OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Possible MX Lookup/Ordering Issue

gordanbobich.net
Date: Thu Nov 01 2007 - 08:54:16 CDT


On Thu, 1 Nov 2007, Victor Duchovni wrote:

>> I'm seeing some strange behaviour with my Postfix setup. It occasionally
>> doesn't try the MX records in the correct order. It will try a low
>> priority one, and if the machine is on a local subnet but not running,
>> it'll get back a "no route to host", and get stuck. It'll keep retrying
>> this one quite a few times, before it gives up and rolls over to the high
>> priority MX-es which it should have tried first.
>>
>> Is this a known bug?
>
> Your anecdotal observations are flawed. Postfix makes new connections to
> the MX hosts in the order supplied by DNS. Claims to the contrary need
> to be backed up with detailed logging for the transactions in question,
> including not only the final delivery success/fail indication, but also
> any prior connection attempts or partial deliveries.
>
>> Does Postfix try to cut a corner here and use the MX with the IP returned
>> in the additional section, instead of going purely based on the MX list
>> and trying the records in the priority order as it should?
>
> It is pointless to speculate without evidence.

I agree - but I have evidence in the logs. Email arrives, the first logged
attempted delivery goes to wrong (low priority) MX. Half a dozen or so
subsequent deliveries get retried to that same, wrong MX.

I worked around it by adding an iptables rule, but the logs will just show
that it now succeeds on that same low priority MX (which shouldn't have
been tried at all, since the higher priority ones are working).

I can paste the logs, but since they aren't debug level logs (only normal
/var/log/maillog), they are unlikely to help in tracking down the problem.
But if there's a debug parameter you want me to reconfigure postfix with
to get some more detailed logs, I'm more than happy to add it and report
back.

Gordan