Lookup failure

I don't know anything about qmail or running a mailing list. I tho't I
would try to poke this in here because nothing else works. I haven't
dutifully read some posts here to familiarize myself with your group;
sorry.

I'm on 2 mailing lists. One of them, kplug@kernel-panic.org uses ezmlm
qmail and I don't know what the other, junkfaxes-l@junkfax.com uses. My
problem is with the kplug list, from which my mail be delayed by hours
or days or bounced because it has been in the queue too long. This has
been the case for quite some time and I've been investigating it more
actively lately and posting to the mailing list group for others who
might have problems as well. No one else seems to notice anything going
on or concurring with my complaints. As far as I know, I never have
mail delayed or bounced by the junkfaxes daemon, which is a more active
list, nor have any friends been bounced that I know of.

What I mean by delayed is that I can tell from the headers when the item
got to kplug from the person sending it, and when I got it from kplug.

Recently the kplug daemon informed me that 18 items had bounced [over
time] and provided me with the bounce for one of them. It does that as
a form of probe to drop me if that bounces, and also to tell me which
message items I didn't get and how to go get them.

<snip>
Return-Path: <>
Received: (qmail 20956 invoked for bounce); 5 Nov 2003 09:36:09 -0000
Date: 5 Nov 2003 09:36:09 -0000
From: MAILER-DAEMON@sparkplug.kernel-panic.org
To: kplug-list-return-65662-@kernel-panic.org
Subject: failure notice

Hi. This is the qmail-send program at sparkplug.kernel-panic.org.
I'm afraid I wasn't able to deliver your message to the following
addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<munged@earthlink.net>:
CNAME lookup failed temporarily. (#4.4.3)
I'm not going to try again; this message has been in the queue too long.
<snip>

In addition, I did a little investigation of earthlink.net at dnsstuff:

http://www.dnsreport.com/tools/dnsre...=earthlink.net

<snip>
INFO MX Record Your 11 MX records are:

5 mx10.earthlink.net. [TTL=1800] IP=207.217.120.241 [TTL=1800]
5 mx1.earthlink.net. [TTL=1800] IP=207.217.125.16 [TTL=1800]
5 mx3.earthlink.net. [TTL=1800] IP=207.217.125.18 [TTL=1800]
5 mx4.earthlink.net. [TTL=1800] IP=207.217.125.19 [TTL=1800]
5 mx5.earthlink.net. [TTL=1800] IP=207.217.125.20 [TTL=1800]
5 mx6.earthlink.net. [TTL=1800] IP=207.217.125.21 [TTL=1800]
5 mx7.earthlink.net. [TTL=1800] IP=207.217.125.22 [TTL=1800]
5 mx01.earthlink.net. [TTL=1800] IP=207.217.120.29 [TTL=1800]
5 mx07.earthlink.net. [TTL=1800] IP=207.217.120.132 [TTL=1800]
5 mx08.earthlink.net. [TTL=1800] IP=207.217.120.201 [TTL=1800]
5 mx09.earthlink.net. [TTL=1800] IP=207.217.120.216 [TTL=1800]

<snip>
FAIL Connect to mail servers ERROR: I could not connect to one or more
of your mailservers:
mx10.earthlink.net: Timed out [Last data sent: QUIT ]
mx1.earthlink.net: Timed out [Last data sent: QUIT ]
mx3.earthlink.net: Timed out [Last data sent: QUIT ]
mx7.earthlink.net: Timed out [Last data sent: QUIT ]
mx01.earthlink.net: Timed out [Last data sent: QUIT ]
mx09.earthlink.net: Timed out [Last data sent: QUIT ]
</snip>

That looks pretty bad to me. If the poor little qmail ezmlm has to
struggle with that, it might give up before it can find one. It
shouldn't be that hard. But, somehow the junkfaxes-l copes with
whatever that problem is.

Besides 'rapping' about this in the kplug list, I've tried to get a
little response in the EL support group earthlink.support.email but
nothing is happening there either.

Do any of you qmail folks know anything I might pass on to the kplug
list guru to help it cope with the earthlink situation better?

--
Mike Easter

In article <dXHub.5661$sb4.2213@newsread2.news.pas.earthlink. net>, Mike Easter wrote:
><snip>
> Return-Path: <>
> Received: (qmail 20956 invoked for bounce); 5 Nov 2003 09:36:09 -0000
> Date: 5 Nov 2003 09:36:09 -0000
> From: MAILER-DAEMON@sparkplug.kernel-panic.org
> To: kplug-list-return-65662-@kernel-panic.org
> Subject: failure notice
>
> Hi. This is the qmail-send program at sparkplug.kernel-panic.org.
> I'm afraid I wasn't able to deliver your message to the following
> addresses.
> This is a permanent error; I've given up. Sorry it didn't work out.
]
>
><snip>
> FAIL Connect to mail servers ERROR: I could not connect to one or more
> of your mailservers:
> mx10.earthlink.net: Timed out [Last data sent: QUIT ]
> mx1.earthlink.net: Timed out [Last data sent: QUIT ]
> mx3.earthlink.net: Timed out [Last data sent: QUIT ]
> mx7.earthlink.net: Timed out [Last data sent: QUIT ]
> mx01.earthlink.net: Timed out [Last data sent: QUIT ]
> mx09.earthlink.net: Timed out [Last data sent: QUIT ]
></snip>
>
> Do any of you qmail folks know anything I might pass on to the kplug
> list guru to help it cope with the earthlink situation better?


Perhaps your problem is the location kernel-panic.org has
chosen. The public email system is splitting in two,
a spam tolerant side and a civilized side.
Increasingly, email administrators are realizing that no
legislature and no backbone carrier is going to help,
and we have to simply stop accepting email from the
spammy side. We firewall them, we blocklist them,
we reject them by domain. We have little choice.

According to DNS and tcptraceroute, kernel-panic.org
is on an ISP called American Digital Network, adnc.com.
Search groups.google.com for "adnc.com" and "spam"
and see what you get. Limit your search to the last
18 months. Perhaps Earthlink has had enough
of that abuse and firewalled adnc.com. Just a
possibility. It's also possible Earthlink's servers are
overloaded by all the Microsoft worms and they don't
respond quickly enough to keep kernel-panic.org's Qmail
engaged.



Cameron

Cameron L. Spitzer wrote:
> Perhaps your problem is the location kernel-panic.org has
> chosen. The public email system is splitting in two,
> a spam tolerant side and a civilized side.
> Increasingly, email administrators are realizing that no
> legislature and no backbone carrier is going to help,
> and we have to simply stop accepting email from the
> spammy side. We firewall them, we blocklist them,
> we reject them by domain. We have little choice.
>
> According to DNS and tcptraceroute, kernel-panic.org
> is on an ISP called American Digital Network, adnc.com.
> Search groups.google.com for "adnc.com" and "spam"
> and see what you get. Limit your search to the last
> 18 months. Perhaps Earthlink has had enough
> of that abuse and firewalled adnc.com. Just a
> possibility. It's also possible Earthlink's servers are
> overloaded by all the Microsoft worms and they don't
> respond quickly enough to keep kernel-panic.org's Qmail
> engaged.

Well, I don't know anything about qmail or mailing lists, but I know
quite a lot about blocklists and how they work. If EL had the kplug's
server's ip address on its known spam blocklist, it would be blocked,
not sometimes delayed more or less and not some kind of CNAME problem.
EL has several modes of blocking its spam, known spamsources versus
suspect spam - which is neither known spamsource ip and not user
whitelisted and which it chooses to use its style of challenge-response
'against'. This is not a ip address blocking problem.

Whatever the condition or reputation of adnc might be, the mail from
kplug comes from 206.251.247.139 rDNS sparkplug.kernel-panic.org which
is not listed on any of the popular dnsbl/s accessed by the openrbl.org
cumulative listings of 37 popular dnsbl/s, currently.

What I'm learning over at EL lately is that qmail 'has to' do that CNAME
lookup, which might not go well.

http://www.es.qmail.org/documentacio...ail-FAQ-6.html
<snip>
6.5 How do I deal with CNAME lookup failed temporarily?

The log showed that a message was deferred for this reason. Why is qmail
doing CNAME lookups, anyway?

Answer:

The SMTP standard does not permit aliased hostnames (see
http://pobox.com/~djb/im/cname.html), so qmail has to do a CNAME lookup
in DNS for every sender and recipient host. CNAME lookup failed
temporarily means that the relevant DNS server is down. It will try
again soon.
</snip>

The EL person seems to think that the qmail may be having trouble there
and that what I posted about the EL mx/s timing out isn't where the
error msg is coming from.- so he's blaming the situation on the
configuration at kplug, that the DNS servers in /etc/resolve.conf aren't
getting the CNAME.

Of course, I can't figure out why that should be -- but I'm a little
confused by that process described in the qmail docs above and also in
the link above over at pobox where it talks more about cname.


--
Mike Easter

On Wed, 19 Nov 2003 10:51:53 GMT, Mike Easter <MikeE@ster.invalid>
may have written:
[snip]

> Return-Path: <>
> Received: (qmail 20956 invoked for bounce); 5 Nov 2003 09:36:09 -0000
> Date: 5 Nov 2003 09:36:09 -0000
> From: MAILER-DAEMON@sparkplug.kernel-panic.org
> To: kplug-list-return-65662-@kernel-panic.org
> Subject: failure notice
>
> Hi. This is the qmail-send program at sparkplug.kernel-panic.org.
> I'm afraid I wasn't able to deliver your message to the following
> addresses.
> This is a permanent error; I've given up. Sorry it didn't work out.
>
><munged@earthlink.net>:
> CNAME lookup failed temporarily. (#4.4.3)
> I'm not going to try again; this message has been in the queue too long.
><snip>
>
> In addition, I did a little investigation of earthlink.net at dnsstuff:
>
> http://www.dnsreport.com/tools/dnsre...=earthlink.net
>
><snip>
> INFO MX Record Your 11 MX records are:
>
> 5 mx10.earthlink.net. [TTL=1800] IP=207.217.120.241 [TTL=1800]
> 5 mx1.earthlink.net. [TTL=1800] IP=207.217.125.16 [TTL=1800]
> 5 mx3.earthlink.net. [TTL=1800] IP=207.217.125.18 [TTL=1800]
> 5 mx4.earthlink.net. [TTL=1800] IP=207.217.125.19 [TTL=1800]
> 5 mx5.earthlink.net. [TTL=1800] IP=207.217.125.20 [TTL=1800]
> 5 mx6.earthlink.net. [TTL=1800] IP=207.217.125.21 [TTL=1800]
> 5 mx7.earthlink.net. [TTL=1800] IP=207.217.125.22 [TTL=1800]
> 5 mx01.earthlink.net. [TTL=1800] IP=207.217.120.29 [TTL=1800]
> 5 mx07.earthlink.net. [TTL=1800] IP=207.217.120.132 [TTL=1800]
> 5 mx08.earthlink.net. [TTL=1800] IP=207.217.120.201 [TTL=1800]
> 5 mx09.earthlink.net. [TTL=1800] IP=207.217.120.216 [TTL=1800]

In the Yet More Qmail Addons section of qmail.org:

Christopher K. Davis has a patch to accept oversize DNS packets which
works on both qmail's dns.c and tcpserver's dns.c. Or better yet,
install djbdns, which is more secure than bind.

http://www.ckdhr.com/ckd/qmail-103.patch

qmail has trouble with DNS responses greater than 512 bytes. The patch
above will fix the problem. Better yet, have them install djbdns as a
local cache on the machine that runs their mail, and point resolv.conf
to it.

Cheers,
--
Brian T Glenn
delink.net Internet Services