0

I'm attempting to send mail from a remote email account to my postfix smtp mail service on my local network. Everything works fine on the local network and users can freely exchange mail between one another's local accounts. However, I can't send email to the outside, nor receive from the outside. When I send email to the remote server, my log says, "no route to host". When I send email from the remote server, I get a bounce message that says, "No MX or A records found". I've been assured this is a DNS problem and not a Postfix problem, so I'll rephrase this question in terms of DNS. Here's the confusion:

I've created a zone file for my domain that is recognized only by my localhost DNS server. When I query the DNS server of my isp, I get a NXdomain error. Granted that only my loopback DNS can recognize the zone file, how does this file get known to the public network? How is this related to the domain I've registered with a public registrar? And how is my remote email account ever going to figure out that I do have MX and A records for that domain, though only on my local DNS?

btw my network is behind a NAT and I've forwarded 53 through both firewalls, and it's currently open.

Here are the current zone files:

db.admitonetwowire.com

$TTL 1d
@     IN    SOA  ns1.admitonetwowire.com. root.admitonetwowire.com. (
                                         3
                                        604800
                                         86400
                                         2419200
                                         604800)

@     IN     NS   ns1.admitonetwowire.com.

root     IN    A     65.13.145.203
ns1      IN    A     65.13.145.203
server   IN    A     65.13.145.203
@        IN    A     65.13.145.203

@     IN     MX    0 server.admitonetwowire.com.

db.203.145.13.65

$TTL 1d
@ IN SOA  ns1.admitonetwowire.com. root.admitonetwowire.com. (
3
604800
86400
2419200
604800 )

@ IN PTR  ns1.admitonetwowire.com
@ IN PTR  server.admitonetwowire.com
@ IN PTR  root.admitonetwowire.com
@ IN PTR  admitonetwowire.com.
@ IN NS   ns1.admitonetwowire.com.

btw 65.13.145.203 is my public ip.

Improve this question
1

Let's start with the DNS issue first. You should have had to designate name servers for your domain with your domain registrar. (Some registrars also offer DNS services and provide tools for setting up basic DNS records - but I'll assume that isn't the case here.) The name server doesn't have to be the SOA (Start of Authority) for your domain; it just has to know where the SOA record is located. ISP's generally won't provide DNS service for accounts unless you are on a business account with static IPs, and even then they usually only have a PTR record provisioned for the IP/hostname of your server (leaving you to manage your DNS records internally). Thus, querying your ISP DNS for info on your domain will yield nothing.

If you are on a residential account with cable or DSL, you will need to look at using a dynamic DNS service like dyn.com to manage your DNS. Cable/DSL uses dynamic addressing on their networks and your public IP is subject to change over time. The service is relatively inexpensive, becomes the SOA of your domain DNS records, lets you create all the DNS records you would need (including MX records) and will direct requests for your domain to your server. You would then designate the dynamic DNS service name servers with your domain registrar.

Once that is addressed, you will probably face the problem that most ISP's block port 25 which is used for SMTP connections and on which Postfix relies for incoming and outgoing connections. In some cases you can get the ISP to drop the block on your account - but not always.

Once you have DNS pointed to your server and it's accessible to the outside world, then you can start working on the Postfix problem.

Improve this answer
3
  • I have a public ip address which I purchased from my isp. You're right, they have a pointer record provisioned for it. That's the reason I can't switch to dynamic dns (I also have a static private ip in consequence of having a static public one). Though I have a residential dsl account, I've asked my isp to unblock port 25, which they have also done for a fee. So your solution looks good to me, but I'd have to reconfigure too much on my other servers. – Matthew Presti Jan 30 '14 at 9:53
  • Then you're going to have to set your BIND zone files so that your server is the listed SOA for your domain as a Primary Master. Check out this How-To for configuring BIND on Ubuntu. – douggro Jan 30 '14 at 15:56
  • I'll post my zone files above in the original post so you can see what I've already done. It's set up already so I can ping the address as well as run "nslookup admitonetwowire.com localhost" and "dig @localhost admitonetwowire.com". It's working, but it still may not be functioning correctly to direct mail to the right place. – Matthew Presti Jan 30 '14 at 19:34
1

If I look up NS servers for your domain, I have this:

admitonetwowire.com.    3434    IN  NS  ns1.admitonetwowire.com.
admitonetwowire.com.    3434    IN  NS  ns09.domaincontrol.com.
admitonetwowire.com.    3434    IN  NS  ns10.domaincontrol.com.

Like, yours is the first one, other two are GoDaddy's. I believe you have configured GoDaddy's to be secondary?

If above is true, then the problem is that your server does not listen on UDP 53 port, but it should. I can not get any records from your server, that means GoDaddy also can't.

You can check /etc/bind/named.conf.options there should be:

listen-on {
  65.13.145.203;
};

You can check listening ports by running:

netstat -tupanl | grep ":53 "

Also check if firewall isn't blocking UDP 53. NOTE: TCP 53 should be blocked, allow only UDP connections.

Improve this answer
23
  • Yes, I configured Godaddy's secondary, and I'm following what you're saying here. However, if I allow 53/udp through my firewalls or if I change the listen-on address to my public ip, my port 53 is blocked. The only way port 53 is open is if I allow 53/tcp through the firewalls and specify "listen-on {any;};" – Matthew Presti Jan 30 '14 at 20:06
  • listen-on {any;}; is ok. How do you check that port is open? DNS client requests go via UDP 53. – Smart69 Jan 30 '14 at 20:14
  • I see you have fixed. Your server now responds correctly. – Smart69 Jan 30 '14 at 20:18
  • I use an open port check tool yougetsignal.com/tools/open-ports to check if my ports are open. 53/tcp is now open, but when I specify allow 53/udp, the port stays closed. – Matthew Presti Jan 30 '14 at 20:20
  • Okay, the tool is stupid. It now says Port 53 is closed on 65.13.145.203... if it checks only TCP then it is CORRECT. UDP port is open currently and working. I can get MX record from your server "admitonetwowire.com. 86400 IN MX 0 server.admitonetwowire.com." – Smart69 Jan 30 '14 at 20:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.