You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Eric Abrahamsen <er...@ericabrahamsen.net> on 2016/09/27 03:46:53 UTC
DNS resolution issue
I found some posts on the web indicating that, if spamd is having
trouble doing DNS resolution, it's probably because of a bum entry in
/etc/resolv.conf. I don't think that's the case here, though, so I'm
coming to the list...
My logs are full of runs like this:
dns: sendto() to [127.0.0.1]:53 failed: Connection refused, failing over to [::1]:53
dns: sendto() to [::1]:53 failed: Connection refused, failing over to [127.0.0.1]:53
It bounces back and forth many times between ipv4 and ipv6, then ends
in:
dns: bad dns reply: Connection refused
dns: bad dns reply: Connection refused
dns: bad dns reply: Connection refused
In between these runs, spamassassin works fine. Except the sa-update
cronjobs also fail regularly with:
/etc/cron.daily/spamassassin:
channel: could not find working mirror, channel failed
sa-update failed for unknown reasons
Which I assume is attributable to the same problem.
The server uses Rackspace's default DNS servers, and they appear to work
okay. My assumption is that I've misconfigured something -- either spamd
shouldn't be consulting localhost in the first place, or it shouldn't be
trying to use ipv6, or maybe both.
Can anyone guess from this what I might have set up incorrectly?
Thanks!
Eric
Re: DNS resolution issue
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>> On 27.09.16 11:46, Eric Abrahamsen wrote:
>>>My logs are full of runs like this:
>>>
>>>dns: sendto() to [127.0.0.1]:53 failed: Connection refused, failing over to [::1]:53
>>>dns: sendto() to [::1]:53 failed: Connection refused, failing over to [127.0.0.1]:53
>Matus UHLAR - fantomas <uh...@fantomas.sk> writes:
>> this means nameserver is not running on your server.
>> the "bum entry" apparently points to localhost.
On 27.09.16 16:39, Eric Abrahamsen wrote:
>/etc/resolv.conf has just got:
>
>nameserver 173.203.4.9
>nameserver 173.203.4.8
>
>Unless something is borked in Rackspace's networking config (certainly
>not impossible), I don't know why that would ever end up pointing to
>localhost.
it's possible that resolv.conf was pointing to localhost at boot time.
However, it's still best to ruin recursing (not forwarding) nameserver
on local machine, this apparently on localhost interface.
>>>The server uses Rackspace's default DNS servers
>>
>> you should use own nameserver, not rackspace serveres shared with other
>> clients (and thus likely blocked by blacklists)
>
>Would you recommend actually running a bind9 or unbound instance on
>these servers? Or just pointing resolv.conf at something like Google's
>DNS servers, or something like that?
I see I should have said "not rackapace nor any other DNS servers shared
with other clients", because google public DNS servers are even worse
solution from this point of view than those of rackspace.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"The box said 'Requires Windows 95 or better', so I bought a Macintosh".
Re: DNS resolution issue
Posted by Eric Abrahamsen <er...@ericabrahamsen.net>.
Axb <ax...@gmail.com> writes:
> On 09/27/2016 03:46 PM, David Jones wrote:
>>
>>> /etc/resolv.conf has just got:
>>
>>> nameserver 173.203.4.9
>>> nameserver 173.203.4.8
>>
>>> Unless something is borked in Rackspace's networking config (certainly
>>> not impossible), I don't know why that would ever end up pointing to
>>> localhost.
>>
>> Setup BIND, unbound, or PowerDNS recursor on localhost and do your
>> own full DNS lookups.
>>
>>>>> The server uses Rackspace's default DNS servers
>>>>
>>>> you should use own nameserver, not rackspace serveres shared with other
>>>> clients (and thus likely blocked by blacklists)
>>
>>> Would you recommend actually running a bind9 or unbound instance on
>>> these servers? Or just pointing resolv.conf at something like Google's
>>> DNS servers, or something like that?
>>
>> Don't point a mail server running SA to anyone else's DNS servers that
>> will combine your BL lookups with others that can push your queries over
>> the free usage limit of the BL causing the URIBL_BLOCKED rule to be hit.
>>
>> This issue seems to come up over and over again on this list. Is there a way
>> something could be added to an SA future release to do a DNS query upon
>> startup/hourly and log/output something about this URIBL_BLOCKED issue
>> to point admins to a wiki page explaining the proper DNS configuration? It's
>> not a straight forward issue that people are finding on the mailing list archives
>> or the SA wiki pages. I know it took me a while to figure out what was going
>> on with URIBL_BLOCKED only after watching this mailing list for a long time.
>> It's not a problem you think you have until you see odd things happening that
>> don't seem to be related until after you ask the question on this list.
>>
>> Dave
>>
>
>
> The rule's description says it all:
>
> describe URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to
> URIBL was blocked. See
> http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for
> more information.
>
> + google "URIBL_BLOCKED" > first hit should also point in the right
> direction.
>
> If that's too hard to handle, should we question SA or the person's
> competence at deploying/managing SA?
I have gotten this error, and read that page. What I didn't understand
was that URIBL_BLOCKED was related in any way to the errors I was seeing
in my logs -- particularly the failure of sa-update (I'm still not sure
why that would be related). Anyway, I'm setting up unbound now, and will
see if this solves my problems.
Thanks to all who responded!
Eric
Re: DNS resolution issue
Posted by Axb <ax...@gmail.com>.
On 09/27/2016 03:46 PM, David Jones wrote:
>
>> /etc/resolv.conf has just got:
>
>> nameserver 173.203.4.9
>> nameserver 173.203.4.8
>
>> Unless something is borked in Rackspace's networking config (certainly
>> not impossible), I don't know why that would ever end up pointing to
>> localhost.
>
> Setup BIND, unbound, or PowerDNS recursor on localhost and do your
> own full DNS lookups.
>
>>>> The server uses Rackspace's default DNS servers
>>>
>>> you should use own nameserver, not rackspace serveres shared with other
>>> clients (and thus likely blocked by blacklists)
>
>> Would you recommend actually running a bind9 or unbound instance on
>> these servers? Or just pointing resolv.conf at something like Google's
>> DNS servers, or something like that?
>
> Don't point a mail server running SA to anyone else's DNS servers that
> will combine your BL lookups with others that can push your queries over
> the free usage limit of the BL causing the URIBL_BLOCKED rule to be hit.
>
> This issue seems to come up over and over again on this list. Is there a way
> something could be added to an SA future release to do a DNS query upon
> startup/hourly and log/output something about this URIBL_BLOCKED issue
> to point admins to a wiki page explaining the proper DNS configuration? It's
> not a straight forward issue that people are finding on the mailing list archives
> or the SA wiki pages. I know it took me a while to figure out what was going
> on with URIBL_BLOCKED only after watching this mailing list for a long time.
> It's not a problem you think you have until you see odd things happening that
> don't seem to be related until after you ask the question on this list.
>
> Dave
>
The rule's description says it all:
describe URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL
was blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for more
information.
+ google "URIBL_BLOCKED" > first hit should also point in the right
direction.
If that's too hard to handle, should we question SA or the person's
competence at deploying/managing SA?
Axb
Re: DNS resolution issue
Posted by David Jones <dj...@ena.com>.
>/etc/resolv.conf has just got:
>nameserver 173.203.4.9
>nameserver 173.203.4.8
>Unless something is borked in Rackspace's networking config (certainly
>not impossible), I don't know why that would ever end up pointing to
>localhost.
Setup BIND, unbound, or PowerDNS recursor on localhost and do your
own full DNS lookups.
>>>The server uses Rackspace's default DNS servers
>>
>> you should use own nameserver, not rackspace serveres shared with other
>> clients (and thus likely blocked by blacklists)
>Would you recommend actually running a bind9 or unbound instance on
>these servers? Or just pointing resolv.conf at something like Google's
>DNS servers, or something like that?
Don't point a mail server running SA to anyone else's DNS servers that
will combine your BL lookups with others that can push your queries over
the free usage limit of the BL causing the URIBL_BLOCKED rule to be hit.
This issue seems to come up over and over again on this list. Is there a way
something could be added to an SA future release to do a DNS query upon
startup/hourly and log/output something about this URIBL_BLOCKED issue
to point admins to a wiki page explaining the proper DNS configuration? It's
not a straight forward issue that people are finding on the mailing list archives
or the SA wiki pages. I know it took me a while to figure out what was going
on with URIBL_BLOCKED only after watching this mailing list for a long time.
It's not a problem you think you have until you see odd things happening that
don't seem to be related until after you ask the question on this list.
Dave
Re: DNS resolution issue
Posted by Eric Abrahamsen <er...@ericabrahamsen.net>.
Matus UHLAR - fantomas <uh...@fantomas.sk> writes:
> On 27.09.16 11:46, Eric Abrahamsen wrote:
>>I found some posts on the web indicating that, if spamd is having
>>trouble doing DNS resolution, it's probably because of a bum entry in
>>/etc/resolv.conf. I don't think that's the case here, though, so I'm
>>coming to the list...
>>
>>My logs are full of runs like this:
>>
>>dns: sendto() to [127.0.0.1]:53 failed: Connection refused, failing over to [::1]:53
>>dns: sendto() to [::1]:53 failed: Connection refused, failing over to [127.0.0.1]:53
>
> this means nameserver is not running on your server.
> the "bum entry" apparently points to localhost.
/etc/resolv.conf has just got:
nameserver 173.203.4.9
nameserver 173.203.4.8
Unless something is borked in Rackspace's networking config (certainly
not impossible), I don't know why that would ever end up pointing to
localhost.
>>The server uses Rackspace's default DNS servers
>
> you should use own nameserver, not rackspace serveres shared with other
> clients (and thus likely blocked by blacklists)
Would you recommend actually running a bind9 or unbound instance on
these servers? Or just pointing resolv.conf at something like Google's
DNS servers, or something like that?
Thanks for your response!
Eric
Re: DNS resolution issue
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 27.09.16 11:46, Eric Abrahamsen wrote:
>I found some posts on the web indicating that, if spamd is having
>trouble doing DNS resolution, it's probably because of a bum entry in
>/etc/resolv.conf. I don't think that's the case here, though, so I'm
>coming to the list...
>
>My logs are full of runs like this:
>
>dns: sendto() to [127.0.0.1]:53 failed: Connection refused, failing over to [::1]:53
>dns: sendto() to [::1]:53 failed: Connection refused, failing over to [127.0.0.1]:53
this means nameserver is not running on your server.
the "bum entry" apparently points to localhost.
>The server uses Rackspace's default DNS servers
you should use own nameserver, not rackspace serveres shared with other
clients (and thus likely blocked by blacklists)
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Micro$oft random number generator: 0, 0, 0, 4.33e+67, 0, 0, 0...