# Postfix suddenly stopped resolving freebsd.org MX



## abishai (Dec 5, 2018)

I have a very strange issue. I run a mail personal server, so I'm not sure if more host are affected (at least others seem to be working), but I can't participate in FreeBSD mailing lists anymore 
11.1-RELEASE-p1 version (yes, I know, but it is not right time to upgrade)
postfix-3.3.0_1,1


```
alias_database = hash:/etc/mail/aliases
alias_maps = hash:/etc/mail/aliases
biff = no
command_directory = /usr/local/sbin
compatibility_level = 2
daemon_directory = /usr/local/libexec/postfix
data_directory = /var/db/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
html_directory = no
inet_interfaces = 10.0.4.2
inet_protocols = ipv4
mail_owner = postfix
mailq_path = /usr/local/bin/mailq
manpage_directory = /usr/local/man
message_size_limit = 104857600
meta_directory = /usr/local/libexec/postfix
milter_default_action = accept
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
milter_protocol = 6
mydomain = xxxxxxxxxxx
myhostname = xxxxxxxxxxxx
mynetworks = 10.0.0.0/16
myorigin = $mydomain
newaliases_path = /usr/local/bin/newaliases
queue_directory = /var/spool/postfix
readme_directory = no
sample_directory = /usr/local/etc/postfix
sendmail_path = /usr/local/sbin/sendmail
setgid_group = maildrop
shlib_directory = /usr/local/lib/postfix
smtpd_milters = inet:10.0.4.2:11332
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unauth_destination, reject_unauth_pipelining, check_sender_access hash:/usr/local/etc/postfix/sender_access.conf, permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_tls_CAfile = /etc/ssl/cert.pem
smtpd_tls_cert_file = /usr/local/etc/ssl/certs/xxxxxxx.pem
smtpd_tls_key_file = /usr/local/etc/ssl/priv/xxxxxxxxxxxxxx.pem
smtpd_tls_mandatory_ciphers = high
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_timeout = 3600s
unknown_local_recipient_reject_code = 550
virtual_alias_maps = hash:/var/vmail/auth.d/virtual
virtual_mailbox_domains = xxxxxxxxxxxx
virtual_transport = lmtp:unix:private/dovecot-lmtp
```

Here is the problem:

```
Dec  5 21:09:53 mail postfix/smtp[39269]: DD3791AFBA: to=<freebsd-test@freebsd.org>, relay=none, delay=2078, delays=2048/0.01/30/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=mx66.freebsd.org type=A: Host not found, try again)
```

Resolving from the mail server console:

```
abishai@mail:~ % host freebsd.org
freebsd.org has address 96.47.72.84
freebsd.org has IPv6 address 2610:1c1:1:606c::50:15
freebsd.org mail is handled by 10 mx1.freebsd.org.
freebsd.org mail is handled by 30 mx66.freebsd.org.
abishai@mail:~ % host mx66.freebsd.org
mx66.freebsd.org has address 96.47.72.85
mx66.freebsd.org has IPv6 address 2610:1c1:1:606c::19:5
abishai@mail:~ % telnet 96.47.72.85 25
Trying 96.47.72.85...
Connected to mx66.freebsd.org.
Escape character is '^]'.
220 mx1.freebsd.org ESMTP Postfix (Postfix FTW!)
^]
telnet> quit
Connection closed.
```

I'm running 1 recursive resolver (bind911-9.11.4P2) for my home network and it's definitely resolving


```
options {

        directory       "/usr/local/etc/namedb/working";
        pid-file        "/var/run/named/pid";
        dump-file       "/var/dump/named_dump.db";
        statistics-file "/var/stats/named.stats";

        listen-on       { 127.0.0.1; 10.0.10.1; };
        allow-query { any; };
        allow-recursion { local; };
        allow-query-cache { local; };
        version "*hiss*";

};

acl local { 127.0.0.1; 10.0.0.0/16; 192.168.0.0/16; xxxxxxxxxxx; xxxxxxxxxxxx; };

view local {

        match-clients { local; };
        include "/usr/local/etc/namedb/named-rfc.conf";
        zone "xxxxxxxxxx" {

                type master;
                allow-query { any; };
                allow-update { 10.0.0.222; xxxxxxxxxxxx; xxxxxxxxxx; };
                file "/usr/local/etc/namedb/slave/xxxxxxxxxx-local-forward.db";
        };
};
```
Heeeeeelp


----------



## abishai (Dec 5, 2018)

added -v to smtp, no clue it this log as well

```
Dec  5 21:22:09 mail postfix/qmgr[39826]: 596081C0B0: from=<axxxxxxxxxxxxx>, size=748, nrcpt=1 (queue active)
Dec  5 21:22:09 mail postfix/smtp[39893]: name_mask: ipv4
Dec  5 21:22:09 mail postfix/smtp[39893]: inet_addr_local: configured 1 IPv4 addresses
Dec  5 21:22:09 mail postfix/smtp[39893]: process generation: 12 (12)
Dec  5 21:22:09 mail postfix/smtp[39893]: match_string: parent_domain_matches_subdomains: fast_flush_domains ~? debug_peer_list
Dec  5 21:22:09 mail postfix/smtp[39893]: match_string: parent_domain_matches_subdomains: fast_flush_domains ~? fast_flush_domains
Dec  5 21:22:09 mail postfix/smtp[39893]: name_mask: canonical
Dec  5 21:22:09 mail postfix/smtp[39893]: name_mask: virtual
Dec  5 21:22:09 mail postfix/smtp[39893]: name_mask: dns
Dec  5 21:22:09 mail postfix/smtp[39893]: host name lookup methods: dns
Dec  5 21:22:09 mail postfix/smtp[39893]: auto_clnt_create: transport=local endpoint=private/scache
Dec  5 21:22:09 mail postfix/smtp[39893]: connection established
Dec  5 21:22:09 mail postfix/smtp[39893]: master_notify: status 0
Dec  5 21:22:09 mail postfix/smtp[39893]: deliver_request_initial: send initial status
Dec  5 21:22:09 mail postfix/smtp[39893]: send attr status = 0
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: flags
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: flags
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: 3
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: queue_name
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: queue_name
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: active
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: queue_id
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: queue_id
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: 596081C0B0
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: offset
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: offset
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: 785
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: size
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: size
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: 748
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: nexthop
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: nexthop
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: freebsd.org
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: encoding
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: encoding
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: 8bit
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: smtputf8
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: smtputf8
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: 0
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: sender
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: sender
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: xxxxxxxxxxxxxxx
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: envelope_id
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: envelope_id
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: (end)
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: ret_flags
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: ret_flags
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: 0
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: time
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: time
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: gUEIXAAAAACq2wMAAAAAAIFBCFwAAAAArSALAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: log_client_name
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: log_client_name
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: unknown
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: log_client_address
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: log_client_address
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: 10.0.0.100
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: log_client_port
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: log_client_port
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: 58286
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: log_protocol_name
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: log_protocol_name
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: ESMTP
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: log_helo_name
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: log_helo_name
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: xxxxxxxxxxxxxxxxxxx
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: sasl_method
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: sasl_method
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: PLAIN
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: sasl_username
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: sasl_username
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: xxxxxxxxxxxxxxxxxx
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: sasl_sender
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: sasl_sender
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: (end)
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: log_ident
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: log_ident
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: 596081C0B0
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: rewrite_context
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: rewrite_context
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: remote
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: recipient_count
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: recipient_count
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: 1
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: (list terminator)
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: (end)
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: original_recipient
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: original_recipient
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: freebsd-test@freebsd.org
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: recipient
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: recipient
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: freebsd-test@freebsd.org
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: offset
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: offset
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: 740
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: dsn_orig_rcpt
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: dsn_orig_rcpt
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: rfc822;freebsd-test@freebsd.org
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: notify_flags
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: notify_flags
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute value: 0
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp socket: wanted attribute: (list terminator)
Dec  5 21:22:09 mail postfix/smtp[39893]: input attribute name: (end)
Dec  5 21:22:09 mail postfix/smtp[39893]: deliver_request_get: file active/596081C0B0
Dec  5 21:22:09 mail postfix/smtp[39893]: deliver_message: from xxxxxxxxxxxxxxxxxxxxxx
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp_parse_destination: freebsd.org smtp
Dec  5 21:22:09 mail postfix/smtp[39893]: connecting to freebsd.org port 25
Dec  5 21:22:09 mail postfix/smtp[39893]: dns_query: freebsd.org (MX): OK
Dec  5 21:22:09 mail postfix/smtp[39893]: dns_get_answer: type MX for freebsd.org
Dec  5 21:22:09 mail postfix/smtp[39893]: dns_get_answer: type MX for freebsd.org
Dec  5 21:22:09 mail postfix/smtp[39893]: smtp_addr_one: host mx1.freebsd.org
Dec  5 21:22:09 mail postfix/smtp[39893]: lookup mx1.freebsd.org type A flags RES_USE_DNSSEC
Dec  5 21:22:09 mail postfix/smtpd[39890]: disconnect from unknown[10.0.0.100] ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=8
Dec  5 21:22:24 mail postfix/smtp[39893]: dns_query: mx1.freebsd.org (A): Host not found, try again
Dec  5 21:22:24 mail postfix/smtp[39893]: smtp_addr_one: host mx66.freebsd.org
Dec  5 21:22:24 mail postfix/smtp[39893]: lookup mx66.freebsd.org type A flags RES_USE_DNSSEC
Dec  5 21:22:39 mail postfix/smtp[39893]: dns_query: mx66.freebsd.org (A): Host not found, try again
Dec  5 21:22:39 mail postfix/smtp[39893]: warning: no MX host for freebsd.org has a valid address record
```


----------



## abishai (Dec 5, 2018)

google resolver works.

```
Dec  5 21:39:42 mail postfix/smtp[40708]: smtp_parse_destination: freebsd.org smtp
Dec  5 21:39:42 mail postfix/smtp[40708]: connecting to freebsd.org port 25
Dec  5 21:39:42 mail postfix/smtp[40708]: dns_query: freebsd.org (MX): OK
Dec  5 21:39:42 mail postfix/smtp[40708]: dns_get_answer: type MX for freebsd.org
Dec  5 21:39:42 mail postfix/smtp[40708]: dns_get_answer: type MX for freebsd.org
Dec  5 21:39:42 mail postfix/smtp[40708]: smtp_addr_one: host mx1.freebsd.org
Dec  5 21:39:42 mail postfix/smtp[40708]: lookup mx1.freebsd.org type A flags RES_USE_DNSSEC
Dec  5 21:39:42 mail postfix/smtp[40708]: dns_query: mx1.freebsd.org (A): OK
Dec  5 21:39:42 mail postfix/smtp[40708]: dns_get_answer: type A for mx1.freebsd.org
Dec  5 21:39:42 mail postfix/smtp[40708]: dns_get_answer: type RRSIG for mx1.freebsd.org
Dec  5 21:39:42 mail postfix/smtp[40708]: smtp_addr_one: host mx66.freebsd.org
Dec  5 21:39:42 mail postfix/smtp[40708]: lookup mx66.freebsd.org type A flags RES_USE_DNSSEC
Dec  5 21:39:42 mail postfix/smtpd[40702]: disconnect from unknown[10.0.0.100] ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=8
Dec  5 21:39:42 mail postfix/smtp[40708]: dns_query: mx66.freebsd.org (A): OK
Dec  5 21:39:42 mail postfix/smtp[40708]: dns_get_answer: type A for mx66.freebsd.org
Dec  5 21:39:42 mail postfix/smtp[40708]: dns_get_answer: type RRSIG for mx66.freebsd.org
Dec  5 21:39:42 mail postfix/smtp[40708]: begin freebsd.org address list
Dec  5 21:39:42 mail postfix/smtp[40708]: pref   10 host mx1.freebsd.org/96.47.72.80
Dec  5 21:39:42 mail postfix/smtp[40708]: pref   30 host mx66.freebsd.org/96.47.72.85
Dec  5 21:39:42 mail postfix/smtp[40708]: end freebsd.org address list
Dec  5 21:39:42 mail postfix/smtp[40708]: smtp_find_self: not found
```

So, something with bind ? But it has so simple configuration and resolving without issues other hosts (including freebsd.org).


----------



## ShelLuser (Dec 5, 2018)

Whats in /etc/resolv.conf? Also: `dig @localhost freebsd.org mx`, what does that do for you?


----------



## abishai (Dec 6, 2018)

ShelLuser said:


> Whats in /etc/resolv.conf? Also: `dig @localhost freebsd.org mx`, what does that do for you?




```
search xxxxxxxxxxxxxxxx    <- points to bing's local view domain
nameserver 10.0.10.1
```

I don't have `dig`

```
abishai@mail:~ % drill @localhost freebsd.org mx
Error: error sending query: Could not send or receive, because of network error
```
Is it right command ? mail is jail.


----------



## gkontos (Dec 6, 2018)

try `drill @10.0.10.1 freebsd.org mx`


----------



## abishai (Dec 6, 2018)

```
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 30628
;; flags: qr rd ra ; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 9 
;; QUESTION SECTION:
;; freebsd.org. IN      MX

;; ANSWER SECTION:
freebsd.org.    3600    IN      MX      10 mx1.freebsd.org.
freebsd.org.    3600    IN      MX      30 mx66.freebsd.org.

;; AUTHORITY SECTION:
freebsd.org.    2707    IN      NS      ns1.isc-sns.net.
freebsd.org.    2707    IN      NS      ns2.isc-sns.com.
freebsd.org.    2707    IN      NS      ns3.isc-sns.info.

;; ADDITIONAL SECTION:
mx1.freebsd.org.        300     IN      A       96.47.72.80
mx66.freebsd.org.       300     IN      A       96.47.72.85
ns1.isc-sns.net.        2707    IN      A       72.52.71.1
ns2.isc-sns.com.        2707    IN      A       63.243.194.1
ns3.isc-sns.info.       2707    IN      A       63.243.194.1
mx1.freebsd.org.        300     IN      AAAA    2610:1c1:1:606c::19:1
mx66.freebsd.org.       300     IN      AAAA    2610:1c1:1:606c::19:5
ns1.isc-sns.net.        134019  IN      AAAA    2001:470:1a::1
ns3.isc-sns.info.       47619   IN      AAAA    2001:5a0:10::1

;; Query time: 79 msec
;; SERVER: 10.0.10.1
;; WHEN: Thu Dec  6 08:40:14 2018
;; MSG SIZE  rcvd: 350
```


----------



## VladiBG (Dec 6, 2018)

lookup mx1.freebsd.org type A flags RES_USE_DNSSEC

It's using DNSSEC to resolve and most likely your DNS is not responding to the DNSSEC. You can try for for the test to change how the postfix ask the DNS using this http://www.postfix.org/postconf.5.html#smtp_dns_support_level


----------



## abishai (Dec 6, 2018)

*smtp_dns_support_level=true* didn't help, however *smtp_host_lookup=dns,native* helped.
I have default nsswitch.conf, with *hosts: files dns* so I use my very dns server when postfix dns lookup fails.
This is still very weird.


----------



## abishai (Dec 6, 2018)

Damn, all my 100 mails flushed to freebsd-test@freebsd.org and it dies

```
Dec  6 12:06:31 mail postfix/smtp[75983]: send attr reason = host mx66.freebsd.org[96.47.72.85] said: 450-4.3.2 Service currently unavailable
```
I feel I'll get ban for another reason now.


----------



## obsigna (Dec 6, 2018)

I just tested freebsd-test@freebsd.org with my postfix server:

```
Dec  6 10:42:24 egress postfix/smtp[10635]: 9BF4C1E1666: host mx1.freebsd.org[96.47.72.80] said: 450-4.3.2 Service currently unavailable 450 4.3.2 in case of permanent delivery errors (e.g. 5XX SMTP errors) please send your problem report from a non-blocked location (e.g. gmail/yahoo) to postmaster@FreeBSD.org and include the following information: time (Dec 06 12:42:24) and client (1x.xxx.xxx.xxx). (in reply to RCPT TO command)
Dec  6 10:42:27 egress postfix/smtp[10635]: 9BF4C1E1666: to=<freebsd-test@freebsd.org>, relay=mx66.freebsd.org[96.47.72.85]:25, delay=13, delays=0.77/0.01/10/2, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 6E6F78FFD9)
Dec  6 10:42:28 egress postfix/qmgr[740]: 9BF4C1E1666: removed
```

It looks like freebsd.org utilizes the so called poor man’s greylisting - which is actually not that poor, only you need no special software for this kind of greylisting. You inform a dead MX or one which always errors out as the one with the highest  priority, and operate the working MX on lower priority (higher number).

```
# host freebsd.org
freebsd.org has address 96.47.72.84
freebsd.org has IPv6 address 2610:1c1:1:606c::50:15
freebsd.org mail is handled by 10 mx1.freebsd.org.
freebsd.org mail is handled by 30 mx66.freebsd.org.
```

Normal clients would connect first to the higher one (here mx1), and in case this fails would try again with the second one (now mx66). An effective greylisting installation would enforce clients not to bypass the first MX, because spammers could easily setup their bots to always use the MX having the lowest priority (higher number).

You need to check why your postfix does not first try mx1.freebsd.org. My did, and received a temporary failure code 450, and almost immediately (3 sec later) it tried again using mx66.freebsd.org, this time with success.


----------



## VladiBG (Dec 6, 2018)

450 is temporary error It's normal greylist mechanism to prevent spam.
 If you found that the problem is because of the DNSSEC then enable it back and use DSN server which support DNSSEC.

https://dnssec-analyzer.verisignlabs.com/mx66.freebsd.org


----------



## gkontos (Dec 6, 2018)

Looks like it is working fine here. I am using my own DNS servers that do not currently support DNSSEC


```
Dec  6 17:22:46 sigma postfix/qmgr[17403]: D1A8229A45F: from=<my@mail.address>, size=726, nrcpt=1 (queue active)
Dec  6 17:22:52 sigma postfix-customerxxxxxx/smtp[56570]: D1A8229A45F: host mx1.freebsd.org[96.47.72.80] said: 450-4.3.2 Service currently unavailable 450 4.3.2 in case of permanent delivery errors (e.g. 5XX SMTP errors) please send your problem report from a non-blocked location (e.g. gmail/yahoo) to postmaster@FreeBSD.org and include the following information: time (Dec 06 15:22:52) and client (xxx.xxx.xxx.xxx). (in reply to RCPT TO command)
Dec  6 17:22:53 sigma postfix/smtpd[56503]: connect from mx1.freebsd.org[96.47.72.80]
Dec  6 17:22:54 sigma postfix/smtpd[56503]: lost connection after CONNECT from mx1.freebsd.org[96.47.72.80]
Dec  6 17:22:54 sigma postfix/smtpd[56503]: disconnect from mx1.freebsd.org[96.47.72.80] commands=0/0
Dec  6 17:22:54 sigma postfix-customerxxxxxx/smtp[56570]: D1A8229A45F: to=<freebsd-test@freebsd.org>, relay=mx1.freebsd.org[2610:1c1:1:606c::19:1]:25, delay=8.5, delays=0.76/0.01/7/0.78, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 9C6E870D23)
Dec  6 17:22:54 sigma postfix/qmgr[17403]: D1A8229A45F: removed
```


----------



## abishai (Dec 6, 2018)

VladiBG said:


> 450 is temporary error It's normal greylist mechanism to prevent spam.
> If you found that the problem is because of the DNSSEC then enable it back and use DSN server which support DNSSEC.
> 
> https://dnssec-analyzer.verisignlabs.com/mx66.freebsd.org



I don't think that problem is DNSSEC as according postfix man it's disabled by default. Probably, 3.3.0 version has this issue.


----------



## VladiBG (Dec 6, 2018)

Use drill with -DT option on your DNS and see if it can verify and return response of the server. You may need to update your postfix tho.


----------



## abishai (Dec 9, 2018)

Thanks for help, guys. I think I'll stop here. As Postfix works with *smtp_host_lookup=native *further digging assumes OS and postfix updates. As I slowly (I learn ansible and writing all configuration with it) migrating to a new server, this is not I want to perform with the old one.


----------

