Topic: Suddenly getting lots of theses reports

[Drifting]

ID: 3
email.ebuyer.com
rua:    mailto:hostmaster@ebuyer.com
SSL connection failed
   SSL connection failed
delivering message to hostmaster@ebuyer.com, via 127.0.0.1
deleting report 3
deleting report_record_spf rows 3,5
deleting report_record_dkim rows 3,5
deleting report_record_reason rows 3,5
sleeping 5.....done.


Tried to search to see if anyone else was getting these? So hard to read when you are on an iPhone away from home!

[Peasant]

Yes, I'm getting them too. I think it is due to the upgrading of the mail package. I've taken this from the wiki:

Code: [Select]

* DMARCReject (enabled|disabled): Default value is disabled.
If set to enabled, the dmarc plugin can decide to reject an email (if the policy of the sender is to reject on alignment failure)

 * DMARCReporting (enabled|disabled): Default value is enabled.
If set to enabled, enable reporting (which is the **r** in dma**r**c). Reporting is a very important part of the DMARC standard.
When enabled, you'll record information about email you receive from domains which have published a DMARC policy in a local
SQLite database (/var/lib/qpsmtpd/dmarc/reports.sqlite).
Then, once a day, you send the aggregate reports to the domain owner so they have feedback.
You can set this to disabled if you want to disable this feature

 * SPFRejectPolicy (0|1|2|3|4): Default value is 0. Set the policy to apply in case of SPF failure when the sender hasn't published a DMARC policy.
Note: this is only used when no DMARC policy is published by the sender.
If there's a DMARC policy, even a "p=none" one (meaning no reject), then the email won't be rejected, even on failed SPF tests.
   * 0: do not reject anything
   * 1: reject when SPF says fail
   * 2: reject when SPF says softfail
   * 3: reject when SPF says neutral
   * 4: reject when an error occurred (like a syntax error in SPF entry) or if no SPF entry is published
 * Inbound DKIM checks are only used by DMARC. No reject solely based on DKIM is supported
You can get more information at the wiki:

https://wiki.contribs.org/Email#Inbound_DKIM_.2F_SPF_.2F_DMARC

[Drifting]

Thanks Jim

Wonder when that came into force? must admit I am a great believer on leaving SME to do it's own thing, and update when it tells me.
Think I will be disabling until I know how to use the setting properly.

Regards Paul.

[Peasant]

Like you it caught me a bit by surprise, but from what I've read it is a new part of the upgraded qpsmtpd. The bit I posted from the wiki says that the default value for reporting is 'enabled' because 'Reporting is a very important part of the DMARC standard', so I'll leave mine as it is while I read up a bit more about it. From what I can gather, the emails being sent to admin are just letting you know that SME server has sent reports to the domain owners as per the DMARC standard.

[Drifting]

Like you it caught me a bit by surprise, but from what I've read it is a new part of the upgraded qpsmtpd. The bit I posted from the wiki says that the default value for reporting is 'enabled' because 'Reporting is a very important part of the DMARC standard', so I'll leave mine as it is while I read up a bit more about it. From what I can gather, the emails being sent to admin are just letting you know that SME server has sent reports to the domain owners as per the DMARC standard.

Hi Jim
Yes, can see that. But the whole thing falls flat when you start out with myservername.local, then add a few virtual domains. It tries to send out with the .local and fails! I could change the domain name, but all the certificates etc will then need replacing. ARGH.

Paul.

[janet]

Drifting

.... But the whole thing falls flat when you start out with myservername.local, then add a few virtual domains. It tries to send out with the .local and fails! I could change the domain name, but all the certificates etc will then need replacing.

It has NEVER been a good idea to use *.local domain names as external mail servers check for a resolvable domain.
Use a real domain, I suggest you do go through the trouble of changing the domain name & certificates.

[Stefano]

I could change the domain name, but all the certificates etc will then need replacing. ARGH.

since everything is done automagically, I can't see the issue here

[Drifting]

since everything is done automagically, I can't see the issue here

It's not the server, it is the devices connected to it. Outlook being a case in point, real pain with self certificates. Also iPhones of late I have had a few issues with. However, should have put the correct domain in the first place, but then I was moving from Exchange server in my defense

Paul.

[Stefano]

if you use letsencrypt certs you won't have any issue, never..

[Drifting]

if you use letsencrypt certs you won't have any issue, never..

Hi yes, does sound promising, but the parts that would bother me are "A state of flux" and "Beta" Oh and the 3 month renewal. Might be ok for a home server, but would be reluctant to try it on a business one.  I Tend to trust the guys from Koozali, so when I see a tried and tested contrib with their sanction, I will be there!

Regards Paul.

[Stefano]

letsencrypt is in stable release, no more beta
certs are renewed every 3 months automagically, no intervention needed, no advices/messages on the clients
the 3 months limitation is imposed by letsencrypt, but it's not a problem, at all (using it since an year on almost all my servers)

[Drifting]

letsencrypt is in stable release, no more beta
certs are renewed every 3 months automagically, no intervention needed, no advices/messages on the clients
the 3 months limitation is imposed by letsencrypt, but it's not a problem, at all (using it since an year on almost all my servers)

Really? Oh well, that changes it then. Assume the instructions in the How to's still stands good then? will give it a whirl, but as you can imagine the documentation does rather imply it was in Beat.

Thanks for the advice Stefano.

Paul.

[Stefano]

Really? Oh well, that changes it then. Assume the instructions in the How to's still stands good then? will give it a whirl, but as you can imagine the documentation does rather imply it was in Beat.

documentation has been deeply reorganized/rewrote

[Drifting]

Hi.

Just had a re read. Have a question for you? I do not host any websites on this server, they all point to my ISP's webserver. The only thing on here is my email server, and this does resolve straight to the SME 9.2 box. Can I create a certificate just for email? Was a little confused with that part in the documents (Me at fault no the docs)

Paul.

[Stefano]

you just need an externally resolvable hostname (like mail.yourdomain.tld) pointing to your SME and the port 80 open and redirected to your SME

that's all