-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Brian, I've configured a backup mailrelay machine for MCS mail. Could you add mailrelay-bak.mcs.anl.gov to your configs any place newman.mcs.anl.gov exists? Thanks, Ken -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkwP9nsACgkQvRJB9CBtvwgo9wCgoX/lpvpA1T7lCrfO3PpHecKL RMEAoIP2q/qhf1nLfsDb3qNxlYBoJroT =u1ey -----END PGP SIGNATURE-----
My reading of postfix configs and such tell me that we can't have multiple entries in /etc/postfix/transport for the same rules. One solution I see presented is to have a hostname that resolves to both. Since mailrelay.mcs.anl.gov is a CNAME on newman, we could instead make it an A record to point to both newman and mailrelay-bak. On Jun 9, 2010, at 3:15 PM, Kenneth Raffenetti wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Brian,
I've configured a backup mailrelay machine for MCS mail. Could you add mailrelay-bak.mcs.anl.gov to your configs any place newman.mcs.anl.gov exists?
Thanks, Ken -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkwP9nsACgkQvRJB9CBtvwgo9wCgoX/lpvpA1T7lCrfO3PpHecKL RMEAoIP2q/qhf1nLfsDb3qNxlYBoJroT =u1ey -----END PGP SIGNATURE-----
== Craig
Right now, the transport map is set to go to [mailrelay.mcs.anl.gov]. The [] prevents it from doing MX lookups, but I'm not sure how it handles it if the A record resolves to multiple places. I can help do some testing if you'd like. One thing that might help (maybe) is the smtp_fallback_relay parameter that specifies a fallback relay for an instance in master.cf. We could possibly set up some sort of MCS-specific transport with a fallback relay, but I don't know if that would work properly or not. We're using the fallback relay on the pager servers to force it to rate limit, but it's pretty kludgy. Brian On Wed, Jun 09, 2010 at 05:27:43PM -0500, Craig Stacey wrote:
My reading of postfix configs and such tell me that we can't have multiple entries in /etc/postfix/transport for the same rules. One solution I see presented is to have a hostname that resolves to both. Since mailrelay.mcs.anl.gov is a CNAME on newman, we could instead make it an A record to point to both newman and mailrelay-bak.
On Jun 9, 2010, at 3:15 PM, Kenneth Raffenetti wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Brian,
I've configured a backup mailrelay machine for MCS mail. Could you add mailrelay-bak.mcs.anl.gov to your configs any place newman.mcs.anl.gov exists?
Thanks, Ken -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkwP9nsACgkQvRJB9CBtvwgo9wCgoX/lpvpA1T7lCrfO3PpHecKL RMEAoIP2q/qhf1nLfsDb3qNxlYBoJroT =u1ey -----END PGP SIGNATURE-----
== Craig
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
My understanding is that setting the relay to a dns round-robin address is fine, although preventing the mtu from doing mx lookups would make delivery fail if dns happened to point mailgateway to newman for and newman was down. Shouldn't we just have two mx records set for mcs.anl.gov? one for newman and one for mailrelay-bak? curious: why are we suppressing mx lookups for mailrelay? curious, I thought this was used more to keep mail loops from happening when the MTA pointed to an MX living on the same IP ... -- max On Jun 9, 2010, at 5:57 PM, Brian Sebby wrote:
Right now, the transport map is set to go to [mailrelay.mcs.anl.gov]. The [] prevents it from doing MX lookups, but I'm not sure how it handles it if the A record resolves to multiple places. I can help do some testing if you'd like.
One thing that might help (maybe) is the smtp_fallback_relay parameter that specifies a fallback relay for an instance in master.cf. We could possibly set up some sort of MCS-specific transport with a fallback relay, but I don't know if that would work properly or not. We're using the fallback relay on the pager servers to force it to rate limit, but it's pretty kludgy.
Brian
On Wed, Jun 09, 2010 at 05:27:43PM -0500, Craig Stacey wrote:
My reading of postfix configs and such tell me that we can't have multiple entries in /etc/postfix/transport for the same rules. One solution I see presented is to have a hostname that resolves to both. Since mailrelay.mcs.anl.gov is a CNAME on newman, we could instead make it an A record to point to both newman and mailrelay-bak.
On Jun 9, 2010, at 3:15 PM, Kenneth Raffenetti wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Brian,
I've configured a backup mailrelay machine for MCS mail. Could you add mailrelay-bak.mcs.anl.gov to your configs any place newman.mcs.anl.gov exists?
Thanks, Ken -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkwP9nsACgkQvRJB9CBtvwgo9wCgoX/lpvpA1T7lCrfO3PpHecKL RMEAoIP2q/qhf1nLfsDb3qNxlYBoJroT =u1ey -----END PGP SIGNATURE-----
== Craig
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
MCS is now behind the Ironport systems, and the MX record that the lab-wide mailrelay systems see is mailgateway.anl.gov and mailgateway-bak.anl.gov. We suppress the MX lookups to avoid the mail loop that would be caused when mail gets delivered to mailrelay.anl.gov and mailrelay-bak.anl.gov after it hits the Ironport systems (mailgateway*). We avoid this for most of our lab systems by having a split DNS; the mailrelay servers see our internal DNS view, so once external mail comes in to the mailgateway servers and is passed off to mailrelay, they then deliver mail to the proper MX host using the internal records. If MCS set up a split DNS that we could use, that would simply mail delivery greatly. Brian On Thu, Jun 10, 2010 at 10:30:39AM -0500, Max trefonides wrote:
My understanding is that setting the relay to a dns round-robin address is fine, although preventing the mtu from doing mx lookups would make delivery fail if dns happened to point mailgateway to newman for and newman was down. Shouldn't we just have two mx records set for mcs.anl.gov? one for newman and one for mailrelay-bak?
curious: why are we suppressing mx lookups for mailrelay? curious, I thought this was used more to keep mail loops from happening when the MTA pointed to an MX living on the same IP ...
-- max
On Jun 9, 2010, at 5:57 PM, Brian Sebby wrote:
Right now, the transport map is set to go to [mailrelay.mcs.anl.gov]. The [] prevents it from doing MX lookups, but I'm not sure how it handles it if the A record resolves to multiple places. I can help do some testing if you'd like.
One thing that might help (maybe) is the smtp_fallback_relay parameter that specifies a fallback relay for an instance in master.cf. We could possibly set up some sort of MCS-specific transport with a fallback relay, but I don't know if that would work properly or not. We're using the fallback relay on the pager servers to force it to rate limit, but it's pretty kludgy.
Brian
On Wed, Jun 09, 2010 at 05:27:43PM -0500, Craig Stacey wrote:
My reading of postfix configs and such tell me that we can't have multiple entries in /etc/postfix/transport for the same rules. One solution I see presented is to have a hostname that resolves to both. Since mailrelay.mcs.anl.gov is a CNAME on newman, we could instead make it an A record to point to both newman and mailrelay-bak.
On Jun 9, 2010, at 3:15 PM, Kenneth Raffenetti wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Brian,
I've configured a backup mailrelay machine for MCS mail. Could you add mailrelay-bak.mcs.anl.gov to your configs any place newman.mcs.anl.gov exists?
Thanks, Ken -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkwP9nsACgkQvRJB9CBtvwgo9wCgoX/lpvpA1T7lCrfO3PpHecKL RMEAoIP2q/qhf1nLfsDb3qNxlYBoJroT =u1ey -----END PGP SIGNATURE-----
== Craig
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We should be able to do split DNS. I'll work on it. Ken Brian Sebby wrote:
MCS is now behind the Ironport systems, and the MX record that the lab-wide mailrelay systems see is mailgateway.anl.gov and mailgateway-bak.anl.gov. We suppress the MX lookups to avoid the mail loop that would be caused when mail gets delivered to mailrelay.anl.gov and mailrelay-bak.anl.gov after it hits the Ironport systems (mailgateway*). We avoid this for most of our lab systems by having a split DNS; the mailrelay servers see our internal DNS view, so once external mail comes in to the mailgateway servers and is passed off to mailrelay, they then deliver mail to the proper MX host using the internal records.
If MCS set up a split DNS that we could use, that would simply mail delivery greatly.
Brian
On Thu, Jun 10, 2010 at 10:30:39AM -0500, Max trefonides wrote:
My understanding is that setting the relay to a dns round-robin address is fine, although preventing the mtu from doing mx lookups would make delivery fail if dns happened to point mailgateway to newman for and newman was down. Shouldn't we just have two mx records set for mcs.anl.gov? one for newman and one for mailrelay-bak?
curious: why are we suppressing mx lookups for mailrelay? curious, I thought this was used more to keep mail loops from happening when the MTA pointed to an MX living on the same IP ...
-- max
On Jun 9, 2010, at 5:57 PM, Brian Sebby wrote:
Right now, the transport map is set to go to [mailrelay.mcs.anl.gov]. The [] prevents it from doing MX lookups, but I'm not sure how it handles it if the A record resolves to multiple places. I can help do some testing if you'd like.
One thing that might help (maybe) is the smtp_fallback_relay parameter that specifies a fallback relay for an instance in master.cf. We could possibly set up some sort of MCS-specific transport with a fallback relay, but I don't know if that would work properly or not. We're using the fallback relay on the pager servers to force it to rate limit, but it's pretty kludgy.
Brian
On Wed, Jun 09, 2010 at 05:27:43PM -0500, Craig Stacey wrote:
My reading of postfix configs and such tell me that we can't have multiple entries in /etc/postfix/transport for the same rules. One solution I see presented is to have a hostname that resolves to both. Since mailrelay.mcs.anl.gov is a CNAME on newman, we could instead make it an A record to point to both newman and mailrelay-bak.
On Jun 9, 2010, at 3:15 PM, Kenneth Raffenetti wrote:
Brian,
I've configured a backup mailrelay machine for MCS mail. Could you add mailrelay-bak.mcs.anl.gov to your configs any place newman.mcs.anl.gov exists?
Thanks, Ken
== Craig -- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkwRK3cACgkQvRJB9CBtvwjYvACfd5z+wkRI895GKvxmu3SkRLwy AKEAoLedVTfY+G1QH8Euq1KJoV4yrLsR =w5IU -----END PGP SIGNATURE-----
I'm going to add Barry Finkel to this thread - having a split DNS may have an impact on other systems as well, and Barry would be the best person to know what those might be. If we did go to a split DNS where servers on-site have a different MX record for MCS than external hosts, we could eliminate the MCS transport maps entirely. Brian On Thu, Jun 10, 2010 at 01:14:15PM -0500, Kenneth Raffenetti wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
We should be able to do split DNS. I'll work on it.
Ken
Brian Sebby wrote:
MCS is now behind the Ironport systems, and the MX record that the lab-wide mailrelay systems see is mailgateway.anl.gov and mailgateway-bak.anl.gov. We suppress the MX lookups to avoid the mail loop that would be caused when mail gets delivered to mailrelay.anl.gov and mailrelay-bak.anl.gov after it hits the Ironport systems (mailgateway*). We avoid this for most of our lab systems by having a split DNS; the mailrelay servers see our internal DNS view, so once external mail comes in to the mailgateway servers and is passed off to mailrelay, they then deliver mail to the proper MX host using the internal records.
If MCS set up a split DNS that we could use, that would simply mail delivery greatly.
Brian
On Thu, Jun 10, 2010 at 10:30:39AM -0500, Max trefonides wrote:
My understanding is that setting the relay to a dns round-robin address is fine, although preventing the mtu from doing mx lookups would make delivery fail if dns happened to point mailgateway to newman for and newman was down. Shouldn't we just have two mx records set for mcs.anl.gov? one for newman and one for mailrelay-bak?
curious: why are we suppressing mx lookups for mailrelay? curious, I thought this was used more to keep mail loops from happening when the MTA pointed to an MX living on the same IP ...
-- max
On Jun 9, 2010, at 5:57 PM, Brian Sebby wrote:
Right now, the transport map is set to go to [mailrelay.mcs.anl.gov]. The [] prevents it from doing MX lookups, but I'm not sure how it handles it if the A record resolves to multiple places. I can help do some testing if you'd like.
One thing that might help (maybe) is the smtp_fallback_relay parameter that specifies a fallback relay for an instance in master.cf. We could possibly set up some sort of MCS-specific transport with a fallback relay, but I don't know if that would work properly or not. We're using the fallback relay on the pager servers to force it to rate limit, but it's pretty kludgy.
Brian
On Wed, Jun 09, 2010 at 05:27:43PM -0500, Craig Stacey wrote:
My reading of postfix configs and such tell me that we can't have multiple entries in /etc/postfix/transport for the same rules. One solution I see presented is to have a hostname that resolves to both. Since mailrelay.mcs.anl.gov is a CNAME on newman, we could instead make it an A record to point to both newman and mailrelay-bak.
On Jun 9, 2010, at 3:15 PM, Kenneth Raffenetti wrote:
Brian,
I've configured a backup mailrelay machine for MCS mail. Could you add mailrelay-bak.mcs.anl.gov to your configs any place newman.mcs.anl.gov exists?
Thanks, Ken
== Craig -- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkwRK3cACgkQvRJB9CBtvwjYvACfd5z+wkRI895GKvxmu3SkRLwy AKEAoLedVTfY+G1QH8Euq1KJoV4yrLsR =w5IU -----END PGP SIGNATURE-----
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
We have the capability to do split lookups, but I think smtp_fallback_relay is what we want. I'll look at implementing it on our side as well on our mailing list server. On Jun 10, 2010, at 11:25 AM, Brian Sebby wrote:
MCS is now behind the Ironport systems, and the MX record that the lab-wide mailrelay systems see is mailgateway.anl.gov and mailgateway- bak.anl.gov. We suppress the MX lookups to avoid the mail loop that would be caused when mail gets delivered to mailrelay.anl.gov and mailrelay-bak.anl.gov after it hits the Ironport systems (mailgateway*). We avoid this for most of our lab systems by having a split DNS; the mailrelay servers see our internal DNS view, so once external mail comes in to the mailgateway servers and is passed off to mailrelay, they then deliver mail to the proper MX host using the internal records.
If MCS set up a split DNS that we could use, that would simply mail delivery greatly.
Brian
On Thu, Jun 10, 2010 at 10:30:39AM -0500, Max trefonides wrote:
My understanding is that setting the relay to a dns round-robin address is fine, although preventing the mtu from doing mx lookups would make delivery fail if dns happened to point mailgateway to newman for and newman was down. Shouldn't we just have two mx records set for mcs.anl.gov? one for newman and one for mailrelay- bak?
curious: why are we suppressing mx lookups for mailrelay? curious, I thought this was used more to keep mail loops from happening when the MTA pointed to an MX living on the same IP ...
-- max
On Jun 9, 2010, at 5:57 PM, Brian Sebby wrote:
Right now, the transport map is set to go to [mailrelay.mcs.anl.gov]. The [] prevents it from doing MX lookups, but I'm not sure how it handles it if the A record resolves to multiple places. I can help do some testing if you'd like.
One thing that might help (maybe) is the smtp_fallback_relay parameter that specifies a fallback relay for an instance in master.cf. We could possibly set up some sort of MCS-specific transport with a fallback relay, but I don't know if that would work properly or not. We're using the fallback relay on the pager servers to force it to rate limit, but it's pretty kludgy.
Brian
On Wed, Jun 09, 2010 at 05:27:43PM -0500, Craig Stacey wrote:
My reading of postfix configs and such tell me that we can't have multiple entries in /etc/postfix/transport for the same rules. One solution I see presented is to have a hostname that resolves to both. Since mailrelay.mcs.anl.gov is a CNAME on newman, we could instead make it an A record to point to both newman and mailrelay-bak.
On Jun 9, 2010, at 3:15 PM, Kenneth Raffenetti wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Brian,
I've configured a backup mailrelay machine for MCS mail. Could you add mailrelay-bak.mcs.anl.gov to your configs any place newman.mcs.anl.gov exists?
Thanks, Ken -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkwP9nsACgkQvRJB9CBtvwgo9wCgoX/lpvpA1T7lCrfO3PpHecKL RMEAoIP2q/qhf1nLfsDb3qNxlYBoJroT =u1ey -----END PGP SIGNATURE-----
== Craig
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
== Craig
Actually, on further reading and thought, smtp_fallback_relay is not what we want, since it is a catch-all and not domain-specific. If Ken's going to get the split view set up, we'll use that. On Jun 10, 2010, at 3:47 PM, Craig Stacey wrote:
We have the capability to do split lookups, but I think smtp_fallback_relay is what we want. I'll look at implementing it on our side as well on our mailing list server.
On Jun 10, 2010, at 11:25 AM, Brian Sebby wrote:
MCS is now behind the Ironport systems, and the MX record that the lab-wide mailrelay systems see is mailgateway.anl.gov and mailgateway- bak.anl.gov. We suppress the MX lookups to avoid the mail loop that would be caused when mail gets delivered to mailrelay.anl.gov and mailrelay-bak.anl.gov after it hits the Ironport systems (mailgateway*). We avoid this for most of our lab systems by having a split DNS; the mailrelay servers see our internal DNS view, so once external mail comes in to the mailgateway servers and is passed off to mailrelay, they then deliver mail to the proper MX host using the internal records.
If MCS set up a split DNS that we could use, that would simply mail delivery greatly.
Brian
On Thu, Jun 10, 2010 at 10:30:39AM -0500, Max trefonides wrote:
My understanding is that setting the relay to a dns round-robin address is fine, although preventing the mtu from doing mx lookups would make delivery fail if dns happened to point mailgateway to newman for and newman was down. Shouldn't we just have two mx records set for mcs.anl.gov? one for newman and one for mailrelay- bak?
curious: why are we suppressing mx lookups for mailrelay? curious, I thought this was used more to keep mail loops from happening when the MTA pointed to an MX living on the same IP ...
-- max
On Jun 9, 2010, at 5:57 PM, Brian Sebby wrote:
Right now, the transport map is set to go to [mailrelay.mcs.anl.gov]. The [] prevents it from doing MX lookups, but I'm not sure how it handles it if the A record resolves to multiple places. I can help do some testing if you'd like.
One thing that might help (maybe) is the smtp_fallback_relay parameter that specifies a fallback relay for an instance in master.cf. We could possibly set up some sort of MCS-specific transport with a fallback relay, but I don't know if that would work properly or not. We're using the fallback relay on the pager servers to force it to rate limit, but it's pretty kludgy.
Brian
On Wed, Jun 09, 2010 at 05:27:43PM -0500, Craig Stacey wrote:
My reading of postfix configs and such tell me that we can't have multiple entries in /etc/postfix/transport for the same rules. One solution I see presented is to have a hostname that resolves to both. Since mailrelay.mcs.anl.gov is a CNAME on newman, we could instead make it an A record to point to both newman and mailrelay-bak.
On Jun 9, 2010, at 3:15 PM, Kenneth Raffenetti wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Brian,
I've configured a backup mailrelay machine for MCS mail. Could you add mailrelay-bak.mcs.anl.gov to your configs any place newman.mcs.anl.gov exists?
Thanks, Ken -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkwP9nsACgkQvRJB9CBtvwgo9wCgoX/lpvpA1T7lCrfO3PpHecKL RMEAoIP2q/qhf1nLfsDb3qNxlYBoJroT =u1ey -----END PGP SIGNATURE-----
== Craig
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
== Craig
== Craig
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 So I've setup split views on antares based CIS configs. For the time being, there are very few differences in the internal/external MCS zones. antares:/var/named/xt# diff mcs.anl.gov mcs.anl.gov.external 2802,2803d2801 < consolo A 140.221.9.195 < MX 30 mailgateway.anl.gov. 3813a3812
foo CNAME kyuss 4335,4337d4333 < $ORIGIN inside.mcs.anl.gov. < vserver A 10.140.224.16 < $ORIGIN mcs.anl.gov.
consolo and vserver.inside are only resolvable from inside, and a cname for my desktop is only resolvable from outside. If I understand the mailrelay situation correctly, we want to change the internal MX records for mcs.anl.gov to be: 10 mailrelay.mcs.anl.gov 20 mailrelay-bak.mcs.anl.gov Are they additional steps we need to take before enabling that? Firewall rules for the mailrelays? Ken Craig Stacey wrote:
Actually, on further reading and thought, smtp_fallback_relay is not what we want, since it is a catch-all and not domain-specific.
If Ken's going to get the split view set up, we'll use that.
On Jun 10, 2010, at 3:47 PM, Craig Stacey wrote:
We have the capability to do split lookups, but I think smtp_fallback_relay is what we want. I'll look at implementing it on our side as well on our mailing list server.
On Jun 10, 2010, at 11:25 AM, Brian Sebby wrote:
MCS is now behind the Ironport systems, and the MX record that the lab-wide mailrelay systems see is mailgateway.anl.gov and mailgateway-bak.anl.gov. We suppress the MX lookups to avoid the mail loop that would be caused when mail gets delivered to mailrelay.anl.gov and mailrelay-bak.anl.gov after it hits the Ironport systems (mailgateway*). We avoid this for most of our lab systems by having a split DNS; the mailrelay servers see our internal DNS view, so once external mail comes in to the mailgateway servers and is passed off to mailrelay, they then deliver mail to the proper MX host using the internal records.
If MCS set up a split DNS that we could use, that would simply mail delivery greatly.
Brian
On Thu, Jun 10, 2010 at 10:30:39AM -0500, Max trefonides wrote:
My understanding is that setting the relay to a dns round-robin address is fine, although preventing the mtu from doing mx lookups would make delivery fail if dns happened to point mailgateway to newman for and newman was down. Shouldn't we just have two mx records set for mcs.anl.gov? one for newman and one for mailrelay-bak?
curious: why are we suppressing mx lookups for mailrelay? curious, I thought this was used more to keep mail loops from happening when the MTA pointed to an MX living on the same IP ...
-- max
On Jun 9, 2010, at 5:57 PM, Brian Sebby wrote:
Right now, the transport map is set to go to [mailrelay.mcs.anl.gov]. The [] prevents it from doing MX lookups, but I'm not sure how it handles it if the A record resolves to multiple places. I can help do some testing if you'd like.
One thing that might help (maybe) is the smtp_fallback_relay parameter that specifies a fallback relay for an instance in master.cf. We could possibly set up some sort of MCS-specific transport with a fallback relay, but I don't know if that would work properly or not. We're using the fallback relay on the pager servers to force it to rate limit, but it's pretty kludgy.
Brian
On Wed, Jun 09, 2010 at 05:27:43PM -0500, Craig Stacey wrote:
My reading of postfix configs and such tell me that we can't have multiple entries in /etc/postfix/transport for the same rules. One solution I see presented is to have a hostname that resolves to both. Since mailrelay.mcs.anl.gov is a CNAME on newman, we could instead make it an A record to point to both newman and mailrelay-bak.
On Jun 9, 2010, at 3:15 PM, Kenneth Raffenetti wrote:
Brian,
I've configured a backup mailrelay machine for MCS mail. Could you add mailrelay-bak.mcs.anl.gov to your configs any place newman.mcs.anl.gov exists?
Thanks, Ken
== Craig
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
== Craig
== Craig
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkwjcN8ACgkQvRJB9CBtvwgOgwCgjkBv9/XgtMIvfWnu3e0oh0x8 +M4AnRJp/gLvT2t/i81KmE38piUzhMat =O6vG -----END PGP SIGNATURE-----
I have the ability to do split DNS views now and would like to move forward with the changes. I want to refresh my memory on what needs to happen, though. IIRC, we change the MX records for mcs.anl.gov to use mailrelay and mailrelay-bak.mcs.anl.gov for inside ANL only. That way CIS can pass mail to MCS with DNS lookups rather than transport maps and we have 2 redundant mailrelays. Does this sound right? Ken On 06/10/2010 03:53 PM, Craig Stacey wrote:
Actually, on further reading and thought, smtp_fallback_relay is not what we want, since it is a catch-all and not domain-specific.
If Ken's going to get the split view set up, we'll use that.
On Jun 10, 2010, at 3:47 PM, Craig Stacey wrote:
We have the capability to do split lookups, but I think smtp_fallback_relay is what we want. I'll look at implementing it on our side as well on our mailing list server.
On Jun 10, 2010, at 11:25 AM, Brian Sebby wrote:
MCS is now behind the Ironport systems, and the MX record that the lab-wide mailrelay systems see is mailgateway.anl.gov and mailgateway-bak.anl.gov. We suppress the MX lookups to avoid the mail loop that would be caused when mail gets delivered to mailrelay.anl.gov and mailrelay-bak.anl.gov after it hits the Ironport systems (mailgateway*). We avoid this for most of our lab systems by having a split DNS; the mailrelay servers see our internal DNS view, so once external mail comes in to the mailgateway servers and is passed off to mailrelay, they then deliver mail to the proper MX host using the internal records.
If MCS set up a split DNS that we could use, that would simply mail delivery greatly.
Brian
On Thu, Jun 10, 2010 at 10:30:39AM -0500, Max trefonides wrote:
My understanding is that setting the relay to a dns round-robin address is fine, although preventing the mtu from doing mx lookups would make delivery fail if dns happened to point mailgateway to newman for and newman was down. Shouldn't we just have two mx records set for mcs.anl.gov? one for newman and one for mailrelay-bak?
curious: why are we suppressing mx lookups for mailrelay? curious, I thought this was used more to keep mail loops from happening when the MTA pointed to an MX living on the same IP ...
-- max
On Jun 9, 2010, at 5:57 PM, Brian Sebby wrote:
Right now, the transport map is set to go to [mailrelay.mcs.anl.gov]. The [] prevents it from doing MX lookups, but I'm not sure how it handles it if the A record resolves to multiple places. I can help do some testing if you'd like.
One thing that might help (maybe) is the smtp_fallback_relay parameter that specifies a fallback relay for an instance in master.cf. We could possibly set up some sort of MCS-specific transport with a fallback relay, but I don't know if that would work properly or not. We're using the fallback relay on the pager servers to force it to rate limit, but it's pretty kludgy.
Brian
On Wed, Jun 09, 2010 at 05:27:43PM -0500, Craig Stacey wrote:
My reading of postfix configs and such tell me that we can't have multiple entries in /etc/postfix/transport for the same rules. One solution I see presented is to have a hostname that resolves to both. Since mailrelay.mcs.anl.gov is a CNAME on newman, we could instead make it an A record to point to both newman and mailrelay-bak.
On Jun 9, 2010, at 3:15 PM, Kenneth Raffenetti wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Brian,
I've configured a backup mailrelay machine for MCS mail. Could you add mailrelay-bak.mcs.anl.gov to your configs any place newman.mcs.anl.gov exists?
Thanks, Ken -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkwP9nsACgkQvRJB9CBtvwgo9wCgoX/lpvpA1T7lCrfO3PpHecKL RMEAoIP2q/qhf1nLfsDb3qNxlYBoJroT =u1ey -----END PGP SIGNATURE-----
== Craig
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
== Craig
== Craig
Except not just mcs.anl.gov, but every domain we handle mail for. On Aug 23, 2010, at 10:34 AM, Kenneth Raffenetti wrote:
I have the ability to do split DNS views now and would like to move forward with the changes. I want to refresh my memory on what needs to happen, though.
IIRC, we change the MX records for mcs.anl.gov to use mailrelay and mailrelay-bak.mcs.anl.gov for inside ANL only. That way CIS can pass mail to MCS with DNS lookups rather than transport maps and we have 2 redundant mailrelays.
Does this sound right?
Ken
On 06/10/2010 03:53 PM, Craig Stacey wrote:
Actually, on further reading and thought, smtp_fallback_relay is not what we want, since it is a catch-all and not domain-specific.
If Ken's going to get the split view set up, we'll use that.
On Jun 10, 2010, at 3:47 PM, Craig Stacey wrote:
We have the capability to do split lookups, but I think smtp_fallback_relay is what we want. I'll look at implementing it on our side as well on our mailing list server.
On Jun 10, 2010, at 11:25 AM, Brian Sebby wrote:
MCS is now behind the Ironport systems, and the MX record that the lab-wide mailrelay systems see is mailgateway.anl.gov and mailgateway-bak.anl.gov. We suppress the MX lookups to avoid the mail loop that would be caused when mail gets delivered to mailrelay.anl.gov and mailrelay-bak.anl.gov after it hits the Ironport systems (mailgateway*). We avoid this for most of our lab systems by having a split DNS; the mailrelay servers see our internal DNS view, so once external mail comes in to the mailgateway servers and is passed off to mailrelay, they then deliver mail to the proper MX host using the internal records.
If MCS set up a split DNS that we could use, that would simply mail delivery greatly.
Brian
On Thu, Jun 10, 2010 at 10:30:39AM -0500, Max trefonides wrote:
My understanding is that setting the relay to a dns round-robin address is fine, although preventing the mtu from doing mx lookups would make delivery fail if dns happened to point mailgateway to newman for and newman was down. Shouldn't we just have two mx records set for mcs.anl.gov? one for newman and one for mailrelay-bak?
curious: why are we suppressing mx lookups for mailrelay? curious, I thought this was used more to keep mail loops from happening when the MTA pointed to an MX living on the same IP ...
-- max
On Jun 9, 2010, at 5:57 PM, Brian Sebby wrote:
Right now, the transport map is set to go to [mailrelay.mcs.anl.gov]. The [] prevents it from doing MX lookups, but I'm not sure how it handles it if the A record resolves to multiple places. I can help do some testing if you'd like.
One thing that might help (maybe) is the smtp_fallback_relay parameter that specifies a fallback relay for an instance in master.cf. We could possibly set up some sort of MCS-specific transport with a fallback relay, but I don't know if that would work properly or not. We're using the fallback relay on the pager servers to force it to rate limit, but it's pretty kludgy.
Brian
On Wed, Jun 09, 2010 at 05:27:43PM -0500, Craig Stacey wrote:
My reading of postfix configs and such tell me that we can't have multiple entries in /etc/postfix/transport for the same rules. One solution I see presented is to have a hostname that resolves to both. Since mailrelay.mcs.anl.gov is a CNAME on newman, we could instead make it an A record to point to both newman and mailrelay-bak.
On Jun 9, 2010, at 3:15 PM, Kenneth Raffenetti wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Brian,
I've configured a backup mailrelay machine for MCS mail. Could you add mailrelay-bak.mcs.anl.gov to your configs any place newman.mcs.anl.gov exists?
Thanks, Ken -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkwP9nsACgkQvRJB9CBtvwgo9wCgoX/lpvpA1T7lCrfO3PpHecKL RMEAoIP2q/qhf1nLfsDb3qNxlYBoJroT =u1ey -----END PGP SIGNATURE-----
== Craig
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
== Craig
== Craig
== Craig
Sigh. I need to think more about the host specific MX records a little more. Ken On 08/23/2010 10:55 AM, Craig Stacey wrote:
Except not just mcs.anl.gov, but every domain we handle mail for.
On Aug 23, 2010, at 10:34 AM, Kenneth Raffenetti wrote:
I have the ability to do split DNS views now and would like to move forward with the changes. I want to refresh my memory on what needs to happen, though.
IIRC, we change the MX records for mcs.anl.gov to use mailrelay and mailrelay-bak.mcs.anl.gov for inside ANL only. That way CIS can pass mail to MCS with DNS lookups rather than transport maps and we have 2 redundant mailrelays.
Does this sound right?
Ken
On 06/10/2010 03:53 PM, Craig Stacey wrote:
Actually, on further reading and thought, smtp_fallback_relay is not what we want, since it is a catch-all and not domain-specific.
If Ken's going to get the split view set up, we'll use that.
On Jun 10, 2010, at 3:47 PM, Craig Stacey wrote:
We have the capability to do split lookups, but I think smtp_fallback_relay is what we want. I'll look at implementing it on our side as well on our mailing list server.
On Jun 10, 2010, at 11:25 AM, Brian Sebby wrote:
MCS is now behind the Ironport systems, and the MX record that the lab-wide mailrelay systems see is mailgateway.anl.gov and mailgateway-bak.anl.gov. We suppress the MX lookups to avoid the mail loop that would be caused when mail gets delivered to mailrelay.anl.gov and mailrelay-bak.anl.gov after it hits the Ironport systems (mailgateway*). We avoid this for most of our lab systems by having a split DNS; the mailrelay servers see our internal DNS view, so once external mail comes in to the mailgateway servers and is passed off to mailrelay, they then deliver mail to the proper MX host using the internal records.
If MCS set up a split DNS that we could use, that would simply mail delivery greatly.
Brian
On Thu, Jun 10, 2010 at 10:30:39AM -0500, Max trefonides wrote:
My understanding is that setting the relay to a dns round-robin address is fine, although preventing the mtu from doing mx lookups would make delivery fail if dns happened to point mailgateway to newman for and newman was down. Shouldn't we just have two mx records set for mcs.anl.gov? one for newman and one for mailrelay-bak?
curious: why are we suppressing mx lookups for mailrelay? curious, I thought this was used more to keep mail loops from happening when the MTA pointed to an MX living on the same IP ...
-- max
On Jun 9, 2010, at 5:57 PM, Brian Sebby wrote:
Right now, the transport map is set to go to [mailrelay.mcs.anl.gov]. The [] prevents it from doing MX lookups, but I'm not sure how it handles it if the A record resolves to multiple places. I can help do some testing if you'd like.
One thing that might help (maybe) is the smtp_fallback_relay parameter that specifies a fallback relay for an instance in master.cf. We could possibly set up some sort of MCS-specific transport with a fallback relay, but I don't know if that would work properly or not. We're using the fallback relay on the pager servers to force it to rate limit, but it's pretty kludgy.
Brian
On Wed, Jun 09, 2010 at 05:27:43PM -0500, Craig Stacey wrote:
My reading of postfix configs and such tell me that we can't have multiple entries in /etc/postfix/transport for the same rules. One solution I see presented is to have a hostname that resolves to both. Since mailrelay.mcs.anl.gov is a CNAME on newman, we could instead make it an A record to point to both newman and mailrelay-bak.
On Jun 9, 2010, at 3:15 PM, Kenneth Raffenetti wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Brian,
I've configured a backup mailrelay machine for MCS mail. Could you add mailrelay-bak.mcs.anl.gov to your configs any place newman.mcs.anl.gov exists?
Thanks, Ken -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkwP9nsACgkQvRJB9CBtvwgo9wCgoX/lpvpA1T7lCrfO3PpHecKL RMEAoIP2q/qhf1nLfsDb3qNxlYBoJroT =u1ey -----END PGP SIGNATURE-----
== Craig
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
-- Brian Sebby ([email protected]) | Infrastructure and Operation Services Phone: +1 630.252.9935 | Computing and Information Systems Fax: +1 630.252.4601 | Argonne National Laboratory
== Craig
== Craig
== Craig
participants (4)
-
Brian Sebby -
Craig Stacey -
Kenneth Raffenetti -
Max trefonides