SMTP Trouble

[cwall64]

I just started getting this message yesterday on a server that has been running fine for years, to my knowledge nothing has changed on the Ubuntu server recently and the Zimbra version has been stable also for a while (8.0.2 network). Only thing possible is some network provider changes (ATT). All of my users are seeing this when they try to send an email:

This is the mail system at host mail.cbrworld.com.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The mail system

<xxxxxxx@mac.com>: host 127.0.0.1[127.0.0.1] said: 504 5.5.2 id=03268-01 -
Rejected by next-hop MTA on relaying, from MTA(smtp:[127.0.0.1]:10029): 504
5.5.2 <localhost>: Helo command rejected: need fully-qualified hostname (in
reply to end of DATA command)

"Hostname -f" shows the correct name (mail.cbrworld.com) and "postconf | grep myhostname" returns same. Any help in where I should start looking would be appreciated.

[phoenix]

Take your pick of these solutions: +"Helo command rejected: need fully-qualified hostname" - Yahoo! Search Results and your server also doesn't have a valid reverse DNS.

[cwall64]

According to a couple of the threads listed, this should be correct:

root@mail:~# hostname -f
mail.cbrworld.com
root@mail:~# su - zimbra
zimbra@mail:~$ postconf | grep myhostname
lmtp_lhlo_name = $myhostname
local_transport = local:$myhostname
milter_macro_daemon_name = $myhostname
myhostname = mail.cbrworld.com
myorigin = $myhostname
smtp_helo_name = $myhostname
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_proxy_ehlo = $myhostname

zimbra@mail:~$ postconf -n
alias_maps = hash:/etc/aliases
always_add_missing_headers = yes
bounce_notice_recipient = postmaster
bounce_queue_lifetime = 5d
broken_sasl_auth_clients = yes
command_directory = /opt/zimbra/postfix/sbin
config_directory = /opt/zimbra/postfix-2.10-20121007.2z/conf
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /opt/zimbra/postfix/libexec
delay_warning_time = 0h
disable_dns_lookups = no
header_checks =
import_environment =
in_flow_delay = 1s
inet_protocols = ipv4
lmtp_connection_cache_destinations =
lmtp_connection_cache_time_limit = 4s
lmtp_host_lookup = dns
local_header_rewrite_clients = permit_mynetworks,permit_sasl_authenticated
mail_owner = postfix
mailbox_size_limit = 0
mailq_path = /opt/zimbra/postfix/sbin/mailq
manpage_directory = /opt/zimbra/postfix/man
maximal_backoff_time = 4000s
message_size_limit = 102400000
minimal_backoff_time = 300s
mydestination = localhost
myhostname = mail.cbrworld.com
mynetworks = 127.0.0.0/8 75.63.111.40/29 [::1]/128
newaliases_path = /opt/zimbra/postfix/sbin/newaliases
non_smtpd_milters =
notify_classes = resource,software
propagate_unmatched_extensions = canonical
queue_directory = /opt/zimbra/data/postfix/spool
queue_run_delay = 300s
recipient_delimiter =
relayhost =
sender_canonical_maps = proxy:ldap:/opt/zimbra/conf/ldap-scm.cf
sendmail_path = /opt/zimbra/postfix/sbin/sendmail
setgid_group = postdrop
smtp_cname_overrides_servername = no
smtp_sasl_auth_enable = no
smtp_sasl_mechanism_filter =
smtp_sasl_password_maps =
smtp_sasl_security_options = noplaintext,noanonymous
smtp_tls_security_level =
smtpd_client_restrictions = reject_unauth_pipelining
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_end_of_data_restrictions =
smtpd_helo_required = yes
smtpd_milters =
smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_unlisted_recipient, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_non_fqdn_sender, reject_unknown_client_hostname, reject_unknown_helo_hostname, reject_unknown_sender_domain, reject_rbl_client zen.spamhaus.org reject_rbl_client b.barracudacentral.org, permit
smtpd_reject_unlisted_recipient = no
smtpd_relay_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = no
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
smtpd_sender_restrictions = check_sender_access regexp:/opt/zimbra/postfix/conf/tag_as_originating.re, permit_mynetworks, permit_sasl_authenticated, permit_tls_clientcerts, check_sender_access regexp:/opt/zimbra/postfix/conf/tag_as_foreign.re
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /opt/zimbra/conf/smtpd.crt
smtpd_tls_key_file = /opt/zimbra/conf/smtpd.key
smtpd_tls_loglevel = 1
smtpd_tls_security_level = may
transport_maps = proxy:ldap:/opt/zimbra/conf/ldap-transport.cf
virtual_alias_domains = proxy:ldap:/opt/zimbra/conf/ldap-vad.cf
virtual_alias_expansion_limit = 10000
virtual_alias_maps = proxy:ldap:/opt/zimbra/conf/ldap-vam.cf
virtual_mailbox_domains = proxy:ldap:/opt/zimbra/conf/ldap-vmd.cf
virtual_mailbox_maps = proxy:ldap:/opt/zimbra/conf/ldap-vmm.cf
virtual_transport = error

Unfortunately GoDaddy's DNS doesn't support reverse DNS...

[phoenix]

According to a couple of the threads listed, this should be correct:

I'm afraid your pout shows nothing except the configuration options, you need to see what the helo response is.

Unfortunately GoDaddy's DNS doesn't support reverse DNS...

Of course it doesn't a reverse DNS is supplied by your ISP not the DNS host for your records.

[cwall64]

Is this the HELO that we are looking for:

Christophers-MBP-266:~ cwall$ telnet mail.cbrworld.com 25
Trying 75.63.111.42...
Connected to mail.cbrworld.com.
Escape character is '^]'.
220 mail.cbrworld.com ESMTP Postfix
helo
501 Syntax: HELO hostname
helo mail.cbrworld.com
250 mail.cbrworld.com

[phoenix]

Is this the HELO that we are looking for:

Yes and it's correct but as I mentioned it doesn't have a valid reverse DNS.

[cwall64]

Sorry, I just do not understand why I have another server for more domains that is on the same vSphere 5.0 infrastructure, same network with same DNS configurations - and it works fine... And this one just started this behavior yesterday afternoon after years of upgrades and service.

[McDuck]

humm... 8.0 worked fine, updated to 8.0.2 and suddenly I got the same error message as above.
Verifed via this "http://wiki.zimbra.com/wiki/Split_DNS" I do use a seperate DNS server (internal on my network).
What i understand, the verification worked as it should, cannot find the issue, send an e-mail and I get one in return saying
"Diagnostic-Code: smtp; 504 5.5.2 id=07777-01 - Rejected by next-hop MTA on relaying, from MTA(smtp:[127.0.0.1]:10029): 504 5.5.2 <localhost>: Helo command rejected: need fully-qualified hostname"

Some dig results,


dhcp-8:~ McDuck$ dig -x 10.16.3.21

; <<>> DiG 9.8.3-P1 <<>> -x 10.16.3.21
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19900
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;21.3.16.10.in-addr.arpa. IN PTR

;; ANSWER SECTION:
21.3.16.10.in-addr.arpa. 10800 IN PTR r2-d2.sweden-hosting.com.

;; AUTHORITY SECTION:
3.16.10.in-addr.arpa. 10800 IN NS mcnsx.mafiabusiness.intra.

;; ADDITIONAL SECTION:
mcnsx.mafiabusiness.intra. 10800 IN A 10.16.3.12

;; Query time: 8 msec
;; SERVER: 10.16.3.12#53(10.16.3.12)
;; WHEN: Sat Feb 9 02:46:40 2013
;; MSG SIZE rcvd: 134

dhcp-8:~ McDuck$
-------------------------------------------------------------------------------
dhcp-8:~ McDuck$ dig mx sweden-hosting.com

; <<>> DiG 9.8.3-P1 <<>> mx sweden-hosting.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47987
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 1

;; QUESTION SECTION:
;sweden-hosting.com. IN MX

;; ANSWER SECTION:
sweden-hosting.com. 600 IN MX 10 r2-d2.sweden-hosting.com.
sweden-hosting.com. 600 IN MX 80 mxbackup1.clearsdn.com.
sweden-hosting.com. 600 IN MX 80 mxbackup2.clearsdn.com.

;; AUTHORITY SECTION:
sweden-hosting.com. 169464 IN NS ns4.clearsdn.com.
sweden-hosting.com. 169464 IN NS ns2.clearsdn.com.
sweden-hosting.com. 169464 IN NS ns1.clearsdn.com.
sweden-hosting.com. 169464 IN NS ns3.clearsdn.com.

;; ADDITIONAL SECTION:
r2-d2.sweden-hosting.com. 259200 IN A 10.16.3.21

;; Query time: 530 msec
;; SERVER: 10.16.3.12#53(10.16.3.12)
;; WHEN: Sat Feb 9 02:47:18 2013
;; MSG SIZE rcvd: 207

dhcp-8:~ McDuck$
---------------------------------------------------------------
dhcp-8:~ McDuck$ dig r2-d2.sweden-hosting.com

; <<>> DiG 9.8.3-P1 <<>> r2-d2.sweden-hosting.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25599
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;r2-d2.sweden-hosting.com. IN A

;; ANSWER SECTION:
r2-d2.sweden-hosting.com. 259200 IN A 10.16.3.21

;; AUTHORITY SECTION:
r2-d2.sweden-hosting.com. 259200 IN NS mcnsx.mafiabusiness.intra.

;; ADDITIONAL SECTION:
mcnsx.mafiabusiness.intra. 10800 IN A 10.16.3.12

;; Query time: 6 msec
;; SERVER: 10.16.3.12#53(10.16.3.12)
;; WHEN: Sat Feb 9 02:47:52 2013
;; MSG SIZE rcvd: 113

dhcp-8:~ McDuck$

zimbra@r2-d2:/home/mcduck$ zmcontrol -v
Release 8.0.2.GA.5569.UBUNTU12.64 UBUNTU12_64 FOSS edition.

root@r2-d2:/home/mcduck# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 12.04.2 LTS
Release: 12.04
Codename: precise
root@r2-d2:/home/mcduck#


Does anyone have any idea? I'm a tad stuck.

[McDuck]

Well, found this one in settings, "Sender address must be fully qualified (refect_non_fqdn_sender)" it was checked, I unceched it, and everything seams to work again. Find it a tad mind blowing, is this a bug or am I wrong?

[cwall64]

I worked with AT&T to get rDNS setup correctly, it is now, and same error still... McDuck, I'll look at your setting.