not all email received

[james]

Hello @trend-1 and welcome to the Cloudron forum

These days many anti-spam providers are also checking for IPv6.
Please check if IPv6 is enabled and configured.
Also, can you share a screenshot of your mail status form the Cloudron Dashboard?
Did you set the PTR records correctly? See https://docs.cloudron.io/email/#ptr-record

[trend-1]

Hi @james

• IPv6 is enabled and configured correctly
• PTR records are also correctly set

[james]

Hello @trend-1
Since you stated you are a new Cloudron user, I also assume your Cloudron is very fresh.
Meaning, also your mail servers IP reputation started from a negative value (all IPs do that, nothing to worry about).
This issue should resolve itself over some time.
Spamhaus states:

queries made via a public/open server may be blocked

Important keyword is may.

This is mostly due to the negative reputation which will get better pretty fast.
If you wish to get more details on this topic, here is the offical documentation from Spamhaus https://www.spamhaus.com/resource-center/help-for-spamhaus-projects-legacy-blocklist-users/#error-code-127-255-255-254-is-causing-problems-for-my-email-stream

---

As a temporary solution you could simply remove zen.spamhaus.org from your Mail ACL in the Mail Server settings in the Cloudron Dashboard.
There is also this great post from @d19dotca about spam filtering https://forum.cloudron.io/post/105256 if you'd like to improve on that part as well.

[trend-1]

Hi @james ,

Thank you for your reply. Although I am new to Cloudron I did have other servers on the same IP. The reputation is good. Checking on mxtoolbox shows all ok's.

I switched to Cloudron because of a more easy, polished and stable platform (am happy so far ). But I do need to send and receive emails.

I will check the information in the post about spam filtering. Looks interesting.

Still I would like to now the answer, if possible, to my question about what steps to follow when signing up to Spamhaus DQS and making relevant changes to the mail server configuration. What changes would I have to make in Cloudron ?
How to go about ? Or is that a no-go from Cloudron's perspective ?

[joseph]

@trend-1 For incoming mail, it works like this: Cloudron checks incoming email IP against SpamHaus . If found blocked, it will reject the email . So you have to actually check the sending server IP and not your own IP in SpamHaus! Also, you might have to check IPv6 and not IPv4 (this depends on how that external email server connected to yours).

Cloudron is default configured to use SpamHaus but SpamHaus has a "limitation" that it blocks IPv6 addresses wholesale (/64) . See this .

Now for the practical fix:

• You can disable IPv6 for just email on your server. Easiest way to test this is to remove the AAAA record for the MX domain in your DNS provider. If your MX is my.example.com , then go to your DNS provider UI and remove the associated AAAA record of my.example.com .

• Alternately, if you want to keep IPv6, disable SpamHaus. https://docs.cloudron.io/email/#dnsbl . Email -> Settings -> Mail ACL. Remove zen.spamhaus.org there. Ideally, you should put in some other provider which is proficient in IPv6 filtering there (if you find any, let us know , maybe we should make that the default...).

[trend-1]

Hi @joseph I will take a look at your proposed solutions. And see how I can implement that. (And if it works for my usecase.)

@joseph said in not all email received:

So you have to actually check the sending server IP and not your own IP in SpamHaus

When my server checks with Spamhaus on the incoming message (by making a request?) Spamhaus doesn't like it when this is done via a public/open resolver. Resulting in my server bouncing the incoming message.
The error message send to the sender clearly states (after clicking a link) that the problem is with the receiving server not the sending one. Hence my question.

[joseph]

@trend-1 said in not all email received:

When my server checks with Spamhaus on the incoming message (by making a request?) Spamhaus doesn't like it when this is done via a public/open resolver. Resulting in my server bouncing the incoming message.

Cloudron uses an internal resolver (unbound) for exactly this. Have you configured a custom DNS or customized unbound config by any chance?

You can verify like this on the server. If you use the system resolver:

root@my:/etc/unbound/unbound.conf.d# host 76.67.227.165.zen.spamhaus.org
76.67.227.165.zen.spamhaus.org has address 127.255.255.254

127.255.255.254 is error for NXDOMAIN (from the open resolver that DO uses by default).

Now, use unbound:

root@my:/etc/unbound/unbound.conf.d# host 76.67.227.165.zen.spamhaus.org 127.0.0.150
Using domain server:
Name: 127.0.0.150
Address: 127.0.0.150#53
Aliases: 

76.67.227.165.zen.spamhaus.org has address 127.0.0.11

127.0.0.11 means PBL (ISP policy blocks) , so we got a good response.

[girish]

I am adding a feature upstream to prefer ipv4 over ipv6 - https://github.com/haraka/Haraka/pull/3502

[trend-1]

@joseph Hi, sorry for the delay in my response. I checked my server according to the examples you gave and got the same results. So that seems to be correct.

What I gathered from this whole conversation (and my subsequent online searches) is that IPv6 is a bit of a problem for email. I guess we have to wait until some conventions are created/adopted.

@girish Thank you!
The initial error seemed indeed to be related to an IPv6 address.

Thanks everyone for helping and answering all my questions.

[girish]

@trend-1 our mail server was having the same trouble. DO has blocked outbound port 25 (ipv6) wholesale on the network and it doesn't look like they make exceptions. So, the mail server tried to send via ipv6 (haraka prefers ipv6 by default) and wait for sometime to fail. It then tried ipv4 after. For my other VPS, which has IPv6, email was getting blocked in various places anyway because of the "open resolver" issue of IPv6. So, I think 9.0.12 fixes it. Works on both my servers.