What is the procedure for setup only the first level DNS for docker-mailserver ? (not having a second level dns like mail.example.com at all))

[shodanx2]

Hi,

I had been having certificate confusion between mail.example.com and example.com

So I tried only setting example.com as a domain

by changing

    hostname: mail
    domainname: example.com

in the docker-compose.yml file to

    hostname: example.com
#    domainname: example.com

but doing this causes errors like

postfix/smtpd[2250]: NOQUEUE: reject: RCPT from mail-oa1-f46.google.com[209.85.160.46]: 550 5.1.1 [email protected]: Recipient address rejected: User unknown in local recipient table; from=[email protected] to=[email protected] proto=ESMTP helo=<mail-oa1-f46.google.com>

Even thoug the account does appear when typing

root@example:/opt/docker-mailserver# ./setup.sh email list
* [email protected] ( 0 / ~ ) [0%]

Some search led me to this serverfault page
https://serverfault.com/questions/1061720/debian-postfix-rejecting-user-user-unknown-in-local-recipient-table-in-reply

I tried the commands

root@example:/# postconf mydestination
mydestination = $myhostname, localhost.$mydomain, localhost
root@example:/# postconf -x mydestination
mydestination = example.com, localhost.example.com, localhost

However they recommend

"Configure a proper mail server host name & domain. Ideally, not just the second-level mydomain.example but with a name like mx2.mydomain.example. The settings myhostname and mydomain should typically not equal."

So maybe I should have both mail.example.com and example.com ? Is this even possible ?

Another posts suggest that I remove $mydomain from mydestination
https://serverfault.com/questions/179419/postfix-recipient-address-rejected-user-unknown-in-local-recipient-table
I haven't tried that as I'm not sure in this case it -should- send the mail to the local account ?

I tried checking if my "user" exists in /etc/passwd, it does not

root@example:/# cat /etc/passwd | grep user
root@example:/#      (no output)

root@example:/# cat /etc/aliases
root: [email protected]
root@example:/#

root@example:/# postconf | grep example
mydomain = example.com
myhostname = example.com
smtpd_tls_chain_files = /etc/letsencrypt/live/example.com/privkey.pem /etc/letsencrypt/live/example.com/fullchain.pem
root@example:/#

and this last one might be the cause but I don't understand why it doesn't exist, should it exist if I don't have a second, virtual domain ?

root@example:/# cat /etc/postfix/virtual-mailbox
cat: /etc/postfix/virtual-mailbox: No such file or directory
root@example:/#

I tried deleting the mailbox and recreating

root@example:/opt/docker-mailserver# ./setup.sh email del [email protected]
Do you want to delete the mailbox as well (removing all mails)? [Y/n] y
[   INF   ]  Deleting Mailbox: '/var/mail/example.com/user'
[   INF   ]  '[email protected]' and associated data deleted
root@example:/opt/docker-mailserver# ./setup.sh config dkim
[ WARNING ]  No entries found, no keys to make
root@example:/opt/docker-mailserver# ./setup.sh email add [email protected]
Enter Password:
root@example:/opt/docker-mailserver# ./setup.sh config dkim
root@example:/opt/docker-mailserver#

I ran all the commands above, but nothing changed

Here is the entire log from sending an email from another domain

root@example:/# tail -f /var/log/supervisor/*.log /var/log/mail/* /var/log/mail.log
==> /var/log/mail/mail.info <==
Oct 28 02:59:28 example postfix/postscreen[7076]: CONNECT from [209.85.167.170]:45051 to [172.21.0.2]:25
Oct 28 02:59:28 example postfix/postscreen[7076]: PASS OLD [209.85.167.170]:45051
Oct 28 02:59:28 example postfix/smtpd[7077]: connect from mail-oi1-f170.google.com[209.85.167.170]
Oct 28 02:59:28 example postfix/smtpd[7077]: Anonymous TLS connection established from mail-oi1-f170.google.com[209.85.167.170]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256

==> /var/log/mail/mail.log <==
Oct 28 02:59:28 example postfix/postscreen[7076]: CONNECT from [209.85.167.170]:45051 to [172.21.0.2]:25
Oct 28 02:59:28 example postfix/postscreen[7076]: PASS OLD [209.85.167.170]:45051
Oct 28 02:59:28 example postfix/smtpd[7077]: connect from mail-oi1-f170.google.com[209.85.167.170]
Oct 28 02:59:28 example postfix/smtpd[7077]: Anonymous TLS connection established from mail-oi1-f170.google.com[209.85.167.170]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256

==> /var/log/mail.log <==
Oct 28 02:59:28 example postfix/postscreen[7076]: CONNECT from [209.85.167.170]:45051 to [172.21.0.2]:25
Oct 28 02:59:28 example postfix/postscreen[7076]: PASS OLD [209.85.167.170]:45051
Oct 28 02:59:28 example postfix/smtpd[7077]: connect from mail-oi1-f170.google.com[209.85.167.170]
Oct 28 02:59:28 example postfix/smtpd[7077]: Anonymous TLS connection established from mail-oi1-f170.google.com[209.85.167.170]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256

==> /var/log/mail/mail.info <==
Oct 28 02:59:29 example postfix/trivial-rewrite[7085]: warning: do not list domain example.com in BOTH mydestination and virtual_mailbox_domains
Oct 28 02:59:29 example policyd-spf[7087]: prepend Received-SPF: None (mailfrom) identity=mailfrom; client-ip=209.85.167.170; helo=mail-oi1-f170.google.com; [email protected]; receiver=<UNKNOWN>
Oct 28 02:59:29 example postfix/smtpd[7077]: NOQUEUE: reject: RCPT from mail-oi1-f170.google.com[209.85.167.170]: 550 5.1.1 <[email protected]>: Recipient address rejected: User unknown in local recipient table; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-oi1-f170.google.com>

==> /var/log/mail/mail.log <==
Oct 28 02:59:29 example postfix/trivial-rewrite[7085]: warning: do not list domain example.com in BOTH mydestination and virtual_mailbox_domains
Oct 28 02:59:29 example policyd-spf[7087]: prepend Received-SPF: None (mailfrom) identity=mailfrom; client-ip=209.85.167.170; helo=mail-oi1-f170.google.com; [email protected]; receiver=<UNKNOWN>
Oct 28 02:59:29 example postfix/smtpd[7077]: NOQUEUE: reject: RCPT from mail-oi1-f170.google.com[209.85.167.170]: 550 5.1.1 <[email protected]>: Recipient address rejected: User unknown in local recipient table; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-oi1-f170.google.com>

==> /var/log/mail/mail.warn <==
Oct 28 02:59:29 example postfix/trivial-rewrite[7085]: warning: do not list domain example.com in BOTH mydestination and virtual_mailbox_domains

==> /var/log/mail.log <==
Oct 28 02:59:29 example postfix/trivial-rewrite[7085]: warning: do not list domain example.com in BOTH mydestination and virtual_mailbox_domains
Oct 28 02:59:29 example policyd-spf[7087]: prepend Received-SPF: None (mailfrom) identity=mailfrom; client-ip=209.85.167.170; helo=mail-oi1-f170.google.com; [email protected]; receiver=<UNKNOWN>
Oct 28 02:59:29 example postfix/smtpd[7077]: NOQUEUE: reject: RCPT from mail-oi1-f170.google.com[209.85.167.170]: 550 5.1.1 <[email protected]>: Recipient address rejected: User unknown in local recipient table; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-oi1-f170.google.com>

==> /var/log/mail/mail.info <==
Oct 28 03:00:00 example postfix/smtpd[7077]: disconnect from mail-oi1-f170.google.com[209.85.167.170] ehlo=2 starttls=1 mail=1 rcpt=0/1 bdat=0/1 rset=1 quit=1 commands=6/8

==> /var/log/mail/mail.log <==
Oct 28 03:00:00 example postfix/smtpd[7077]: disconnect from mail-oi1-f170.google.com[209.85.167.170] ehlo=2 starttls=1 mail=1 rcpt=0/1 bdat=0/1 rset=1 quit=1 commands=6/8

==> /var/log/mail.log <==
Oct 28 03:00:00 example postfix/smtpd[7077]: disconnect from mail-oi1-f170.google.com[209.85.167.170] ehlo=2 starttls=1 mail=1 rcpt=0/1 bdat=0/1 rset=1 quit=1 commands=6/8

And [email protected] can send email to other domains, that works, but they can't send email to themselves, that fails but not with the exact same error messages strangely

The error
postfix/trivial-rewrite[7686]: warning: do not list domain example.com in BOTH mydestination and virtual_mailbox_domains
looks like the best lead, but this is how the comments in docker-compose.yml say to do it !?

    # If the FQDN for your mail-server is only two labels (eg: example.com),
    # you can assign this entirely to `hostname` and remove `domainname`.

root@example:/# postconf  virtual_mailbox_domains
virtual_mailbox_domains = /etc/postfix/vhost
root@example:/# cat /etc/postfix/vhost
example.com
root@example:/#

This discussion
https://serverfault.com/questions/491601/postfix-do-not-list-domain-example-com-in-both-mydestination-and-virtual-alias

also says to remove $domainname from mydestination

This other discussion
https://www.howtoforge.com/postfix-do-not-list-domain-example.com-in-both-mydestination-and-virtual_mailbox_domains

says "You can list example.com either in virtual_mailbox_domains or in mydestination, but not in both."

So everything now does point to removing $myhostname from
mydestination = $myhostname, localhost.$mydomain, localhost

and then running /etc/init.d/postfix restart inside the container

I imagine the problem is that if I do that, next time I down/up or update the container, this change will be overwritten ?

I guess it's worth a shot anyway !

And that works actually !

But can I restart the container and keep this change ? No the changes are lost

cat /etc/postfix/main.cf | grep mydest
mydestination = $myhostname, localhost.$mydomain, localhost

Ok, so how do I make this change permanent OR am I going about this the right way ?
Does anyone else here run a docker-mailserver without a 2nd level dns name ?

thanks !

[polarathene]

We have a related FAQ entry about this: https://docker-mailserver.github.io/docker-mailserver/edge/faq/#can-i-use-nakedbare-domains-no-host-name

It's not advised to setup your email this way though. mail.example.com is the address for the mail-server, and does not have anything to do with the email address used by accounts it manages. You can have [email protected] and [email protected] managed by the same DMS instance.

When you use hostname: mail.example.com (no domainname needed in the docker-compose.yml), it should work fine. Just create the mail account [email protected] and have your DNS MX record set to mail.example.com (A record), and you should have inbound mail received by DMS for that user.

---

If this is not working out for you, it's likely you have a misconfiguration, but you have not shared what your docker-compose.yml looks like, so that is difficult to assess where the issue could be.

[shodanx2]

Thanks for the reply, I missed the existence of the faq

Originally I had my email set to mail.example.com but the problem is that some mail clients would ask for certification and get mail.example.com when they expected example.com or vice versa and the client would throw a certificate invalid error.

So I tried side stepping the problem by making example.com the only domain.

Another user in another discussion suggested making my example.com certificate into a "Subject Alternate Name" certificate that would be applicable to both mail.example.com and example.com

But this current solution seemed simpler

I now see in the FAQ that the solution was to put

mydestination = localhost.$mydomain, localhost
to /opt/docker-mailserver/docker-data/dms/config/postfix-main.cf instead of doing what I did and editing /etc/postfix/main.cf directly

Can you explain why it is advisable to maintain mail.example.com (with a SAN certificate, I imagine it is mandatory ? I have both a letsencrypt certificate for example.com and mail.example.com but the server seem to only serve one of the two)

[polarathene]

Can you explain why it is advisable to maintain mail.example.com (with a SAN certificate, I imagine it is mandatory ? I have both a letsencrypt certificate for example.com and mail.example.com but the server seem to only serve one of the two)

I think the LetsEncrypt support just tries to find a certificate file based on the hostname DMS gets configured with, and chooses the first one that matches that hostname. It won't configure itself for multiple certificates.

When mail servers are contacted, they'd look at the MX record of a mail server when finding where to send the email to, and that could point to DMS for example at mail.example.com when sending to [email protected]. Similar for mail clients like Thunderbird connecting to DMS to retrieve mail over something like IMAP I believe.

Thus I think they'd expect the certificate provided to match that DMS hostname (mail.example.com, not the one in the mail address @example.com). This would be because you could have other addresses also managed such as [email protected] also handled at mail.example.com (which the DNS somewhere-else.com has an MX record pointing to), and that should be where you are checking that the mail-server is the one you expect to trust for mail.example.com. Whereas example.com could be an entirely different sever than the one mail.example.com is running from, so a certificate for that is not very helpful trust wise.

I believe our documentation for SSL has a few examples of how you can get LetsEncrypt certificates. AFAIK, it's quite common to always register the certificate with SAN for the domain now, and that may be one or more domains, so you should be able to get one for mail.example.com, example.com, which covers both.