For dedicated servers, we have preinstalled server e-mail qmail

www.qmail.org

Qmail can be captured through the following patches:

• patch tls permits the sending of e-mails with ssl cryptage


• patch spamcontrol

The e-mail server is a program that accepts e-mails at port 25 via SMTP protocol. To find out more on how the SMTP protocol works, see the RFC: http://www.ietf.org/rfc/rfc0821.txt

Here is an example of SMTP communication with port 25:



The information in DATA must normally be the e-mail itself i.e. simply have the form of an e-mail:



Why was the e-mail accepted by the mx3.ovh.net. server?

- Because the IP of the connection ping.ovh.net (213.186.33.13) can relay the e-mails via mx3.ovh.net
- mx3.ovh.net is the MX of the ovh.net server


The simplest function of the e-mail server is the relay which:

• accepts e-mails and then sends 250 ok after RCPT TO


• places e-mails in the spool or the queue


• resends e-mails to the MX server destination

It is an SMTP server that distributes e-mails on the internet.

The service provider access proposes this type of server. Any other type of SMTP server can also distribute e-mails.

The first step is presented in the Before Starting section. This simply consists of accepting e-mails. The problem becomes more complex with spam management which is presented in the following:

-the qmail-smtp process that does this function. Its role is to communicate in SMTP and save e-mails under a file directory on the hard disk.

The second step consists of stocking e-mails on the disks while waiting for the third step.

To see the spool status:


This means that there are 360 e-mails that the server has already sent once visibly. So either the destination does not exist, or the MX server destination doesn't work correctly.

It should be pointed out that there are often problems with server relay response due to large amounts of emails in the spool.

Qmail can become enormous with more than 25,000 e-mails in the spool. In this case, the e-mail preparation becomes longer and longer and the messages in queue but not yet pre-processed increases.

To see the e-mails:


Why are these e-mails there ? These e-mails are there because:

• the server relay has accepted the relay, but the RCPT TO destination does not exist


• the server relay has accepted the relay, but the MX server destination doesn't exist


• the MX server has accepted the email but the local POP3 account does not exist, so we try to send the email to the sender with the error but:
  
  
  • the recipient does not exist (MAIL FROM from the initial email)
  
  
  • the recipient MX server does not exist
  
  

qmail-send manages the queue for any qmail. It's role is to look at the files that qmail-smtp has left and to distribute. It has the choice of using a local distribution (in the case of the recipient, it is on the machine itself i.e. the server is the MX server of the email and there is a POP3/IMAP account on the machine) or remote (relay the email to the email recipient).

The third step is to send the email to the recipient. The email is then taken from the spool to find out who the recipient is. qmail searches the MX server of the domain and then connects to port 25 to send email. This operation is Cette opération est the same at the beginning.

We may have several MX in a domain with the same weight or different. In this case, the SMTP server first tries to connect to the MX server with a lowest weight. If two MX have the same weight, it is the one that comes out of the DNS query first that will be used.

For errors, see the error section.

Each relay operation is logged in the email headers.
We can see from where and through which mail server the email was sent:


Reading it upwards from the bottom, we see that the email is sent from 200.102.28.198 which is connected to mx4.ovh.net and that the email arrived at the 60gp@ovh.net account.

See the forged headers in the Spam section

To see the functioning of your email server you can look in the logs. By default you only have the logs of the third step:



status: local 0/15 remote 1/120 on the spool->local distribution (the POP3 account) qmail uses 0 connections in 15 and on spool->remote (the third step) 1 in 120.

Attention: the file turns i.e. if it reaches a certain size it will redo the queue for the logs.
You also have the queue order -F that reopens the file when it turns


To manage the relay functions it must handle the IPs of users who can use this feature. If you permit all IPs to relay, in time your machine will be used as a relay server for spammers.

To manage this you have a file called /etc/tcp.smtp


This means that:

• all emails that come from IP 127.0.0.X are relayed


• all email that come from other IPs are accepted only if the recipient is configured on the machine (see the MX server)

You can add an IP of your choice (e.g. if you have a fixed IP in your company or a fixed IP in adsl) and compile tcp.smtp:


Changes are made and implemented in the file /etc/tcp.smtp.cdb that are used by the SMTP server. You do not need to restart the SMTP server. The file reads each SMTP connection.

In the case of ISPs, the IP classes are being hard on the SMTP server that allows customers of the ISP to automatically use the SMTP relay server without any other configuration

The open-smtp or pop-smtp option consists of using the POP3/IMAP server to identify the POP3 server. By using a login and password you can be sure that it's someone you trust and thus enable relay. During the POP3/IMAP operation, the POP3 server registers the IP connection, updates /etc/tcp.smtp and compiles /etc/tcp.smtp.cdb


All the temporary IPs are stored in open-smtp:


The last figure is the time, in seconds, since 1970 and lets you know when the IP was used POP3/IMAP the last time. So this allows another script /home/vpopmail/bin/clearopensmtp to watch all the IPs older than 3 hours and to remove the /etc/tcp.smtp.


Warning: it must be used to indicate the user and then save


and not


Moreover, in this case we see that this machine on the open-smtp file is particularly large.


11,859 IPs is a lot. And it's hard to know because there is no user specified in the crontab. We correct the error in crontab and we execute clearopensmtp:


It is better. The permissions for open-smtp have also changed. This is not very serious.

If you have the POP3/IMAP server busy with more than 3000-4000 connections/hour, we recommend using the OSD patch (Open-Smtp-Dir) you can find at
ftp://ftp.ovh.net/made-in-ovh/vpopmail. This patch was made by OVH and is to stop using the open-smtp file with the system locked (IPs blocked). If many people connect to the POP3/IMAP server, they must each wait their turn to have access to the file to save the IP as this slows the server. Instead we had the idea to use a directory to save files with the name of the IP and a size 0. Each new connection is used to update the file date and tmpwatch deletes files older than 3 hours. Another script updates /etc/tcp.smtp every second.

To avoid use pop3 before you can send emails, we can patch qmail with the smtp-auth patch. This patch allows you to send via SMTP connection the login and password for a POP3 account and then allow sending emails:


We see that instead of HELO, we send EHLO which allows use of advanced ESMTP control described in http://www.ietf.org/rfc/rfc2821.txt. The server responds to EHLO with all the options that are accepted:


The login and password are sent as base64. No penalty charge unlike chains sent to find out my passwords, they are false (the chains).

The installation of this patch is complex and requires a few tricks that are off-topic here. Please do not contact support for this. Instead, talk about it on the mailing-list.

You can also put in place the IP of the recipient's machine hardcoded in the configuration of qmail. This is very useful when, for example, the MX server in front is not very accessible (e.g. caramail.com). In this case, we can tell the server to use a special SMTP server whose role is to relay emails for caramail.com only.


Thus, all emails to caramail will be redirected to 213.186.33.9 that will handle the distribution of emails to caramail.com. Therefore, we avoid having a spool of important emails and we unload the machines. Of course, 213.186.33.9 must accept emails to go or we relay the emails but we trusts the admin to have properly configured servers. No need to restart the server after a change.

It is the qmail-remote process that responsible for connecting servers on port 25 and send emails.




Emails eventually must get to the destination MX server i.e. one that will store the mail waiting to be consulted in POP3 server or IMAP server. In this case, the mail server accepts the email and did exactly the same as in the case of relay. It is the third step that changes.

In the third stage the qmail-sent process detects that the recipient exists on the machine. We remember it is the qmail-sent process that is involved in the second step to manage the spool. Then it starts to load up the lists of all the domains that are on the machine. These lists are in:


DO NOT change the files manually. They have a special structure and there is always a cdb file that must be compiled.


And so, if the recipient is found on the machine qmail-sent uses qmail-local to send the email locally on the proper directory. Inside it should find a .qmail-default file or it is vpopmail that takes charge of the distribution of the email with all the system redirections, alias, mailing list, catch all and the POP3 accounts with a quota management.




You can get information in this guide: VpopmailAndAdministration




Maximum file size


All emails that are larger than 10MB will be rejected.

Lifetime of an email in the spool


If the email remains in the spool for 10 days and is still not returned when it returns two errors to the postmaster account on the machine. If the file does not exist, the email is returned after five days.

Reject emails with certain MAIL FROM


During the SMTP dialog, the SMTP server checks the MAIL FROM. We can refuse certain MAIL FROM which prevents the reception of some spam or viruses that have a fixed sender.

Attention: it has nothing to do with the From: To: Subject: fields of the email.




Sorry, I wasn't able to establish an SMTP connection

An attempt to send to dr_adams@sm66.com

We ask the DNS servers to find the MX:



If you use djbdns we can use dnsmx directly:


So, the email server that manages all the @sm66.com emails is mail.sm66.com.
We will therefore try to send the email:


Ouch! Obviously the server does not work properly. We can see the error message ("out of connection slots"), which makes us think there are too many connections on the mail server at the moment. Qmail will try to resend the email later.

Another example: 66-2434019-directway.com?amysummers@trailerr.trailblazernews.com
Hmmm ... it looks like a spam email.


The MX server is present on the internet but there is no SMTP server that works and so we cannot connection on port 25.


Another example: response@sleekzine.com


There are three MX servers with different weights for each server. Therefore Qmail will try mail1.sleekzine.com which has the lowest weight, then mail2.sleekzine.com, then mail3.sleekzine.com.


If we look at what will make qmail with an email like that:



553 sorry, that domain isn't allowed to be relayed thru this MTA

If the server does not relay the email, this means that:

• the IP connection is not in /etc/tcp.smtp (see the Relay section)


• the recipient does not have an account on the machine (see the MX section)

In this case one can easily guess that the account wanadoo.fr is not managed on mx1.ovh.net and it is simply a relay problem: the IP connection is not declared in /etc/tcp.smtp (voir section relay)

If the account is declared on the email server and you have this error, verify that the domain is ok in /var/qmail/bin/assign and if you have restarted qmail-send with



This may be due to a false declaration on the DNS server when you specify a mail server that has nothing to do with your domain and therefore you do not know and who did not want to relay your emails .

qmail_has_prog_delivery_but_has_x_bit_set._(#4.7.0)

This means that the /home/vpopmail directory has execution permissions but it should not be the case (chmod 700 instead of chmod 600 in a .qmail-alias)

Here is a script to correct the permissions:



553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)

This simply means that your domain is not configured in /var/qmail/control/rcpthosts

Exemple the domain 'test.com' has been installed but erased accidentally from /var/qmail/control/rcpthosts
Here's what you get when we try to send an email to postmaster@test.com :




See the guide : QueueQmailFull


The Spam section is coming soon.