SMTP – Ryan Schulze

Selfhosting email, and sending email to Microsoft.

September 25, 2018October 19, 2018Ryanemail, microsoft, MTA, SMTP

About once a year one of my outgoing email servers will magically pop up on Microsofts blacklist of email servers. The exact status in SNDS is “Blocked due to user complaints or other evidence of spamming“, which is a bit ironic since the weekly volume of emails that go to Microsoft controlled domains seldom is higher than 5 and they are all personal emails.
The error message the MTA recieves is “550 5.7.1 Unfortunately, messages from [xxx.xxx.xxx.xxx] weren’t sent. Please contact your Internet service provider since part of their network is on our block list (S3140). You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.” in case anyone ends up here via google.

I’m not going to bitch and moan or attempt to guess why the server ends up on the list since it isn’t something I can influence
(just submit a support request and wait), instead I’ll post some tips and pointers to useful tools you should be using:

SPF – Sender Policy Framework
Specify which IPs are allowed too send mail for your domains, also determine what should happen with mail that is recieved from unauthorized IPs.

DKIM – DomainKeys Identified Mail
Outgoing mail servers for a domain can sign the emails and thereby allow recipients to verify that the email really came from a valid mail server and is not from a spoofed sender.

DMARC – Domain-based Message Authentication, Reporting & Conformance
DMARC allows you to specify policies for domains or subdomains in regards to “what should happen if an email fails DKIM or SPF” and where/if to send reports for Emails recieved by other mail servers.

SNDS – Smart Network Data Service
Allows you to monitor the IPs of your mailservers as viewed by the Outlook.com system.

JMRP – Junk Email Reporting Program
Forwards the full message with headers of any email marked as “junk” or “phishing” by Outlook.com users

MX Toolbox
MXtoolbox is a great website for testing your mail server settings, they also have a free_monitoring service for one IP, so you can get alerted if your IP shows up on a Blacklist.

Last but not least I use the following small script to monitor the status of my servers according to Microsoft. I call the script via a daily cronjob, and if a server is blacklisted, it sends an alert. Go to Automated Data Access first to generate an API key.

#!/usr/bin/env bash

sdns_key="&lt;&lt;insert API key here&gt;&gt;"
recipient="&lt;&lt;email to send alerts to&gt;&gt;"

if [[ "${sdns_key}" == '' ]]; then
        exit 0
fi

_URL_ip="https://sendersupport.olc.protection.outlook.com/snds/ipStatus.aspx?key=${sdns_key}"
_URL_data="https://sendersupport.olc.protection.outlook.com/snds/data.aspx?key=${sdns_key}"

content="$(curl -s "${_URL_ip}")"

if [[ ${#content} -gt 0 ]]; then
        {
        echo "${content}"
        echo
        curl -s "${_URL_data}"
    } | mailx -s "Microsoft SNDS status" ${recipient}
    exit 1
fi

#!/usr/bin/env bash

sdns_key="<<insert API key here>>"

recipient="<<email to send alerts to>>"

if [[ "${sdns_key}" == '' ]]; then

exit 0

_URL_ip="https://sendersupport.olc.protection.outlook.com/snds/ipStatus.aspx?key=${sdns_key}"

_URL_data="https://sendersupport.olc.protection.outlook.com/snds/data.aspx?key=${sdns_key}"

content="$(curl -s "${_URL_ip}")"

if [[ ${#content} -gt 0 ]]; then

{

echo "${content}"

echo

curl -s "${_URL_data}"

} | mailx -s "Microsoft SNDS status" ${recipient}

exit 1

And if all else fails and your IP does end up blacklisted in SNDS, you can go here to submit a ticket to get back off (although I’d suggest checking your mail server logs and the status of the IP on other RBLs first, just to make sure).

http://go.microsoft.com/fwlink/?LinkID=614866

Setting up multidomain DKIM with Exim

October 13, 2016November 7, 2018RyanDKIM, dmarc, exim, SMTP, SPF

Update November 2018:

A reader contacted me and pointed out that removing the {} around DKIM_DOMAIN solves the errors in the original example I found and had problems using. I’ve updated the code below (line 8) to reflect those changes in case anyone ends up here via google.

He also shared a nifty way to make selector rollovers easier by adding them to the filename:

DKIM_SELECTOR = whatever
DKIM_FILE =/etc/exim4/dkim/DKIM_DOMAIN.pem.DKIM_SELECTOR
DKIM_PRIVATE_KEY = ${if exists{DKIM_FILE}{DKIM_FILE}{0}}

With the format of the key files being ....

/etc/exim4/dkim/example.org.pem.previousselector
/etc/exim4/dkim/example.org.pem.whatever

DKIM_SELECTOR = whatever

DKIM_FILE =/etc/exim4/dkim/DKIM_DOMAIN.pem.DKIM_SELECTOR

DKIM_PRIVATE_KEY = ${if exists{DKIM_FILE}{DKIM_FILE}{0}}

With the format of the key files being ....

/etc/exim4/dkim/example.org.pem.previousselector

/etc/exim4/dkim/example.org.pem.whatever

And last but not least an elegant way to populate the DKIM_DOMAIN variable: https://bugs.exim.org/show_bug.cgi?id=1019

Original Posting:

I was recently setting up SPF, DKIM and DMARC for multiple domains and was having trouble getting Exim to sign emails for the different domains. I found an article here explaining the steps. But I kept getting the following error in my exim logs:

failed to expand dkim_private_key: missing or misplaced { or }

The suggested configuration was the following:

DKIM_CANON = relaxed
DKIM_SELECTOR = 20150726

# Get the domain from the outgoing mail.
DKIM_DOMAIN = ${sg{${lc:${domain:$h_from:}}}{^www\.}{}}

# The file is based on the outgoing domain-name in the from-header.
DKIM_FILE = /etc/exim4/dkim/DKIM_DOMAIN.pem

# If key exists then use it, if not don't.
DKIM_PRIVATE_KEY = ${if exists{DKIM_FILE}{DKIM_FILE}{0}}

DKIM_CANON = relaxed

DKIM_SELECTOR = 20150726

# Get the domain from the outgoing mail.

DKIM_DOMAIN = ${sg{${lc:${domain:$h_from:}}}{^www\.}{}}

# The file is based on the outgoing domain-name in the from-header.

DKIM_FILE = /etc/exim4/dkim/DKIM_DOMAIN.pem

# If key exists then use it, if not don't.

DKIM_PRIVATE_KEY = ${if exists{DKIM_FILE}{DKIM_FILE}{0}}

I’m not quite sure why, but Exim was having trouble using the macros in the following macros, so I ended up changing it to the following snippet instead. If you don’t use DKIM_FILE you can omit it. Also you might want to set DKIM_STRICT to true if you published a DMARC policy that will reject or quarantine email failing the DKIM tests (unset, or “false” tells Exim to send the message unsigned if it ran into problems signing the email). The default setting for DKIM_CANON is “relaxed“, so it also can be omitted.

DKIM_CANON = relaxed
DKIM_STRICT = false
DKIM_SELECTOR = 20160724
DKIM_DOMAIN = ${lc:${domain:$h_from:}}
DKIM_FILE = /etc/exim4/dkim/${lc:${domain:$h_from:}}.pem
DKIM_PRIVATE_KEY = ${if exists {/etc/exim4/dkim/${lc:${domain:$h_from:}}.pem} {/etc/exim4/dkim/${lc:${domain:$h_from:}}.pem}}

DKIM_CANON = relaxed

DKIM_STRICT = false

DKIM_SELECTOR = 20160724

DKIM_DOMAIN = ${lc:${domain:$h_from:}}

DKIM_FILE = /etc/exim4/dkim/${lc:${domain:$h_from:}}.pem

DKIM_PRIVATE_KEY = ${if exists {/etc/exim4/dkim/${lc:${domain:$h_from:}}.pem} {/etc/exim4/dkim/${lc:${domain:$h_from:}}.pem}}

Other than that, just make sure the exim process has permissions to access the dkim directory and certificate files and everything should work nicely.

Playing around with Exim, Spamassassin, DKIM and SPF

March 30, 2012July 29, 2016RyanDKIM, exim, intenet, SMTP, spamassassin, SPF

I was playing around with my mail server today and decided to have a look at DKIM and SPF. Jump to the bottom for some useful links. You will have to be able to change TXT entries for your domain/subdomains to do any of this. Sending a mail to check-auth@verifier.port25.com will generate an auto-reply with the result of your mail servers settings. I also noticed that Exim wasn’t listening to the IPv6 interface and promptly fixed that, and have received my first mail via IPv6.

Some spamassassin scores for your local/user settings:

score SPF_PASS -1.0
score SPF_FAIL 3.5
score SPF_SOFTFAIL 1.0
score SPF_HELO_PASS -1.1
score SPF_HELO_FAIL 3.5
score SPF_HELO_SOFTFAIL 1.0

score SPF_PASS -1.0

score SPF_FAIL 3.5

score SPF_SOFTFAIL 1.0

score SPF_HELO_PASS -1.1

score SPF_HELO_FAIL 3.5

score SPF_HELO_SOFTFAIL 1.0

SPF:
Syntax: http://www.openspf.org/SPF_Record_Syntax
Tools & Information: http://www.openspf.org/
Wizard: http://www.spfwizard.net/

DKIM:
Exim walkthrough: http://mikepultz.com/2010/02/using-dkim-in-exim/
Domain specific settings: http://www.debian-administration.org/users/lee/weblog/41
Tools: http://dkimcore.org/tools/
Wizard: https://www.port25.com/dkim-wizard/