1

I have a nicely working OpenSMTPD configuration and I added dkimproxy to it.

Everything is working nicely and mail-tester, etc., all report that I have proper DKIM signing and my email score is 10/10, etc.

The problem is ...

If I attempt to send an email from user@mydomain.com to other_user@mydomain.com the mail server gets into a loop and the mail never gets sent. I see this in maillog:

Nov 15 08:34:13 mail dkimproxy.out[38686]: DKIM signing - signed; message-id=<4dea9099466e00b7@mail.mydomain.com>, signer=<MAILER-DAEMON@mail.mydomain.com>, from=<MAILER-DAEMON@mail.mydomain.com>
Nov 15 08:34:13 mail smtpd[33463]: 4dea90938ef29e98 smtp message msgid=0b62ff80 size=104666 nrcpt=1 proto=ESMTP
Nov 15 08:34:13 mail smtpd[33463]: 4dea90938ef29e98 smtp envelope evpid=0b62ff80eb408785 from=<> to=<joey@mydomain.com>                                                               
Nov 15 08:34:13 mail smtpd[33463]: 4dea9092f4274d88 mta delivery evpid=6fe8c750a74f16ac from=<> to=<joey@mydomain.com> rcpt=<-> source="200.100.240.135" relay="200.100.240.135 (mail.mydomain.com)" delay=1s result="Ok" stat="250 2.0.0 0b62ff80 Message accepted for delivery"

... and it loops like that maybe 50 times over and over - eventually it gives up with this error:

Nov 15 08:34:18 mail smtpd[33463]: warn: loop detected                                                                                                                                            
Nov 15 08:34:18 mail smtpd[33463]: 4dea9097226c93aa smtp failed-command command="DATA" result="500 5.4.6 Routing loop detected: Loop detected"                                                    
Nov 15 08:34:18 mail smtpd[33463]: 4dea90969c6cf495 mta delivery evpid=49514d020281ac48 from=<> to=<joey@mydomain.com> rcpt=<-> source="200.100.240.135" relay="200.100.240.135 (mail.mydomain.com)" delay=1s result="PermFail" stat="500 5.4.6 Routing loop detected: Loop detected"

I have no idea what the issue is. This only happens when I send email to myself or to another user with this domain that is hosted on this mail server.

# cat dkimproxy_in.conf

# specify what address/port DKIMproxy should listen on
listen    200.100.240.135:10025

# specify what address/port DKIMproxy forwards mail to
relay     200.100.240.135:10026


# cat dkimproxy_out.conf 

# specify what address/port DKIMproxy should listen on
listen    200.100.240.135:10027

# specify what address/port DKIMproxy forwards mail to
relay     200.100.240.135:10028

# specify what domains DKIMproxy can sign for (comma-separated, no spaces)
domain    mydomain.com

# specify what signatures to add
signature dkim(c=relaxed)
signature domainkeys(c=nofws)

# specify location of the private key
keyfile   /root/dkim.private.key

# specify the selector (i.e. the name of the key record put in DNS)
selector  selector1

# control how many processes DKIMproxy uses
#  - more information on these options (and others) can be found by
#    running `perldoc Net::Server::PreFork'.
#min_servers 5
#min_spare_servers 2

... and that's everything ... thank you.

EDIT - here is the opensmtpd.conf:

table aliases file:/usr/local/etc/mail/aliases

filter check_dyndns phase connect match rdns regex \
    { '.*\.dyn\..*', '.*\.dsl\..*' } \
    disconnect "550 no residential connections"

filter check_rdns phase connect match !rdns \
    disconnect "550 no rDNS"

filter check_fcrdns phase connect match !fcrdns \
    disconnect "550 no FCrDNS"

listen on 200.100.240.135 filter { check_dyndns, check_rdns, check_fcrdns }

listen on 200.100.240.135 port 10028 tag DKIM

listen on 200.100.240.135 port submission

action "local_mail" mbox alias <aliases>
action "relay_dkim" relay host smtp://200.100.240.135:10027
action "outbound" relay helo mail.mydomain.com
    
match from any mail-from "sensors@mydomain.com" action "local_mail"

match tag DKIM for any action "outbound"
match for any action "relay_dkim"

match from any for domain "mydomain.com" action "local_mail"
match for local action "local_mail"

match from any auth for any action "outbound"
match for any action "outbound"
Paul
  • 2,755
  • 6
  • 24
  • 35
user227963
  • 199
  • 1
  • 2
  • 11
  • What OS are you using? Can you please post `smtpd.conf`? – Paul Nov 15 '21 at 17:24
  • OS is FreeBSD. I can post the smtpd.conf but, again, everything works great - perfect score from mail-tester, DKIM signing is great ... everything works fine and I could email my own domain before adding dkimproxy ... it is only AFTER adding dkimproxy that I get a mail loop with my own domain .... – user227963 Nov 15 '21 at 18:28
  • 1
    OK, added the smtpd.conf ... – user227963 Nov 15 '21 at 18:35
  • If these are all on the same server, it is unusual to not use `lo0` or `127.0.0.1`. Is there any particular reason you are using DKIMproxy? That package doesn't appear to have been updated in ten years or so, plus it may be easier to find configuration examples for the tools used by OpenSMTPD maintainers, such as `rspamd` which is in FreeBSD ports, best I can tell, and is in `smtpd.conf(5)`. Evaluate closer on the `match` order since `smtpd` "match rules are evaluated sequentially, with the first match winning." – Paul Nov 15 '21 at 19:44
  • I have to use dkimproxy because there is a weird freebsd binary compat issue with rspamd (and senderscore). So I am using dkimproxy which, again, WORKS GREAT ... it's just this weird loop sending to my own domain from my own domain ... – user227963 Nov 16 '21 at 05:49
  • Is there a reason you are using an external interface IP address instead of the loopback? – Paul Dec 04 '21 at 02:13

1 Answers1

1

This answer is written assuming no reason to use external interface for internal processes. The question does not include the pf.conf configuration which may have settings that conflict with normal mail processing when using an interface other than loopback and should have set skip on lo or equivalent configured.

smtpd.conf:

# Verify this is the correct location of aliases, which normally is
# located in /etc/mail/aliases. If you have changed aliases
# from default, be sure to run newaliases.
table aliases file:/usr/local/etc/mail/aliases

filter check_dyndns phase connect match rdns regex \
    { '.*\.dyn\..*', '.*\.dsl\..*' } \
    disconnect "550 no residential connections"

filter check_rdns phase connect match !rdns \
    disconnect "550 no rDNS"

filter check_fcrdns phase connect match !fcrdns \
    disconnect "550 no FCrDNS"

listen on 127.0.0.1 port 10028 tag DKIM
listen on 200.100.240.135 filter \
    { check_dyndns, check_rdns, check_fcrdns }
listen on 200.100.240.135 port submission

action "local_mail" mbox alias <aliases>
action "relay_dkim" relay host smtp+notls://127.0.0.1:10027
action "outbound" relay helo mail.mydomain.com

match tag DKIM for any action "outbound"
match mail-from "sensors@mydomain.com" action "local_mail"
match from any for domain "mydomain.com" action "local_mail"
match from any auth for any action "outbound"
match for local action "local_mail"
match for any action "relay_dkim"

# I interpret this to be redundant:
# match for any action "outbound"

# This original configuration line seems nonsensical because
# "mail-from" is also "from any", so removed "from any"
# match from any mail-from "sensors@mydomain.com" action "local_mail"

Even though dkimproxy_in.conf is configured, there is currently no authentication of DKIM headers in received messages as this is not configured in the original smtpd.conf, so I did not add it.

dkimproxy_in.conf:

# specify what address/port DKIMproxy should listen on
listen    127.0.0.1:10025

# specify what address/port DKIMproxy forwards mail to
relay     127.0.0.1:10026

dkimproxy_out.conf:

# specify what address/port DKIMproxy should listen on
listen    127.0.0.1:10027

# specify what address/port DKIMproxy forwards mail to
relay     127.0.0.1:10028

# specify what domains DKIMproxy can sign for (comma-separated, no spaces)
domain    mydomain.com

# specify what signatures to add
signature dkim(c=relaxed)
signature domainkeys(c=nofws)

# specify location of the private key
keyfile   /root/dkim.private.key

# specify the selector (i.e. the name of the key record put in DNS)
selector  selector1

# control how many processes DKIMproxy uses
#  - more information on these options (and others) can be found by
#    running `perldoc Net::Server::PreFork'.
#min_servers 5
#min_spare_servers 2
Paul
  • 2,755
  • 6
  • 24
  • 35