Issue sending mail to all mail.protection.outlook.com domains

acute71

Hi,

I am not able to send mail to maildomains using mail.protection.outlook.com

E.g. to @albeka.nl -

warning: no MX host for albeka.nl has a valid address record

C827460E9B: to=xyz@albeka.nl, relay=none, delay=720, delays=708/0.03/12/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=albeka-nl.mail.protection.outlook.com type=AAAA: Host not found, try again)

I am able to resolve the mx in Postfix -

:/opt/mailcow-dockerized$ sudo docker compose exec postfix-mailcow dig mx albeka.nl

; <<>> DiG 9.18.33-1_deb12u2-Debian <<>> mx albeka.nl
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18379
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;albeka.nl. IN MX

;; ANSWER SECTION:
albeka.nl. 300 IN MX 0 albeka-nl.mail.protection.outlook.com.

;; Query time: 20 msec
;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP)
;; WHEN: Fri Oct 03 18:13:08 CEST 2025
;; MSG SIZE rcvd: 91

:/opt/mailcow-dockerized$

as well as in unbound -

:/opt/mailcow-dockerized$ sudo docker compose exec unbound-mailcow dig mx albeka.nl

; <<>> DiG 9.18.34 <<>> mx albeka.nl
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22829
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;albeka.nl. IN MX

;; ANSWER SECTION:
albeka.nl. 300 IN MX 0 albeka-nl.mail.protection.outlook.com.

;; Query time: 15 msec
;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP)
;; WHEN: Fri Oct 03 18:14:02 CEST 2025
;; MSG SIZE rcvd: 91

:/opt/mailcow-dockerized$

Also ping is working -

:/opt/mailcow-dockerized$ ping albeka-nl.mail.protection.outlook.com
PING albeka-nl.mail.protection.outlook.com (52.101.73.8) 56(84) bytes of data.
64 bytes from mail-am0pr04cu00500.inbound.protection.outlook.com (52.101.73.8): icmp_seq=1 ttl=118 time=2.69 ms
64 bytes from mail-am0pr04cu00500.inbound.protection.outlook.com (52.101.73.8): icmp_seq=2 ttl=118 time=2.64 ms
64 bytes from mail-am0pr04cu00500.inbound.protection.outlook.com (52.101.73.8): icmp_seq=3 ttl=118 time=2.66 ms
^C
— albeka-nl.mail.protection.outlook.com ping statistics —
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 2.641/2.660/2.685/0.018 ms
:/opt/mailcow-dockerized$

I have no idea where to look next.

esackbauer

Name service error for name=albeka-nl.mail.protection.outlook.com type=AAAA:

MX record is not the problem. Unbound is trying to resolve an IPv6 address, maybe due to IPv6
misconfiguration of your mailcow host?
Look at unbound logs.
Or disable IPv6 totally in mailcow.

acute71 Also ping is working -

You are using your mailcows host DNS configuration, returning IPv4 address, not unbound container as the mailcow containers use.

acute71

As far as I know ipv6 is already disabled.

The last 2 lines of my mailcow.conf (file located in /opt/mailcow-dockerized) -

SKIP_OLEFY=n
ENABLE_IPV6=false

Edit: I checked the sysctl and executed the commands to disable ipv6. I will test to check if that fixes it.

root@srv01dmz:/opt/mailcow-dockerized/data/conf/postfix# sudo sysctl net.ipv6.conf.all.disable_ipv6 net.ipv6.conf.default.disable_ipv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

Still same error 🙁

acute71

I send a mail to my own Microsoft email address -

Same error.

From the unbound log -

unbound-mailcow-1 | [1759519131] unbound[19:0] debug: iterator[module 2] operate: extstate:module_wait_reply event:module_event_noreply
unbound-mailcow-1 | [1759519131] unbound[19:0] info: iterator operate: query iamgigi.mail.protection.outlook.com. A IN
unbound-mailcow-1 | [1759519131] unbound[19:0] info: processQueryTargets: iamgigi.mail.protection.outlook.com. A IN
unbound-mailcow-1 | [1759519131] unbound[19:0] info: sending query: iamgigi.mail.protection.outlook.com. A IN
unbound-mailcow-1 | [1759519131] unbound[19:0] debug: sending to target: <mail.protection.outlook.com.> 104.47.34.49#53
unbound-mailcow-1 | [1759519131] unbound[19:0] debug: cache memory msg=125593 rrset=319891 infra=71022 val=92225 subnet=74536
unbound-mailcow-1 | [1759519131] unbound[19:0] debug: iterator[module 2] operate: extstate:module_wait_reply event:module_event_noreply
unbound-mailcow-1 | [1759519131] unbound[19:0] info: iterator operate: query iamgigi.mail.protection.outlook.com. A IN
unbound-mailcow-1 | [1759519131] unbound[19:0] info: processQueryTargets: iamgigi.mail.protection.outlook.com. A IN
unbound-mailcow-1 | [1759519131] unbound[19:0] info: sending query: iamgigi.mail.protection.outlook.com. A IN
unbound-mailcow-1 | [1759519131] unbound[19:0] debug: sending to target: <mail.protection.outlook.com.> 104.47.34.49#53
unbound-mailcow-1 | [1759519131] unbound[19:0] debug: cache memory msg=125593 rrset=319891 infra=71022 val=92225 subnet=74536
unbound-mailcow-1 | [1759519131] unbound[19:0] debug: iterator[module 2] operate: extstate:module_wait_reply event:module_event_noreply
unbound-mailcow-1 | [1759519131] unbound[19:0] info: iterator operate: query iamgigi.mail.protection.outlook.com. A IN
unbound-mailcow-1 | [1759519131] unbound[19:0] info: processQueryTargets: iamgigi.mail.protection.outlook.com. A IN
unbound-mailcow-1 | [1759519131] unbound[19:0] debug: out of query targets – returning SERVFAIL
unbound-mailcow-1 | [1759519131] unbound[19:0] debug: return error response SERVFAIL
unbound-mailcow-1 | [1759519131] unbound[19:0] debug: validator[module 1] operate: extstate:module_wait_module event:module_event_moddone
unbound-mailcow-1 | [1759519131] unbound[19:0] info: validator operate: query iamgigi.mail.protection.outlook.com. A IN
unbound-mailcow-1 | [1759519131] unbound[19:0] debug: subnetcache[module 0] operate: extstate:module_wait_module event:module_event_moddone
unbound-mailcow-1 | [1759519131] unbound[19:0] info: subnetcache operate: query iamgigi.mail.protection.outlook.com. A IN
unbound-mailcow-1 | [1759519131] unbound[19:0] debug: cache memory msg=125593 rrset=319891 infra=71022 val=92225 subnet=74536
unbound-mailcow-1 | [1759519131] unbound[19:0] debug: iterator[module 2] operate: extstate:module_wait_reply event:module_event_noreply
unbound-mailcow-1 | [1759519131] unbound[19:0] info: iterator operate: query iamgigi.mail.protection.outlook.com. A IN
unbound-mailcow-1 | [1759519131] unbound[19:0] info: processQueryTargets: iamgigi.mail.protection.outlook.com. A IN
unbound-mailcow-1 | [1759519131] unbound[19:0] info: sending query: iamgigi.mail.protection.outlook.com. A IN
unbound-mailcow-1 | [1759519131] unbound[19:0] debug: sending to target: <mail.protection.outlook.com.> 104.47.72.81#53
unbound-mailcow-1 | [1759519131] unbound[19:0] debug: cache memory msg=125593 rrset=319891 infra=71022 val=92225 subnet=74536

I have no issues sending mail to non outlook domains. To gmail email addresses as an example is working fine.

esackbauer

Looks like you or a firewall or your hoster or something in between your mailcow and the internet are blocking the requests to the authorative name servers that resolve outlook.com.

acute71

In the traffic log of my Palo Alto vm I see a number of dns sessions from the mailserver were traffic is send to servers on the internet, but no answer is received. I’m afraid it is an issue I cannot fix. I have to find a workaround for this, a mailserver which cannot send mail to some frequently used domains is not much of a mailserver.

Thanks.

esackbauer

If there are outbound firewall rules somewhere, make sure port 53 is allowed for both UDP and TCP.

As a last resort, you could try to use DNS servers from you provider:
https://docs.mailcow.email/manual-guides/Unbound/u_e-unbound-fwd/
But it has implications on RBL checks, and must be a DNSSEC capable resolver.

acute71

When using 1.1.1.1 as an alternative dns server I can send mail to my onmicrosoft account again. Next step will probably to set up a second mailcow server and use that for testing (I do not want to mess around with my main mailserver 😉

Thanks for your help!

gomez77

Hello,

Thanks for all the hints. I solved my issue temperaly but the root cause was the wrong MTU settings.

Maybe you check it too?
https://community.mailcow.email/d/5464-cannot-start-tls-handshake-failure-gmx-web