig mx citaq.com

invaliduser

piperino yeah i get something from that

root@vps2:/opt/mailcow-dockerized# docker compose exec unbound-mailcow dig mx citaq.com

; <<>> DiG 9.18.19 <<>> mx citaq.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11171
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;citaq.com.                     IN      MX

;; ANSWER SECTION:
citaq.com.              142     IN      MX      10 mxbiz2.qq.com.
citaq.com.              142     IN      MX      5 mxbiz1.qq.com.

;; Query time: 0 msec
;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP)
;; WHEN: Sat Mar 16 20:28:48 GMT 2024
;; MSG SIZE  rcvd: 87

piperino

invaliduser

thats weird. you have restarted the postfix container just for fun, right?🙂
or even better a reboot of the whole system.

invaliduser

piperino yep have done a full reboot a couple of times now

piperino

invaliduser

you haven’t another DNS Server running?

invaliduser

piperino nope setup the server using the routers dns server and then let mailcow do it’s thing

piperino

invaliduser

check this. it could be some sort of network issue on your end. although he had no DNS at all.

https://community.mailcow.email/d/511-dns-stopped-resolving-after-recent-update

invaliduser

piperino it looks like there is something wrong with unbound using its IP to do some lookups on the host and I get this where it times out for the domain

oot@vps2:/opt/mailcow-dockerized# dig @172.22.1.254 gmail.com MX

; <<>> DiG 9.16.48-Ubuntu <<>> @172.22.1.254 gmail.com MX
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5561
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;gmail.com.                     IN      MX

;; ANSWER SECTION:
gmail.com.              1963    IN      MX      40 alt4.gmail-smtp-in.l.google.com.
gmail.com.              1963    IN      MX      5 gmail-smtp-in.l.google.com.
gmail.com.              1963    IN      MX      10 alt1.gmail-smtp-in.l.google.com.
gmail.com.              1963    IN      MX      30 alt3.gmail-smtp-in.l.google.com.
gmail.com.              1963    IN      MX      20 alt2.gmail-smtp-in.l.google.com.

;; Query time: 4 msec
;; SERVER: 172.22.1.254#53(172.22.1.254)
;; WHEN: Sat Mar 16 21:09:08 GMT 2024
;; MSG SIZE  rcvd: 161

root@vps2:/opt/mailcow-dockerized# dig @172.22.1.254 citaq.com MX

; <<>> DiG 9.16.48-Ubuntu <<>> @172.22.1.254 citaq.com MX
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

unbound logs don’t give me anything useful

root@vps2:/opt/mailcow-dockerized# docker logs 37f346ca667e
Setting console permissions...
Receiving anchor key...
Receiving root hints...
######################################################################## 100.0%
setup in directory /etc/unbound
Certificate request self-signature ok
subject=CN = unbound-control
removing artifacts
Setup success. Certificates created. Enable in unbound.conf file to use
[1710621491] unbound[1:0] notice: init module 0: validator
[1710621491] unbound[1:0] notice: init module 1: iterator
[1710621492] unbound[1:0] info: start of service (unbound 1.17.1).
[1710621506] unbound[1:0] info: generate keytag query _ta-4f66. NULL IN

piperino

there is also an issue listed here. unfortunately no solution. it may still worth to read.
Last occurrence on the bottom.
mailcow/mailcow-dockerized3735

you could also try to configure an explicit/external DNS server within unbound. if that fixes your issue you might want to file a bugreport.

https://docs.mailcow.email/manual-guides/Unbound/u_e-unbound-fwd/?h=dns

ahm, and just check your fail2ban blockings. just to be on the safe side.

sigdor

everything is working , running mailcow for years.
i have one MX record that doesnt resolve, but the unbound instance had no problem with this.

docker compose exec unbound-mailcow dig mx1.ahponline.de

; <<>> DiG 9.18.34 <<>> mx1.ahponline.de
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3563
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;mx1.ahponline.de. IN A

;; ANSWER SECTION:
mx1.ahponline.de. 3600 IN A 88.79.202.65

;; Query time: 23 msec
;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP)
;; WHEN: Sun Oct 12 12:33:27 CEST 2025
;; MSG SIZE rcvd: 61
!<
resolve it, but

docker compose exec postfix-mailcow dig mx1.ahponline.de

; <<>> DiG 9.18.33-1_deb12u2-Debian <<>> mx1.ahponline.de
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 4733
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;mx1.ahponline.de. IN A

;; Query time: 0 msec
;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP)
;; WHEN: Sun Oct 12 12:43:30 CEST 2025
;; MSG SIZE rcvd: 34
!<
cant resolve it

a reboot doesnt change anything.

esackbauer

Unbound container uses the hosts DNS settings:

root@mail:/home/chackalacka# cat /var/lib/docker/containers/5c5fe811fe9371ed8ee32ae19e8cfbb952494a6518821431477fdc41fbc82ecf/resolv.conf
# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.

nameserver 127.0.0.11
options ndots:0

# Based on host file: '/etc/resolv.conf' (internal resolver)
# ExtServers: [host(10.0.0.254) host(10.0.0.1)]
# Overrides: []
# Option ndots from: internal

Whereas postfix uses the unbound container as DNS resolver:

root@mail:/home/shackalacka# cat /var/lib/docker/containers/359a86ebbba3282f72b8580ab3184cd52854c10e73c89b6792d1d6a61b93daa9/resolv.conf
# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.

nameserver 127.0.0.11
options ndots:0

# Based on host file: '/etc/resolv.conf' (internal resolver)
# ExtServers: [172.22.1.254]
# Overrides: [nameservers]
# Option ndots from: internal

You should look at the unbound logs.

sigdor

thx,

i am using server from Hetzner.
from different Hetzner Server with different IP, i cant resolve it.

the DNS Server for ahponline.de are “dns.btnet.de,dns2.btnet.de”

nslookup mx1.ahponline.de dns.btnet.de
;; communications error to 195.243.214.4#53: timed out

nslookup mx1.ahponline.de dns2.btnet.de
;; communications error to 213.68.194.51#53: timed out

@Home it is working
nslookup mx1.ahponline.de dns.btnet.de
Server: dns.btnet.de
Address: 195.243.214.4#53

Non-authoritative answer:
Name: mx1.ahponline.de
Address: 88.79.202.65

i think it is not a my problem 🙂
They are blocking Hetzner for DNS request.
I have no firewall restriction for outgoing traffic

esackbauer

sigdor they are blocking Hetzner for DNS request.

I don’t believ so, maybe a firewall topic, maybe something has changed. Check again:
https://docs.mailcow.email/getstarted/prerequisite-system/#important-for-hetzner-firewalls
Unbound needs a lot of ports outgoing.

Also make sure you have proper MTU sizes, there is a thread here somewhere regarding this.

DocFraggle

@esackbauer is right, you have to add these entries to your Hetzner firewall because it’s not a stateful firewall: