Hey @guinan - Just signed up on tenforward.social as I am planning to migrate over, however the confirmation email doesn't seem to be arriving... I don't seen any delivery attempts in my mail server logs either.

Some delays expected here? (It's been 30 minutes)

@Routhinator

it appears your mail server is broken see following:

relay=mx01.mail.routh.io[172.105.2.183]:25, delay=391, delays=389/0/2.3/0, dsn=4.7.8, status=deferred (SASL authentication failed; server mx01.mail.routh.io[172.105.2.183] said: 535 5.7.8 Error: authentication failed: )

my mail server shouldn't be trying to SASL auth

(sorry for the late reply, I have mastodon.social silenced so I didn't see your mention until I manually looked up your profile)

@guinan that is odd. Thanks for that feedback, I'll take a look at it.

@guinan

Looking at that message I have a feeling this Haiku is about to become very relevant.

@Routhinator lol, did you have the wrong MX record or A record for the MX hostname set?

@guinan no that message is frequently sent to remote servers when the reverse DNS lookups on my mailserver have exhausted DNS hits for the hour. Happens when spammers hit the server at times. I have a cache layer I'm prepared to deploy on my kube cluster for this, however Linode's LKE has a timed job that forcibly overwrites the CoreDNS config on their clusters, so until they remedy this implementation there's no way for me to deploy my cache.

As I "fix" I had disabled reverse lookups...

@Routhinator ah interesting, let me know when I can resend the message
@guinan Just to help me narrow down the logs (I have 5x pods across 5 hosts to tail here) what is the domain of your mail server? Still tenforward.social?

@Routhinator yep

the mail server IP is 96.126.113.89, RDNS is deirdre.asininetech.net

@guinan Very strange. I cannot find record of your server in my logs. I do see SASL failures with no password attempt, but I can't make sense of it. It seems like the remote is attempting a relay. I've bounced all nodes and tried several tests, and had a few people send me emails, and all came through. Genuinely confused about whats going.

Can you resend and this time send the reject along with a timestamp+timezone so I can correlate log lines?

@Routhinator resent

Apr 29 21:49:42

relay=mx01.mail.routh.io[172.105.2.183]:25, delay=3487, delays=3479/0.01/8.5/0, dsn=4.7.8, status=deferred (SASL authentication failed; server mx01.mail.routh.io[172.105.2.183] said: 535 5.7.8 Error: authentication failed: )

my server's timezone is UTC, no offsets

@guinan

Interesting.. my server definitely seems to think yours is attempting SASL auth with no auth.. couldn't verify earlier because of proxy IPs masking the attempt.

Apr 29 21:49:42 mx01 postfix/smtpd[122]: warning: unknown[10.2.0.1]: SASL PLAIN authentication failed:
Apr 29 21:49:42 mx01 postfix/smtpd[122]: disconnect from unknown[10.2.0.1] ehlo=2 starttls=1 auth=0/1 quit=1 commands=4/5

Digging to try and see why.

@guinan And then suddenly, 1 minute ago - everything came in without issue. Weird.

@Routhinator I figured it out.

smtp_sasl_auth_enable = yes

this was set in my /etc/postfix/main.cf

but the interesting thing is that, this doesn't cause an issue for other mail servers (gmail.com, fastmail.com, yahoo.com etc.) so I'm guessing the issue here is that your mail server is offering SASL auth on port 25, which causes my server to try it.

You should have your confirmation mails now.

@guinan Heh, yep they all came in. I'll have to review why SASL auth is offered on 25, I seem to remember why and I seem to recall it only works if the server uses STARTTLS.
@Routhinator I'm glad this issue cropped up tbh, my postfix config didn't need SASL auth enabled, it was leftover back from when I used AWS SES to send instance mail
@guinan I actually use AWS SES to send instance mail due to poor repuation on affordable providers like DO and Linode. Still not clear why I am offering SASL auth on 25, but it appears it may be a global setting across 25 and 587...
@guinan Aha, found it. Needed to override in master.cf for that port. TIL.