Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Suggested DNS records say "110: Operation timed out" for TLSA record #4408

Closed
4 tasks done
mfnalex opened this issue Dec 31, 2021 · 15 comments
Closed
4 tasks done

Suggested DNS records say "110: Operation timed out" for TLSA record #4408

mfnalex opened this issue Dec 31, 2021 · 15 comments
Labels
bug stale Please update the issue with current status, unclear if it's still open/needed.

Comments

@mfnalex
Copy link

mfnalex commented Dec 31, 2021

Prior to placing the issue, please check following: (fill out each checkbox with an X once done)

  • I understand that not following or deleting the below instructions will result in immediate closure and/or deletion of my issue.
  • I have understood that this bug report is dedicated for bugs, and not for support-related inquiries.
  • I have understood that answers are voluntary and community-driven, and not commercial support.
  • I have verified that my issue has not been already answered in the past. I also checked previous issues.

Summary

Hi everyone :)

I get the following suggested DNS record:
image
That obviously isn't what I am actually supposed to enter, I assume :)

Logs

I am not actually sure where to look. I checked the Mailcow UI logs but there was nothing related to this.

Reproduction

Not sure. I have this problems for months and just didn't any TLSA records, but would like to do that now.

System information

Question Answer
My operating system Debian 10.11 4.19.0-18-amd64
Is Apparmor, SELinux or similar active? Nope
Virtualization technlogy (KVM, VMware, Xen, etc - LXC and OpenVZ are not supported KVM
Server/VM specifications (Memory, CPU Cores) 12x AuthenticAMD @ 2GHz (AMD EPYC 7702P 64-Core Processor), 64 GB RAM
Docker Version (docker version) 20.10.12
Docker-Compose Version (docker-compose version) 1.29.2, build 5becea4c
Reverse proxy (custom solution) Apache, see below

Apache config:

<VirtualHost *:80>
  ServerName mail.<mydomain>.com
  ServerAlias <mydomain>.de
  ServerAlias www.<mydomain>.de
  ServerAlias mail.<mydomain>.de
  ServerAlias autodiscover.*
  ServerAlias autoconfig.*
  RewriteEngine on

  RewriteCond %{HTTPS} off
  RewriteRule ^/?(.*) https://%{HTTP_HOST}/$1 [R=301,L]

  ProxyPass / http://127.0.0.1:7080/
  ProxyPassReverse / http://127.0.0.1:7080/
  ProxyPreserveHost On
  ProxyAddHeaders On
  RequestHeader set X-Forwarded-Proto "http"
</VirtualHost>
<VirtualHost *:443>
  ServerName mail.<mydomain>.com
  ServerAlias <mydomain>.de
  ServerAlias www.<mydomain>.de
  ServerAlias mail.<mydomain>.de
  ServerAlias autodiscover.*
  ServerAlias autoconfig.*

  # You should proxy to a plain HTTP session to offload SSL processing
  ProxyPass /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync connectiontimeout=4000
  ProxyPassReverse /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync
  ProxyPass / http://127.0.0.1:7080/
  ProxyPassReverse / http://127.0.0.1:7080/
  ProxyPreserveHost On
  ProxyAddHeaders On
  RequestHeader set X-Forwarded-Proto "https"

  SSLCertificateFile /etc/letsencrypt/live/<mydomain>/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/<mydomain>/privkey.pem

  # If you plan to proxy to a HTTPS host:
  #SSLProxyEngine On

  # If you plan to proxy to an untrusted HTTPS host:
  #SSLProxyVerify none
  #SSLProxyCheckPeerCN off
  #SSLProxyCheckPeerName off
  #SSLProxyCheckPeerExpire off
</VirtualHost>
# docker exec -it $(docker ps -qf name=acme-mailcow) dig +short stackoverflow.com @172.22.1.254
151.101.1.69
151.101.129.69
151.101.65.69
151.101.193.69

UFW is installed but I didn't mess with any internal docker stuff.
@mfnalex mfnalex added the bug label Dec 31, 2021
@andryyy
Copy link
Contributor

andryyy commented Dec 31, 2021 via email

@mfnalex
Copy link
Author

mfnalex commented Dec 31, 2021

It is most likely a NAT reflection issue. Connecting from the host itself to its own public IP so to say.

Thanks for replying. I have no idea about NAT or docker networking. Is there any way I could fix this?

@Psycho0verload
Copy link

I also have this problem and have not found a solution yet.

@simonoener
Copy link

simonoener commented Feb 12, 2022 •
edited
Loading

I my case, it was ufw. Take a look at /var/log/kern.log. A possible solution for ufw would be ufw allow 25/tcp.

@mfnalex
Copy link
Author

mfnalex commented Feb 14, 2022

I still have the same problem on a new machine that doesn't have any firewall installed.

@Psycho0verload
Copy link

For me, the firewall was also the problem. I have released my port 25 and it has worked with it

@mfnalex
Copy link
Author

mfnalex commented Feb 21, 2022

I'm forwarding / nat'ing 25 from the proxmox host to the VM running mailcow. Mails can also be delivered via port 25 :/

@andryyy
Copy link
Contributor

andryyy commented Feb 21, 2022

These two things don't have to be related.

You can be able to establish/receive connections from WAN to your cow through NAT on a port while not being able to connect to your WAN address from inside your LAN on the very same port and IP. That would be a reflection issue.

It can also be an issue with some IPv6 routing or something else.

Try something like this:

  • nc -4 mailcow.hostname.tld 25 from your Docker host hosting your cow.
  • nc -6 mailcow.hostname.tld 25 from your Docker host hosting your cow.

Works? Cool. This should not have been a problem so far anyway. If this failed though, you don't need to try the stuff below.

Now enter a container with "nc" installed and try again: docker-compose exec php-fpm-mailcow bash. Run:

  • nc -4 mailcow.hostname.tld 25
  • nc -6 mailcow.hostname.tld 25

Something times out?

Please let us now about the returned IPs: ping -4 mailcow.hostname.tld and ping -6 mailcow.hostname.tld

Where do you host these servers? This could be a useful information, too, as they might add some tricky filtering for SMTP.

@milkmaker
Copy link
Collaborator

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

@milkmaker milkmaker added the stale Please update the issue with current status, unclear if it's still open/needed. label Apr 22, 2022
@martinjgrunwald
Copy link

Try something like this:

  • nc -4 mailcow.hostname.tld 25 from your Docker host hosting your cow.
  • nc -6 mailcow.hostname.tld 25 from your Docker host hosting your cow.

Works? Cool. This should not have been a problem so far anyway. If this failed though, you don't need to try the stuff below.

For me nc -6 mailcow.hostname.tld 25 fails with nc: getaddrinfo for host "mailcow.hostname.tld" port 25: No address associated with hostname. My mailcow works great otherwise, I just wanted to add a TLSA record, but I have the same 110 error OP has.
nc -4 mailcow.hostname.tld 25 returns 220 mailcow.hostname.tld ESMTP Postcow.
I have no reverse Proxy in front of the mailcow. Just an OPNsense with all the required ports forwarded to the mailcow server. The server is a KVM Ubuntu 22.04 without UFW.
What can I do to fix the netcat error and therefore hopefully the mailcow 110 error?

@mfnalex
Copy link
Author

mfnalex commented Jul 3, 2023

What is nc supposed to show? It doesn't show any output for me

root@mail:~# nc -4 mail.<mycomain>.com 25
root@mail:~# nc -6 mail.<mydomain>.com 25
root@mail:~#

@martinjgrunwald
Copy link

martinjgrunwald commented Jul 3, 2023 •
edited
Loading

For me it shows 220 mailcow.hostname.tld ESMTP Postcow I fixed the IPv6 ping by adding the FQDN to /etc/hosts but unfortunately that didn't fix my 110 Error in the Web GUI for the TLSA record :-(

Inside the container I still don't get an answer

@enriluis
Copy link

https://community.mailcow.email/d/2607-tlsa-record-110-operation-timed-out/9

@piotrsnella
Copy link

If you are using a proxied DNS service, such as Cloudflare, switch it to 'DNS Only' mode and ensure that port 25 is open.
It worked for me :D

@martinjgrunwald
Copy link

If you are using a proxied DNS service, such as Cloudflare, switch it to 'DNS Only' mode and ensure that port 25 is open. It worked for me :D

Unfortunately it does not work for me even though I did both of those things

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug stale Please update the issue with current status, unclear if it's still open/needed.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
8 participants
@mfnalex @andryyy @Psycho0verload @enriluis @simonoener @piotrsnella @martinjgrunwald @milkmaker