[jira] [Created] (INFRA-11022) qmail using DNS ANY requests, may be blocked by DDoS mitigation strategies.

["Hoss Man (JIRA)" <ji...@apache.org>]

Hoss Man created INFRA-11022:
--------------------------------

             Summary: qmail using DNS ANY requests, may be blocked by DDoS mitigation strategies.
                 Key: INFRA-11022
                 URL: https://issues.apache.org/jira/browse/INFRA-11022
             Project: Infrastructure
          Issue Type: Bug
          Components: Mail (qmail)
            Reporter: Hoss Man


the following information was received in email to the moderators of the solr-user@lucene mailing list in response to an automated email from ezmlm to a user informing them that many emails sent to them have been bouncing.

I've removed any persona/organizational identifying details from the email, and will encourage the original sender to contact infra directly if they wish to share more confidential details (referencing this jira)

----

I am an Email Administrator at [GOV AGENCY].  I have investigated this issue for [USER] and found the following:

It appears your organization is using Qmail to send email.  Based on our analysis, Qmail poses a potential delivery
problem between our systems.  The problem is routed in the configuration of the Qmail system.  Specifically, Qmail
performs DNS "ANY" requests to find the MX records for the destination host of a message.   As have many Federal
Agencies, [GOV AGENCY] has blocked DNS "ANY" queries over UDP (and only "ANY" queries) as part of our DDoS mitigation
strategy. We believe this results in the failure of the DNS queries from Qmail and the rejection of your emails.

Please forward this information to your Email/Network Administrators and request that they update your Qmail system
and discontinue the usage of the "ANY" query as part of your Qmail's delivery process.  Based on our research, the
"ANY" query that Qmail performs is no longer required as part of a standard Qmail system, as outlined below:

(http://fanf.livejournal.com/122220.html , http://www.memoryhole.net/qmail/ ).





--
This message was sent by Atlassian JIRA
(v6.3.4#6332)