Known issue in 6.3.7 and 6.3.8: mail to some DNSSEC-signed domains stays in the queue
-
Who this affects: servers on 6.3.7 or 6.3.8 that deliver mail directly to recipients' mail servers. 6.3.6 may be affected too. Mail sent through an SMTP relay or a route isn't affected.
What you'll see: messages to some domains stay in the delivery queue and are retried later, even though your DNS server is working. If that goes on long enough, the sender gets a bounce. We've seen it with paypal.com, seznam.cz, kpnmail.nl and xs4all.nl, and it isn't limited to those. With application logging on, the log says the DNSSEC lookup of the TLSA records "could not be completed".
The cause: a bug in our DNSSEC checking. Some signed domains prove that a name doesn't exist in a valid way that our code misreads as incomplete. The server then can't tell whether the domain requires DANE, so it holds the message rather than risk sending it insecurely.
What to do: the fix is in testing for 6.3.9, which has no date yet. If you have mail stuck now:
- In the Control Panel, open Transport security, then the Encryption tab, and find DANE & DNSSEC.
- Untick "Honour recipient DANE/TLSA records when sending", then choose Save changes.
- Open the delivery queue and choose Deliver all now.
This turns off DANE checks for all your outgoing mail, so tick it again once you're on 6.3.9. Use the Control Panel rather than editing hMailServer.ini, because an ini edit is hard to undo. If you run on Linux, which has no Control Panel, post here and we'll help you with this step.
If nearly all your outgoing mail is stuck, the cause is more likely a DNS server or firewall that drops DNSSEC data or blocks DNS over TCP. The same steps get mail moving while you look at that.
If you're seeing something else, please post the log line here with addresses and passwords removed.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login