Nothing happens with emails

P

PRB

Verified User
Joined
Oct 18, 2008
Messages
154
Since a few hours ago, no emails get sent or received or forwarded from my server.

Attached is a screenshot of what I have. First it worked like it should be working, why is this happening? What do I have to do to fix it?
 

Attachments

  • Naamloos.jpg
    Naamloos.jpg
    49.9 KB · Views: 122
Btw, log:

Code: 
2008-10-30 09:24:03 1KvaJD-00045S-IK == *** <***> R=lookuphost defer (-1): host lookup did not complete
2008-10-30 09:31:25 1Kva9v-00041i-Ox == *** R=lookuphost defer (-1): host lookup did not complete
2008-10-30 09:31:45 1KvaAa-000425-SD == *** R=lookuphost defer (-1): host lookup did not complete
2008-10-30 10:01:25 1KvaAa-000425-SD == *** R=lookuphost defer (-1): host lookup did not complete
2008-10-30 10:01:45 1Kva9v-00041i-Ox == *** R=lookuphost defer (-1): host lookup did not complete

and so forth... :(
 
Fixed by editing etc/resolv.conf to:
Code: 
search localdomain
nameserver 127.0.0.1
 
Indication that your server cannot resolve other domains.

From a shell login:
Code: 
$ nslookup directadmin.com
If it doesn't resolve, then check this file:
Code: 
$ cat /etc/resolv.conf
That file needs to have two working resolving (caching) nameservers listed. Test the servers:
Code: 
$ dig @123.45.67.89 directadmin.com
$ dig @111.222.233.244 directadmin.com
where you replace the obvious phony IP#s with the ones listed for the nameservers in your resolv.conf file, to make sure you're using two resolving nameservers.

Jeff
 
is the fix I have right now OK as well? Thanks for your answer Jeff!
 
That depends on how you have your nameserver setup.

If you're using your local nameserver for both authoritative and caching (resolving) nameservice, it may be liable to be easily hacked. We do NOT recommend using the same server for both authoritative and caching nameservice.

Jeff
 
There is no reason you cannot use it for both it just matters who you allow to do lookups through it.
 
Not quite, though the issue is subtle and you may not have noticed it. We have, and we've duplcated it, and we found it to be something we didn't want to live with.

Let's presume you've got BIND set up to do recursive queries for your local machine and/or your local network.

Let's further presume you or one of your clients sends an email through your server to (for example) an account at earthlink.net, or that you've got DNS lookups turned on for your httpd logs and someone on an earthlink dialup or DSL account browses a site on your server.

Your server, of course is allowed to look it up, and does, and places the lookup in it's local DNS cache.

Now here's the kicker that most of us ignore: Once the earthlink record is in your local cache, your server will serve it to anyone, just as it will do for all the sites for which it's authoritative.

I've checked this; it's repeatable. It happens, or at least it did when we tried it. That's why we no longer allow local lookups on our authoirtative nameservers.

Jeff
 
Jeff I definitely do not expect you to detail how a hacker could get in. I just wanted to verify that the situation you described above could indeed allow a hacker to get in. I don't need to know how. I just want to verify that it is indeed is dangerous.
 
And I didn't explain how a hacker could get in ;), only how the server could still be a caching nameserer, at least for some domains.

Jeff
 
You must log in or register to reply here.
Back
Top