How to override an MX value for a particular domain only?

[Eric B.-2]

Hi,

I'm running postfix on an internal network with an internal DNS.  My
internal DNS is configured for my particular domain (ie: mydomain.com).  I
have an MX pointer that points to my postfix machine so any email being
generated for mydomain.com from the internal network ends up at the postfix
machine.  All that setup works fine.

My problem is the following.  The email received by Postfix for mydomain.com
actually needs to be resent out into the internet destined for the actual
mydomain.com email server located in a geographically different location.
At the moment, Postfix will do an MX query for mydomain.com, realize that it
is itself, and understandably not forward the email to the appropriate
place.

How can I instruct Postfix on that server to ignore the MX record being
served by the internal DNS and actually query an external DNS server for the
MX pointer instead?  I looked through the main.cf config file, but can't
seem to find anything.  Can I configure Postfix to use a different DNS
server as opposed to the internal one specified by my resolve.conf file?

Any help or suggestions would be appreciated.

Thanks,

Eric

[Martijn de Munnik-2]

On Nov 4, 2009, at 10:52 PM, Eric B. wrote:

> Hi,
>
> I'm running postfix on an internal network with an internal DNS.  My
> internal DNS is configured for my particular domain (ie:  
> mydomain.com).  I
> have an MX pointer that points to my postfix machine so any email  
> being
> generated for mydomain.com from the internal network ends up at the  
> postfix
> machine.  All that setup works fine.
>
> My problem is the following.  The email received by Postfix for mydomain.com
> actually needs to be resent out into the internet destined for the  
> actual
> mydomain.com email server located in a geographically different  
> location.
> At the moment, Postfix will do an MX query for mydomain.com, realize  
> that it
> is itself, and understandably not forward the email to the appropriate
> place.
>
> How can I instruct Postfix on that server to ignore the MX record  
> being
> served by the internal DNS and actually query an external DNS server  
> for the
> MX pointer instead?  I looked through the main.cf config file, but  
> can't
> seem to find anything.  Can I configure Postfix to use a different DNS
> server as opposed to the internal one specified by my resolve.conf  
> file?
>
> Any help or suggestions would be appreciated.

http://www.postfix.org/postconf.5.html#transport_maps

mydomain.com smtp:[realmx.mydomain.com]
>
> Thanks,
>
> Eric
>
>
>

[Wolfgang Zeikat]

Martijn de Munnik wrote:
>
> On Nov 4, 2009, at 10:52 PM, Eric B. wrote:

>> How can I instruct Postfix on that server to ignore the MX record being
>> served by the internal DNS and actually query an external DNS server
>> for the
>> MX pointer instead?  I looked through the main.cf config file, but can't
>> seem to find anything.  Can I configure Postfix to use a different DNS
>> server as opposed to the internal one specified by my resolve.conf file?
>>
>> Any help or suggestions would be appreciated.
>
> http://www.postfix.org/postconf.5.html#transport_maps
>
> mydomain.com smtp:[realmx.mydomain.com]

Martijn's above suggestion will reliably send mail for mydomain.com to
realmx.mydomain.com, which is what you may want to do.

Note: It does *not* query any DNS server for an MX record for
mydomain.com, though. You would need to adapt it manually in case the
external MX pointer is changed.


Hope this helps,

wolfgang

[Eric B.-2]

"Wolfgang Zeikat" <wolfgang.zeikat@...> wrote in message
news:4AF201F9.8060602@......

> Martijn de Munnik wrote:
>>
>> On Nov 4, 2009, at 10:52 PM, Eric B. wrote:
>
>>> How can I instruct Postfix on that server to ignore the MX record being
>>> served by the internal DNS and actually query an external DNS server for
>>> the
>>> MX pointer instead?  I looked through the main.cf config file, but can't
>>> seem to find anything.  Can I configure Postfix to use a different DNS
>>> server as opposed to the internal one specified by my resolve.conf file?
>>>
>>> Any help or suggestions would be appreciated.
>>
>> http://www.postfix.org/postconf.5.html#transport_maps
>>
>> mydomain.com smtp:[realmx.mydomain.com]
>
> Martijn's above suggestion will reliably send mail for mydomain.com to
> realmx.mydomain.com, which is what you may want to do.
>
> Note: It does *not* query any DNS server for an MX record for
> mydomain.com, though. You would need to adapt it manually in case the
> external MX pointer is changed.

This is definitely helpful information; thanks.  I'll take a look into that
ASAP.  My only concern with this setup, of course, is that it requires me to
manually update the MX for the domain if ever it changes.

Is there no way to direct Postfix to a different DNS server (as opposed to
the ones specified in resolve.conf) either for a particular domain, or for
all domains altogether?

Thanks,

Eric

[Seth Mattinen]

Eric B. wrote:
>
> Is there no way to direct Postfix to a different DNS server (as opposed to
> the ones specified in resolve.conf) either for a particular domain, or for
> all domains altogether?
>

No, that's outside of the purview of Postfix. You could probably do
something with BIND views though.

~Seth

[Victor Duchovni]

On Wed, Nov 04, 2009 at 06:16:56PM -0500, Eric B. wrote:

> Is there no way to direct Postfix to a different DNS server (as opposed to
> the ones specified in resolve.conf) either for a particular domain, or for
> all domains altogether?

If you chroot-jail the smtp(8) delivery agent, it will use the resolv.conf
file in the chroot jail. This is ugly, you are probably solving the
wrong problem.

--
        Viktor.

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:majordomo@...?body=unsubscribe%20postfix-users>

If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.

[Kenneth Marshall-3]

On Wed, Nov 04, 2009 at 03:26:07PM -0800, Seth Mattinen wrote:

> Eric B. wrote:
> >
> > Is there no way to direct Postfix to a different DNS server (as opposed to
> > the ones specified in resolve.conf) either for a particular domain, or for
> > all domains altogether?
> >
>
> No, that's outside of the purview of Postfix. You could probably do
> something with BIND views though.
>
> ~Seth
>

You could also use a cronjob to check for a change and then update
the configuration based on that change. Why can't you update resolve.conf?

Cheers,
Ken

[Wolfgang Zeikat]

Eric B. wrote:

>>>
>>> mydomain.com smtp:[realmx.mydomain.com]
>> Martijn's above suggestion will reliably send mail for mydomain.com to
>> realmx.mydomain.com, which is what you may want to do.
>>
>> Note: It does *not* query any DNS server for an MX record for
>> mydomain.com, though. You would need to adapt it manually in case the
>> external MX pointer is changed.
>
> This is definitely helpful information; thanks.  I'll take a look into that
> ASAP.  My only concern with this setup, of course, is that it requires me to
> manually update the MX for the domain if ever it changes.

How likely and how often is such a change going to happen?
Wouldn't the "mydomain.com" administration inform you of such changes
anyway?

If not:

Kenneth Marshall wrote:
 > You could also use a cronjob to check for a change and then update
 > the configuration based on that change.

Unless that happens too often, I would also suggest such a solution.

Hope this helps,

wolfgang

[Wietse Venema]

Martijn de Munnik:
> > How can I instruct Postfix on that server to ignore the MX record  
> > being
> > served by the internal DNS and actually query an external DNS server  
> > for the
> > MX pointer instead?  

Postfix does not choose the DNS server. Instead, Postfix uses system
library routines.  These system library functions use the same
resolv.conf file for all DNS lookups.

Sounds like you need a DNS server or proxy that gives different
replies depending on the client IP address.

        Wietse

[Eric B.-2]

"Seth Mattinen" <sethm@...> wrote in message
news:4AF20D8F.9000608@......

> Eric B. wrote:
>>
>> Is there no way to direct Postfix to a different DNS server (as opposed
>> to
>> the ones specified in resolve.conf) either for a particular domain, or
>> for
>> all domains altogether?
>>
>
> No, that's outside of the purview of Postfix. You could probably do
> something with BIND views though.

Interesting thought... will take a look into that.  Thanks for the tip.

Eric

[Eric B.-2]

"Kenneth Marshall" <ktm@...> wrote in message
news:20091104232959.GF10895@......

> On Wed, Nov 04, 2009 at 03:26:07PM -0800, Seth Mattinen wrote:
>> Eric B. wrote:
>> >
>> > Is there no way to direct Postfix to a different DNS server (as opposed
>> > to
>> > the ones specified in resolve.conf) either for a particular domain, or
>> > for
>> > all domains altogether?
>> >
>>
>> No, that's outside of the purview of Postfix. You could probably do
>> something with BIND views though.
>>
>> ~Seth
>>
> You could also use a cronjob to check for a change and then update
> the configuration based on that change. Why can't you update resolve.conf?

Problem is that the server is hosting other things that needs the internal
DNS configuration for the mydomain.com.  So resolve.conf needs to point to
the internal DNS server for all the other services; it's just for Postfix
that I need to point it elsewhere.

Thanks,

Eric

[Eric B.-2]

"Victor Duchovni" <Victor.Duchovni@...> wrote in message
news:20091104232940.GI27037@......

> On Wed, Nov 04, 2009 at 06:16:56PM -0500, Eric B. wrote:
>
>> Is there no way to direct Postfix to a different DNS server (as opposed
>> to
>> the ones specified in resolve.conf) either for a particular domain, or
>> for
>> all domains altogether?
>
> If you chroot-jail the smtp(8) delivery agent, it will use the resolv.conf
> file in the chroot jail. This is ugly, you are probably solving the
> wrong problem.

Interesting thought.  I agree that this is somewhat ugly, but might be
something worth investigating...

Thanks for the tip.

Eric

[Noel Jones-2]

On 11/5/2009 9:09 AM, Eric B. wrote:

> "Victor Duchovni"<Victor.Duchovni@...>  wrote in message
> news:20091104232940.GI27037@......
>> On Wed, Nov 04, 2009 at 06:16:56PM -0500, Eric B. wrote:
>>
>>> Is there no way to direct Postfix to a different DNS server (as opposed
>>> to
>>> the ones specified in resolve.conf) either for a particular domain, or
>>> for
>>> all domains altogether?
>>
>> If you chroot-jail the smtp(8) delivery agent, it will use the resolv.conf
>> file in the chroot jail. This is ugly, you are probably solving the
>> wrong problem.
>
> Interesting thought.  I agree that this is somewhat ugly, but might be
> something worth investigating...
>
> Thanks for the tip.
>
> Eric
>
>
>

Or just add a "private" DNS record and let postfix use that
for delivery.

# postfix transport
example.com  smtp:real.mx.example.com.local

then arrange for real.mx.example.com.local to resolve to some
appropriate value.

   -- Noel Jones

[Eric B.-2]

"Eric B." <ebenze@...> wrote in message
news:hcupsk$b8a$3@......

> "Victor Duchovni" <Victor.Duchovni@...> wrote in message
> news:20091104232940.GI27037@......
>> On Wed, Nov 04, 2009 at 06:16:56PM -0500, Eric B. wrote:
>>
>>> Is there no way to direct Postfix to a different DNS server (as opposed
>>> to
>>> the ones specified in resolve.conf) either for a particular domain, or
>>> for
>>> all domains altogether?
>>
>> If you chroot-jail the smtp(8) delivery agent, it will use the
>> resolv.conf
>> file in the chroot jail. This is ugly, you are probably solving the
>> wrong problem.
>
> Interesting thought.  I agree that this is somewhat ugly, but might be
> something worth investigating...

Ok - now I am very confused.  I tried setting up Postfix in a chroot jail,
and specified a different set of nameservers in
/var/spool/postfix/etc/resolv.conf.  However, it seems as though Postfix
continues to use the name servers specified in /etc/resolv.conf and not the
ones in the chroot jail.

I have gone so far as to create an empty /var/spool/.../resolv.conf with no
nameservers specified, and yet postfix is still able to deliver the email
(to the wrong server).  I would have expected that leaving the nameservers
blank would have caused Postfix to choke, and yet it still connects.

I definitley have chroot set to Y in my master.cf file, and have done a
postfix restart.  I do get a warning on restart that
postfix/postfix-script: warning: /var/spool/postfix/etc/resolv.conf and
/etc/resolv.conf differ

Or does the fact that they differ cause the chroot to fail, and the process
ends up running in regular mode instead?

I have gone as far as deleting the /var/spool/postfix/lib and lib64
directories, and postfix still starts without any error messages.  And when
I try to mail something, it still manages to send the mail.  So that gives
me confirmation that the chroot isn't working properly.

Apart from setting chroot to y in master.cf, is there anything else I have
to do to enable it properly?

Thanks,

Eric

[Daniel L'Hommedieu]

On Nov 5, 2009, at 15:52, Eric B. wrote:

> "Eric B." <ebenze@...> wrote in message
> news:hcupsk$b8a$3@......
>> "Victor Duchovni" <Victor.Duchovni@...> wrote in  
>> message
>> news:20091104232940.GI27037@......
>>> On Wed, Nov 04, 2009 at 06:16:56PM -0500, Eric B. wrote:
>>>
>>>> Is there no way to direct Postfix to a different DNS server (as  
>>>> opposed
>>>> to
>>>> the ones specified in resolve.conf) either for a particular  
>>>> domain, or
>>>> for
>>>> all domains altogether?
>>>
>>> If you chroot-jail the smtp(8) delivery agent, it will use the
>>> resolv.conf
>>> file in the chroot jail. This is ugly, you are probably solving the
>>> wrong problem.
>>
>> Interesting thought.  I agree that this is somewhat ugly, but might  
>> be
>> something worth investigating...
>
> Ok - now I am very confused.  I tried setting up Postfix in a chroot  
> jail,
> and specified a different set of nameservers in
> /var/spool/postfix/etc/resolv.conf.  However, it seems as though  
> Postfix
> continues to use the name servers specified in /etc/resolv.conf and  
> not the
> ones in the chroot jail.
>
> I have gone so far as to create an empty /var/spool/.../resolv.conf  
> with no
> nameservers specified, and yet postfix is still able to deliver the  
> email
> (to the wrong server).  I would have expected that leaving the  
> nameservers
> blank would have caused Postfix to choke, and yet it still connects.
>
> I definitley have chroot set to Y in my master.cf file, and have  
> done a
> postfix restart.  I do get a warning on restart that
> postfix/postfix-script: warning: /var/spool/postfix/etc/resolv.conf  
> and
> /etc/resolv.conf differ
>
> Or does the fact that they differ cause the chroot to fail, and the  
> process
> ends up running in regular mode instead?
>
> I have gone as far as deleting the /var/spool/postfix/lib and lib64
> directories, and postfix still starts without any error messages.  
> And when
> I try to mail something, it still manages to send the mail.  So that  
> gives
> me confirmation that the chroot isn't working properly.
>
> Apart from setting chroot to y in master.cf, is there anything else  
> I have
> to do to enable it properly?
>
> Thanks,

Eric,

Getting back to your original goal, my understanding is that the  
original goal is to override the DNS "A" record for a single host,  
yes?  If so, that is a perfect use for /etc/hosts.  Give that method a  
try.

Daniel

[Eric B.-2]

"Daniel L'Hommedieu" <dlhommedieu@...> wrote in message
news:670A051C-1871-4E2E-82D8-187324EF11BB@......

> On Nov 5, 2009, at 15:52, Eric B. wrote:
>> "Eric B." <ebenze@...> wrote in message
>> news:hcupsk$b8a$3@......
>>> "Victor Duchovni" <Victor.Duchovni@...> wrote in  message
>>> news:20091104232940.GI27037@......
>>>> On Wed, Nov 04, 2009 at 06:16:56PM -0500, Eric B. wrote:
>>>>
>>>>> Is there no way to direct Postfix to a different DNS server (as
>>>>> opposed
>>>>> to
>>>>> the ones specified in resolve.conf) either for a particular  domain,
>>>>> or
>>>>> for
>>>>> all domains altogether?
>>>>
>>>> If you chroot-jail the smtp(8) delivery agent, it will use the
>>>> resolv.conf
>>>> file in the chroot jail. This is ugly, you are probably solving the
>>>> wrong problem.
>>>
>>> Interesting thought.  I agree that this is somewhat ugly, but might  be
>>> something worth investigating...
>>
>> Ok - now I am very confused.  I tried setting up Postfix in a chroot
>> jail,
>> and specified a different set of nameservers in
>> /var/spool/postfix/etc/resolv.conf.  However, it seems as though  Postfix
>> continues to use the name servers specified in /etc/resolv.conf and  not
>> the
>> ones in the chroot jail.
>>
>> I have gone so far as to create an empty /var/spool/.../resolv.conf  with
>> no
>> nameservers specified, and yet postfix is still able to deliver the
>> email
>> (to the wrong server).  I would have expected that leaving the
>> nameservers
>> blank would have caused Postfix to choke, and yet it still connects.
>>
>> I definitley have chroot set to Y in my master.cf file, and have  done a
>> postfix restart.  I do get a warning on restart that
>> postfix/postfix-script: warning: /var/spool/postfix/etc/resolv.conf  and
>> /etc/resolv.conf differ
>>
>> Or does the fact that they differ cause the chroot to fail, and the
>> process
>> ends up running in regular mode instead?
>>
>> I have gone as far as deleting the /var/spool/postfix/lib and lib64
>> directories, and postfix still starts without any error messages.   And
>> when
>> I try to mail something, it still manages to send the mail.  So that
>> gives
>> me confirmation that the chroot isn't working properly.
>>
>> Apart from setting chroot to y in master.cf, is there anything else  I
>> have
>> to do to enable it properly?
>>
>> Thanks,
>
> Eric,
>
> Getting back to your original goal, my understanding is that the  original
> goal is to override the DNS "A" record for a single host,  yes?  If so,
> that is a perfect use for /etc/hosts.  Give that method a  try.

Actually, it isn't for the "A" record; it is for the MX record(s).  And
unfortunately, I know of no way of using the hosts file to override MX
records for a particular domain.

Thanks,

Eric

[Victor Duchovni]

On Thu, Nov 05, 2009 at 03:52:00PM -0500, Eric B. wrote:

> I definitley have chroot set to Y in my master.cf file, and have done a
> postfix restart.  I do get a warning on restart that

What row in the table has the chroot set to "y"?

--
        Viktor.

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:majordomo@...?body=unsubscribe%20postfix-users>

If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.

[Daniel L'Hommedieu]

On Nov 5, 2009, at 16:12, Eric B. wrote:

> "Daniel L'Hommedieu" <dlhommedieu@...> wrote in message
> news:670A051C-1871-4E2E-82D8-187324EF11BB@......
>> On Nov 5, 2009, at 15:52, Eric B. wrote:
>>> "Eric B." <ebenze@...> wrote in message
>>> news:hcupsk$b8a$3@......
>>>> "Victor Duchovni" <Victor.Duchovni@...> wrote in  
>>>> message
>>>> news:20091104232940.GI27037@......
>>>>> On Wed, Nov 04, 2009 at 06:16:56PM -0500, Eric B. wrote:
>>>>>
>>>>>> Is there no way to direct Postfix to a different DNS server (as
>>>>>> opposed
>>>>>> to
>>>>>> the ones specified in resolve.conf) either for a particular  
>>>>>> domain,
>>>>>> or
>>>>>> for
>>>>>> all domains altogether?
>>>>>
>>>>> If you chroot-jail the smtp(8) delivery agent, it will use the
>>>>> resolv.conf
>>>>> file in the chroot jail. This is ugly, you are probably solving  
>>>>> the
>>>>> wrong problem.
>>>>
>>>> Interesting thought.  I agree that this is somewhat ugly, but  
>>>> might  be
>>>> something worth investigating...
>>>
>>> Ok - now I am very confused.  I tried setting up Postfix in a chroot
>>> jail,
>>> and specified a different set of nameservers in
>>> /var/spool/postfix/etc/resolv.conf.  However, it seems as though  
>>> Postfix
>>> continues to use the name servers specified in /etc/resolv.conf  
>>> and  not
>>> the
>>> ones in the chroot jail.
>>>
>>> I have gone so far as to create an empty /var/spool/.../
>>> resolv.conf  with
>>> no
>>> nameservers specified, and yet postfix is still able to deliver the
>>> email
>>> (to the wrong server).  I would have expected that leaving the
>>> nameservers
>>> blank would have caused Postfix to choke, and yet it still connects.
>>>
>>> I definitley have chroot set to Y in my master.cf file, and have  
>>> done a
>>> postfix restart.  I do get a warning on restart that
>>> postfix/postfix-script: warning: /var/spool/postfix/etc/
>>> resolv.conf  and
>>> /etc/resolv.conf differ
>>>
>>> Or does the fact that they differ cause the chroot to fail, and the
>>> process
>>> ends up running in regular mode instead?
>>>
>>> I have gone as far as deleting the /var/spool/postfix/lib and lib64
>>> directories, and postfix still starts without any error  
>>> messages.   And
>>> when
>>> I try to mail something, it still manages to send the mail.  So that
>>> gives
>>> me confirmation that the chroot isn't working properly.
>>>
>>> Apart from setting chroot to y in master.cf, is there anything  
>>> else  I
>>> have
>>> to do to enable it properly?
>>>
>>> Thanks,
>>
>> Eric,
>>
>> Getting back to your original goal, my understanding is that the  
>> original
>> goal is to override the DNS "A" record for a single host,  yes?  If  
>> so,
>> that is a perfect use for /etc/hosts.  Give that method a  try.
>
> Actually, it isn't for the "A" record; it is for the MX record(s).  
> And
> unfortunately, I know of no way of using the hosts file to override MX
> records for a particular domain.
>
> Thanks,
>
> Eric

Eric,

Redirected back on-list.

It seems to me that you do want to override an "A" record: all you  
care about is that outbound mail gets routed through another host.  
Your postfix server will use DNS to query for the MX record for example.com
, which will return mx.example.com.  Ordinarily it would then query  
DNS for the "A" record for mx.example.com, but if you configure nsswitch.com
  to query files before DNS, you can put mx.example.com into the /etc/
hosts file, with the desired IP address.

Daniel

[Eric B.-2]

"Victor Duchovni" <Victor.Duchovni@...> wrote in message
news:20091105212519.GZ27037@......
> On Thu, Nov 05, 2009 at 03:52:00PM -0500, Eric B. wrote:
>
>> I definitley have chroot set to Y in my master.cf file, and have done a
>> postfix restart.  I do get a warning on restart that
>
> What row in the table has the chroot set to "y"?

I had them all set to "y" except for local, virtual and proxymap.

Am running postfix 2.3.3 on CentOS5.3 x64 if that makes any difference.

Is there a way to enable more detailed logging?  I enabled more detailed
peer logging for the emails, but that only shows me more of the
communication to the remote smtp server.  I'm looking for more of the
Postfix logging (ie: where it is starting up, when/where it does its dns
queries, etc).  The debug_peer_list doesn't help at all in that regards.

Thanks,

Eric

[Victor Duchovni]

On Thu, Nov 05, 2009 at 04:27:33PM -0500, Daniel L'Hommedieu wrote:

> Your postfix
> server will use DNS to query for the MX record for example.com, which will
> return mx.example.com.  Ordinarily it would then query DNS for the "A"
> record for mx.example.com, but if you configure nsswitch.com to query files
> before DNS, you can put mx.example.com into the /etc/hosts file, with the
> desired IP address.

Much easier to just use a transport(5) table entry. If one is willing
to implement static overrides (rather than redirect DNS queries to an
alternate source), the transport(5) table is by far the simplest choice.

--
        Viktor.

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:majordomo@...?body=unsubscribe%20postfix-users>

If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.