I keep getting random "Undelivered Mail Returned to Sender" emails that look like this: [upl-image-preview url=https://community.mailcow.email/assets/files/2024-06-17/1718653604-777893-2024-06-17-21-46-27.png] I didn't send any emails to qq.com but it keeps appearing randomly every 3-10 days. On the mailcow logs on rspamd I keep seeing this being spammed full from the IP "172.22.1.1", when I send email an email myself (for example using K9-Mail) it shows my own IP.[upl-image-preview url=https://community.mailcow.email/assets/files/2024-06-17/1718653830-74423-2024-06-17-21-50-21.png] And on Postfix logs it looks like this: [upl-image-preview url=https://community.mailcow.email/assets/files/2024-06-17/1718653725-18135-2024-06-17-21-48-38.png] I already disabled ipv6 by doing `enable_ipv6: false` and commenting out the ipv6 subnet inside of docker-compose.yml and by setting the ipv6nat in docker-compose.override.yml like on https://docs.mailcow.email/post_installation/firststeps-disable_ipv6 I looked up some stuff and it seemed like an "Open Relay" but when I looked on mxtoolbox it didn't say so. Can someone help me fix/remove this issue?

@"ETNyx"#p16505 I am using ipv6 for other things in my server, seems like enabling ipv6 by reverting the changes fixed the issues!

I do not want to be harbinger of bad news but, from what you wrote I would guess you have been hacked. Ip 172.22.1.1 belongs to inner Mailcow network. So if someone sending from this IP it is probably from inside of docker. Are you regularly upgrading system? Well what to do? You can try to diff files inside container against fresh install, not sure if this will be helpfull.

https://community.mailcow.email/d/2493-server-sending-spam-to-qqcom-once-in-a-while-from-internal-ip-address/10

@"esackbauer"#p16420 For me the docker compose version is already the latest (v2.27.1) if you are meaning that reply.

Well thread suggest you can be open relay over ipv6, sadly I believe mxtoolbox does not test ipv6 for open relay, you will need to test i by your self something like this using telnet ``` +telnet -6 ipv6_address_of_your_server 25 -Trying ... -Connected to ... -Escape character is '^]'. -220-mail.name ESMTP Postcow -220 mail.name ESMTP Postcow +HELO im.test.com -250 mail.name +mail from: -250 2.1.0 Ok +rcpt to: -554 5.7.1 : Relay access denied +QUIT -221 2.0.0 Bye -Connection closed by foreign host. ``` do not copy + and - from start of lines, + is supposed to be write by you - is what is supposed to be response from servr

@"ETNyx"#p16441 It doesn't say "Relay access denied", it just says "250 2.1.5 Ok" at "RCPT TO" when I try connecting to the ipv6 address. Also something I noticed (probably unrelated) is that when I try connecting to the ipv6 address it says "220 mail.playlook.de ESMTP Postcow" but when I try connecting to the ipv4 address of my server it says something about my local ISP: "220 _some domains relating to the ISP_ Swisscom AG ESMTP server ready" and even here it accepts the RCPT TO

> @"chocolateimage"#p16439 is already the latest (v2.27.1) if you are meaning that reply. No, I meant the whole thread. Maybe its an issue with IPv6. > @"chocolateimage"#p16443 but when I try connecting to the ipv4 address of my server it says something about my local ISP: That is strange and I can only imagine that this is due to a transparent NAT rule of your ISP forwarding any packet to your IPv4 Address instead to their own mail service.

@"esackbauer"#p16445 I already tried disabling ipv6 like I said above in my post but no luck.

Yes on IPv4 your ISP is most likely hijacking your traffic, pretty common in my region, but nasty,.. Well most likely you did not disable IPv6 in the proper way. Is there a reason to disable IPv6? Im running Mailcow whit IPv6 just fine,... Any way review your steps a find whats wrong, or I do not know make proper firewall in front that will drop all IPv6 if you cant do it any other way, just be careful UFW and other firewall tools do not play whit Mailcow more whit Docker nicely,... or disable IPv6 on your host interface if you must, better than be open relay,...

@"ETNyx"#p16474 For me ipv6 caused emails not sending properly to some providers like gmail (emails bounced) so I disabled it then email sending worked @"[unknown]"#p16441 I tried actually sending an email with telnet over ipv6 and it seems like I got an email in my inbox without any authorization. In the logs it says: `connect from unknown[172.22.1.1]` so somehow it allowed the ipv6 connection to Postfix even though I disabled it. @"[unknown]"#p16441 I tried actually sending an email with telnet over ipv6 and it seems like I got an email in my inbox without any authorization. In the logs it says: `connect from unknown[172.22.1.1]` so somehow it allowed the ipv6 connection to Postfix even though I disabled it. also sorry for the weird formatting in the message above, seems like the forum bugged out there.

Ok, so you can try to solve why did bounced, or double check you did all necessary steps to disable ipv6 in mailcow stack, i found the docs little bit confusing,.. https://docs.mailcow.email/post_installation/firststeps-disable_ipv6/ If this does not work you can try to disable ipv6 on your hosts it self: This come from my memory double check it on internet and against for your disto,... ```sudo nano /etc/sysctl.conf``` ``` net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 ``` than restart

Random "Undelivered Mail Returned to Sender" emails

esackbauer

chris65 Where should we post it?

Open an issue on github referencing the one above.

chris65

i am not familiar with readable postings, so could you please do it for me in better words? Thank you!

enphor

esackbauer Looks like this is correct. I still have IPv6 disabled on my OS and firewall level and since it is unnecessary for my purposes and will leave it that way. IPv6 continues to be the center of more problems than a solution to them in my experience thus far.

« Previous Page