MX name with _ : all relevant MX records point to non-existent hosts

[mbneto]

Hi,

Some clever admin configured the MX of a domain pointing to
server_01.domain.com.

My users are unable to send email to that domain and attempts to contact the
admin and tell him that _ is not allowed resulted in 'every body else
works'.

So, is there any workaround this issue?

Regards.

[W B Hacker]

Post by mbneto
Hi,
Some clever admin configured the MX of a domain pointing to
server_01.domain.com.
My users are unable to send email to that domain and attempts to contact the
admin and tell him that _ is not allowed resulted in 'every body else
works'.
So, is there any workaround this issue?
Regards.

domain.com shows up with two A RR's:

;; ANSWER SECTION:
domain.com. 3492 IN A 66.150.120.131
domain.com. 3492 IN A 216.34.94.184
conducive# dig any mx domain.com


The MX is on 66.150.120.140

;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 0

;; QUESTION SECTION:
;domain.com. IN MX

;; ANSWER SECTION:
domain.com. 3600 IN MX 10 sentry.domainbank.com.

;; AUTHORITY SECTION:
domain.com. 60 IN NS ns1.dotsterhost.com.
domain.com. 60 IN NS ns3.dotsterhost.com.
domain.com. 60 IN NS ns2.dotsterhost.com.

;; Query time: 187 msec
;; SERVER: 202.85.128.32#53(202.85.128.32)
;; WHEN: Wed Apr 22 21:11:42 2009
;; MSG SIZE rcvd: 128

Suggest you simply Locally Blacklist it bothway.

End of problem.

Bill

[mbneto]

Hi,

The domain.com is simply an example. Not the real one.

I am hoping that there is a flag somewhere I can disable so exim will ignore
this or maybe a tweak in the configuration.

I've tried the manualroute without luck. I add the following as the first
router

problemdomain:
driver = manualroute
domains = domain.com
transport = remote_smtp
route_list = IP.of.the.MX

But it is not working.

Post by W B Hacker

Post by mbneto
Hi,
Some clever admin configured the MX of a domain pointing to
server_01.domain.com.
My users are unable to send email to that domain and attempts to contact

the

Post by mbneto
admin and tell him that _ is not allowed resulted in 'every body else
works'.
So, is there any workaround this issue?
Regards.

domain.com. 3492 IN A 66.150.120.131
domain.com. 3492 IN A 216.34.94.184
conducive# dig any mx domain.com
The MX is on 66.150.120.140
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 0
;domain.com. IN MX
domain.com. 3600 IN MX 10 sentry.domainbank.com.
domain.com. 60 IN NS ns1.dotsterhost.com.
domain.com. 60 IN NS ns3.dotsterhost.com.
domain.com. 60 IN NS ns2.dotsterhost.com.
;; Query time: 187 msec
;; SERVER: 202.85.128.32#53(202.85.128.32)
;; WHEN: Wed Apr 22 21:11:42 2009
;; MSG SIZE rcvd: 128
Suggest you simply Locally Blacklist it bothway.
End of problem.
Bill
--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

[W B Hacker]

Post by mbneto
Hi,
The domain.com is simply an example. Not the real one.

Then do not post it here..

Bill

[W B Hacker]

Post by mbneto
The domain.com is simply an example. Not the real one.

helo_allow_chars = _
However, their admin is incorrect - they'll get rejections at many
more places than just yours. The correct fix is to correct the HELO
value, but this will ignore the problem if that's what you want.
Cheers,
Tony

Quoting the OP:

"My users are unable to send email to that domain..."


'To'

... nothing to do with an arriving 'HELO'

Bill

[Ted Cooper [Exim-users]]

Post by mbneto
The domain.com is simply an example. Not the real one.

example.com, example.net, example.org - all standard example domains
already reserved in the domain space for such purposes.

Post by mbneto
I am hoping that there is a flag somewhere I can disable so exim will ignore
this or maybe a tweak in the configuration.
I've tried the manualroute without luck. I add the following as the first
router
driver = manualroute
domains = domain.com
transport = remote_smtp
route_list = IP.of.the.MX
But it is not working.

Your manual router should have worked. Did you place it before your normal
domains one? Did you restart exim?

And then slightly more directed at the offending mail server/DNS admin ....


There's no simple flag for this one as it's completely broken. This would
be akin to someone putting an IP address in an MX record - it's simply
broken and not allowed since it breaks too many systems. In this case you
should educate the offending server administrator on what is allowed in
hostnames. The "_" is not as it is a special character used to seperate
hostname DNS space and different protocols stored in DNS (eg _domainkeys,
_kerberos._tcp.dc._msdcs, _ldap._tcp.pdc._msdcs). The "_" allows these
other bits of information to sit side by side in a zone file and not
collide. As such, the MX record this example domain is giving is in fact
not inside hostname space. Just because it can be added to a zone file
doesn't mean it should - There's 3 lights on a traffic light but you only
drive through it when it's green.

[Peter Bowyer]

Post by mbneto
Hi,
The domain.com is simply an example. Not the real one.
I am hoping that there is a flag somewhere I can disable so exim will ignore
this or maybe a tweak in the configuration.
I've tried the manualroute without luck.  I add the following as the first
router
 driver = manualroute
 domains = domain.com
 transport = remote_smtp
 route_list = IP.of.the.MX
But it is not working.

You've confused route_list and route_data. You need either

route_list = domain.com IP.of.the.MX

or

route_data = IP.of.the.MX

http://exim.org/exim-html-current/doc/html/spec_html/ch20.html#SECTprioptman

Peter

[Eli Sand]

Post by mbneto
The domain.com is simply an example. Not the real one.

Careful, you're probably gonna catch flak for that one. There's no reason
to hide the offending domain from us, especially if you're seeking help
relating to said domain.

Post by mbneto
I am hoping that there is a flag somewhere I can disable so exim will
ignore this or maybe a tweak in the configuration.

It's been a while since I read the RFCs, but I'm leaning towards a simple
"sorry, _ is quite simply NOT ALLOWED in a hostname". I would instantly
dismiss a "it works for everyone else", because that's not true.

If it is Exim (it may be in your DNS resolver) that is refusing to
acknowledge that hostname, you may just be out of luck - some rules just
simply should not be bent around/over/under. If that admin refuses to
follow the RFCs, it's his (and his users') loss.

Situations like these can usually be corrected by getting your users to do a
bit of legwork - have them call or somehow contact the intended recipients
and tell them that they can't send email to them because their DNS is broken
(or so their admin, being you, says - point to a relevant RFC if you must).
This should quickly get the recipient contacting their admin and complaining
which results in them either contacting you (and you can seem like the
smarter one by telling them the RFC he's violating), or just fixing the
problem by changing the hostname to something valid.

Eli.

[Tony Meyer]

Post by mbneto
The domain.com is simply an example. Not the real one.

I believe you're looking for:

helo_allow_chars = _

However, their admin is incorrect - they'll get rejections at many
more places than just yours. The correct fix is to correct the HELO
value, but this will ignore the problem if that's what you want.

Cheers,
Tony

[Jakob Hirsch]

Post by mbneto
Some clever admin configured the MX of a domain pointing to
server_01.domain.com.

Never ever use other people's domain names for examples. That's what
example.{com,net,org} is for.
And if you want help on this mailing list, don't obfuscate things (apart
from passwords). This is both well explained in the mailing list etiquette.

Ok, now to the issue. Underscore in host names is quite common in the
windows world. But most of that poeple with internet connectivity
learned that it's better not to use it, because many people will not be
able to reach you because many software blocks _ in host names.
If you are more interested in operability than than compliance to
arbitrary decisions, you can allow it in Exim by overriding
dns_check_names_pattern in the config's main section. The default is, as
stated in the spec:

(?i)^(?>(?(1)\.|())[^\W_](?>[a-z0-9/-]*[^\W_])?)+$

The regex is probably not easy to understand (took me also a while). It
should be ok to add the _ in the middle list:

(?i)^(?>(?(1)\.|())[^\W_](?>[a-z0-9/-_]*[^\W_])?)+$



PS: I'm a little embarrassed by my list fellows. 7 replies, but no
solution, that's not something I would have expected...

[Peter Bowyer]

Post by Jakob Hirsch
PS: I'm a little embarrassed by my list fellows. 7 replies, but no
solution, that's not something I would have expected...

Interesting point. I believe those that have said 'tell the other end
to fix it' actually have given a more internet-friendly, sustainable
solution to the holistic problem.. You've given a technical solution
to the small-scale problem which would seem to get the OP over their
immediate pressing issue but with no regard to how many times the same
thing is going to come up again.

Peter

[Mike Cardwell]

Post by Peter Bowyer

Post by Jakob Hirsch
PS: I'm a little embarrassed by my list fellows. 7 replies, but no
solution, that's not something I would have expected...

Interesting point. I believe those that have said 'tell the other end
to fix it' actually have given a more internet-friendly, sustainable
solution to the holistic problem.. You've given a technical solution
to the small-scale problem which would seem to get the OP over their
immediate pressing issue but with no regard to how many times the same
thing is going to come up again.

1.) "You shouldn't do it"
2.) "Here's how to do it"
3.) "You shouldn't do it because of x, but here's how to do it if you
still want to"

When someone asks a difficult question on here, they tend to get about
half a dozen 1's followed by a 2, then some more 1's. Ideally people
would just respond with 3's.

The poster was already aware that 1, but wanted to know how to 2.

Mike

[Rafał Kupka]

On Thu, Apr 23, 2009 at 10:25:03AM +0200, Jakob Hirsch wrote:
Hi,

Post by Jakob Hirsch
If you are more interested in operability than than compliance to
arbitrary decisions, you can allow it in Exim by overriding
dns_check_names_pattern in the config's main section. The default is, as
(?i)^(?>(?(1)\.|())[^\W_](?>[a-z0-9/-]*[^\W_])?)+$
The regex is probably not easy to understand (took me also a while). It
(?i)^(?>(?(1)\.|())[^\W_](?>[a-z0-9/-_]*[^\W_])?)+$

There is small error in regexp above. Character '-' in regexp ranges
have to be last one before closing ']'.

(?i)^(?>(?(1)\.|())[^\W_](?>[a-z0-9/_-]*[^\W_])?)+$

But "helo_allow_chars = _" in main section of exim.conf is much simpler
solution (as someone else said already).

Regards,
Kupson

[Peter Bowyer]

Post by Rafał Kupka
Hi,

Post by Jakob Hirsch
If you are more interested in operability than than compliance to
arbitrary decisions, you can allow it in Exim by overriding
dns_check_names_pattern in the config's main section. The default is, as
(?i)^(?>(?(1)\.|())[^\W_](?>[a-z0-9/-]*[^\W_])?)+$
The regex is probably not easy to understand (took me also a while). It
(?i)^(?>(?(1)\.|())[^\W_](?>[a-z0-9/-_]*[^\W_])?)+$

There is small error in regexp above. Character '-' in regexp ranges
have to be last one before closing ']'.
(?i)^(?>(?(1)\.|())[^\W_](?>[a-z0-9/_-]*[^\W_])?)+$
But "helo_allow_chars = _" in main section of exim.conf is much simpler
solution (as someone else said already).

They, and you, are both guilty of not reading the question. The
problem posted is related to the underscore character in the hostname
of a domain's MX record, and the inability to send mail to that
domain. Nothing to do with HELO and receiving mail from that domain.

[Jakob Hirsch]

Post by Rafał Kupka

Post by Jakob Hirsch
(?i)^(?>(?(1)\.|())[^\W_](?>[a-z0-9/-_]*[^\W_])?)+$

There is small error in regexp above. Character '-' in regexp ranges
have to be last one before closing ']'.
(?i)^(?>(?(1)\.|())[^\W_](?>[a-z0-9/_-]*[^\W_])?)+$

Um, right, of course.

Post by Rafał Kupka
But "helo_allow_chars = _" in main section of exim.conf is much simpler
solution (as someone else said already).

Yes, but to a different problem (incoming vs. outgoing), which hasn't
anything to do with DNS.

[Ian Eiloart]

Post by mbneto
Hi,
Some clever admin configured the MX of a domain pointing to
server_01.domain.com.

You can tell him from me that he won't be getting email from the University
of Sussex. And, that most people probably don't care that they can't
deliver email to him. How would he know, therefore, that he had a problem?

Post by mbneto
My users are unable to send email to that domain and attempts to contact
the admin and tell him that _ is not allowed resulted in 'every body else
works'.
So, is there any workaround this issue?
Regards.

--
Ian Eiloart
IT Services, University of Sussex
01273-873148 x3148
For new support requests, see http://www.sussex.ac.uk/its/help/

[Mike Cardwell]

Post by Ian Eiloart

Post by mbneto
Some clever admin configured the MX of a domain pointing to
server_01.domain.com.

You can tell him from me that he won't be getting email from the University
of Sussex. And, that most people probably don't care that they can't
deliver email to him. How would he know, therefore, that he had a problem?

Here's another 45 UK Universites using Exim, the vast majority of which
wont be able to email him:

1 abdn.ac.uk - 220 mailhub2.abdn.ac.uk ESMTP Exim 4.52
Thu, 23 Apr 2009 13:28:21 +0100
2 abertay.ac.uk - 220 uadspa03.uad.ac.uk ESMTP Exim 4.69
Thu, 23 Apr 2009 13:28:29 +0100
3 bham.ac.uk - 220 bham-mx3.bham.ac.uk ESMTP Exim 4.67
Thu, 23 Apr 2009 13:28:23 +0100
4 bris.ac.uk - 220 dirf.bris.ac.uk ESMTP Exim 4.67 Thu,
23 Apr 2009 13:28:22 +0100
5 bton.ac.uk - 220 carpo.brighton.ac.uk ESMTP Exim 4.63
Thu, 23 Apr 2009 13:28:21 +0100
6 cam.ac.uk - 220-ppsw-1.csi.cam.ac.uk (mx.cam.ac.uk
[131.111.8.141]:25) ESMTP Exim 4.70+ppsw+0 Thu, 23 Apr 2009 13:28:21 +0100
7 cant.ac.uk - 220 mailgw01.canterbury.ac.uk ESMTP Exim
4.63 Thu, 23 Apr 2009 13:28:19 +0100
8 cf.ac.uk - 220 hedwig2.cf.ac.uk ESMTP Exim 4.69 Thu,
23 Apr 2009 13:28:21 +0100
9 cranfield.ac.uk - 220 mailgate-7.central.cranfield.ac.uk
ESMTP Exim 4.69 Thu, 23 Apr 2009 13:28:22 +0100
10 dundee.ac.uk - 220 pp8.dundee.ac.uk ESMTP Exim 4.43 Thu,
23 Apr 2009 13:29:49 +0100
11 essex.ac.uk - 220 serlx29.essex.ac.uk ESMTP Exim 4.69
Thu, 23 Apr 2009 13:28:27 +0100
12 ex.ac.uk - 220 mercury.ex.ac.uk ESMTP Exim 4.68 Thu,
23 Apr 2009 13:28:23 +0100
13 gla.ac.uk - 220 palin.cent.gla.ac.uk ESMTP Exim 4.22
Thu, 23 Apr 2009 13:28:31 +0100
14 glam.ac.uk - 220 mta1.glam.ac.uk ESMTP Exim 4.63 Thu,
23 Apr 2009 13:28:22 +0100
15 harper-adams.ac.uk - 220 xenial.mcc.ac.uk ESMTP Exim 4.69 Thu,
23 Apr 2009 13:28:21 +0100
16 hud.ac.uk - 220 cnoc.hud.ac.uk ESMTP Exim 4.68 Thu, 23
Apr 2009 13:28:20 +0100
17 hw.ac.uk - 220 mail-r.hw.ac.uk ESMTP Exim 4.54 Thu,
23 Apr 2009 13:28:21 +0100
18 ic.ac.uk - 220 mx4.cc.ic.ac.uk ESMTP Exim 4.67 Thu,
23 Apr 2009 13:28:21 +0100
19 kent.ac.uk - 220 mx4.kent.ac.uk ESMTP Exim 4.63 Thu, 23
Apr 2009 13:28:21 +0100
20 lancs.ac.uk - 220 ignavia.lancs.ac.uk ESMTP Exim 4.69
Thu, 23 Apr 2009 13:28:25 +0100 (PBTX)
21 lboro.ac.uk - 220-boo.lut.ac.uk ESMTP Exim 4.66 #1 Thu,
23 Apr 2009 13:28:34 +0100
22 le.ac.uk - 220 gemsbok.le.ac.uk (mailin.le.ac.uk
[143.210.16.42]:25) ESMTP Exim 4.63 Thu, 23 Apr 2009 13:28:34 +0100
23 lincoln.ac.uk - 220 kaitain.lincoln.ac.uk ESMTP Exim 4.69
Thu, 23 Apr 2009 13:28:46 +0100
24 liv.ac.uk - 220 mxd.liv.ac.uk ESMTP Exim 4.67 Thu, 23
Apr 2009 13:28:15 +0100
25 lmu.ac.uk - 220 mrelay-f-ext.lmu.ac.uk ESMTP Exim 4.60
Thu, 23 Apr 2009 13:28:25 +0100
26 londonmet.ac.uk - 220 buzzard.londonmet.ac.uk ESMTP Exim
4.69 Thu, 23 Apr 2009 13:28:23 +0100
27 man.ac.uk - 220 deimos.mcc.ac.uk ESMTP Exim 4.69 Thu,
23 Apr 2009 13:28:22 +0100
28 nott.ac.uk - 220 mx1.nottingham.ac.uk ESMTP Exim 4.60
Thu, 23 Apr 2009 13:28:21 +0100
29 open.ac.uk - 220 neptune.open.ac.uk ESMTP Exim 4.69
Thu, 23 Apr 2009 13:28:19 +0100
30 ox.ac.uk - 220 relay1.mail.ox.ac.uk ESMTP Exim 4.69
Thu, 23 Apr 2009 13:28:21 +0100
31 plym.ac.uk - 220-tracy.csd.plymouth.ac.uk ESMTP Exim
4.69 Thu, 23 Apr 2009 13:28:23 +0100
32 qmw.ac.uk - 220 mail2.qmul.ac.uk ESMTP Exim 4.66 Thu,
23 Apr 2009 13:28:21 +0100
33 qub.ac.uk - 220 mailhub2.qub.ac.uk ESMTP Exim 4.69
Thu, 23 Apr 2009 12:28:21 +0000
34 rdg.ac.uk - 220 vimp4.rdg.ac.uk ESMTP Exim Thu, 23 Apr
2009 13:28:21 +0100
35 soas.ac.uk - 220 mr3.soas.ac.uk ESMTP Exim 4.60 Thu, 23
Apr 2009 13:28:21 +0100 Welcome to the School of Oriental and African
Studies Mail server Please put your spam back in the can
36 staffs.ac.uk - 220 crusms1a.staffs.ac.uk ESMTP Exim 4.66
Thu, 23 Apr 2009 13:28:21 +0100
37 stir.ac.uk - 220 mailrelay2.stir.ac.uk ESMTP Exim 4.63
Thu, 23 Apr 2009 13:28:21 +0100
38 strath.ac.uk - 220 mx3.strath.ac.uk ESMTP Exim Thu, 23
Apr 2009 12:28:47 +0000
39 susx.ac.uk - 220 karpinski.uscs.susx.ac.uk ESMTP Exim
4.64 Thu, 23 Apr 2009 13:29:05 +0100
40 swan.ac.uk - 220 harpo.swan.ac.uk ESMTP Exim 4.69 Thu,
23 Apr 2009 13:28:24 +0100
41 ucl.ac.uk - 220 vscan-a.ucl.ac.uk ESMTP Exim 4.60 Thu,
23 Apr 2009 13:28:45 +0100
42 uclan.ac.uk - 220 mail2.uclan.ac.uk ESMTP Exim 4.69 Thu,
23 Apr 2009 13:28:21 +0100
43 umist.ac.uk - 220 deimos.mcc.ac.uk ESMTP Exim 4.69 Thu,
23 Apr 2009 13:28:22 +0100
44 uwic.ac.uk - 220 llex02.uwic.ac.uk ESMTP Exim 4.43 Thu,
23 Apr 2009 13:29:31 +0100
45 wmin.ac.uk - 220 isls-mx30.wmin.ac.uk ESMTP Exim 4.69
Thu, 23 Apr 2009 13:28:21 +0100

I wonder how many hundreds of thousands of staff and students that covers.

[Peter Bowyer]

Post by mbneto
My users are unable to send email to that domain and attempts to contact
the admin and tell him that _ is not allowed resulted in 'every body else
works'.

How would he know? Undeliverable mail due to his mis-configured DNS
will never leave the sending servers, so he won't see any evidence of
its non-arrival.

Peter

[mbneto]

Hi,

First of all thanks for all the reply I've received.

I'd like to address what I consider the relevant topics in one message.

1) First of all the solution, so hopefully the next person with the same
problem will find it easier than me.

I've added this as my first router.

myrouter:
driver = manualroute
domains = domain.that.should.not.be.named.com
transport = remote_smtp
route_list = * ip.registered.to.the.mx.that.contains.the.underscore
no_more

This worked and will make all messages to that domain to be routed to that
IP.

2) The real solution

In a perfect world where people have the time, responsability and all the
knowledge necessary to do their business and are not self-centered the
solution would be : contact the admin of the offending domain and ask
him/her to rename the server.

In the real world, if you manage to reach the admin (which by the way does
not have a root/admin account - hopefully a postmaster), he/she will tell
you that :
a) gmail/yahoo/hotmail users does not complain about it
b) the 'rest' of the world (that probably uses sendmail) does not complain
about it
c) this setting was already there when he/she got the job
d) I'll do it when I have time (i.e never)
e) this must be an error on your side, fix it!

I am not trying to say nobody uses exim, just that for historical reasons
there are a lot of servers which use another MTA that does not care about
this problem. It is really difficult, in my experience, to find people that
reaches item d).

It is not easy when you run a business and your users do not care how things
works. They simply want their email sent. Try to convince them about rfcs,
that this is not right etc. Since we are not talking about doing something
illegal (in terms of law) they will simply switch to a diffrent server that
does not care about it.

I can not afford the price of being right in this case.

3) The domain.com example

I usually only give the specifics of a problem when they are relevant to the
solution, which is not the case. Whatever domain uses the _ will have the
same problem so the replacement to protect the innocent (or guilty) :)

I was not aware that this was a sensitive issue so my apologies for that.

Thanks again.


PS. Bill replying in a rude manner surely is not the best way to do it
specially if the sender did not intentionally was trying to offend you...

Post by mbneto
Hi,
Some clever admin configured the MX of a domain pointing to
server_01.domain.com.
My users are unable to send email to that domain and attempts to contact
the admin and tell him that _ is not allowed resulted in 'every body else
works'.
So, is there any workaround this issue?
Regards.

[Mike Cardwell]

Post by mbneto
First of all thanks for all the reply I've received.
I'd like to address what I consider the relevant topics in one message.
1) First of all the solution, so hopefully the next person with the same
problem will find it easier than me.
I've added this as my first router.
driver = manualroute
domains = domain.that.should.not.be.named.com
transport = remote_smtp
route_list = * ip.registered.to.the.mx.that.contains.the.underscore
no_more
This worked and will make all messages to that domain to be routed to that
IP.

Really? I thought the better solution would be to use Jakob Hirsch's
suggestion, ie "dns_check_names_pattern" ... That way you wouldn't need
to maintain a special router for a particular domain. What if they
change the IP of the MX for that domain without you noticing?

Post by mbneto
3) The domain.com example
I usually only give the specifics of a problem when they are relevant to the
solution, which is not the case. Whatever domain uses the _ will have the
same problem so the replacement to protect the innocent (or guilty) :)
I was not aware that this was a sensitive issue so my apologies for that.

The list rules state that you must not obfuscate. Several subscribers
take this too literally and believe there is never a case for
obfuscation. IMO, your case was fine for it. But yes, you should have
used example.com rather than domain.com.