TLSRPT - 2 errors on Check DNS page

mjl- / mox

modern full-featured open source secure mail server for low-maintenance self-hosted email

https://www.xmox.nl

MIT License

3.71k stars 113 forks source link

TLSRPT - 2 errors on Check DNS page #109

Closed zkazsi closed 10 months ago

zkazsi commented 11 months ago

I'm mostly using mox to my satisfaction, however I have currently an annoyance (so, possibly not real issue, more fitting as discussion again?)

TLSRPT setting

Background: I'm using mox with 2 domains: 1) 'mail.s...com' (originally set up under this), and 2) 'ka...' (based on my name), MX set up to reference mail.sa...com , etc.

There are actually 2 issues related to TLSRPT settings for the ka... domain :

despite setting 'Host TLSRPT' correctly (referencing '@mail.s...') in DNS, it never gets recognized, always shows "Looking up TLSRPT record: tlsrpt: no tlsrpt dns txt record"
in addition, when setting it correctly as per the instruction, for the 'Domain TLSPT? it shows there's an error saying "tlsrpt: multiple tlsrpt records"

Maybe, the issue is best visible in the screenshot here

I have the same issue on the Check DNS for the s... domain (simply for '@mail.s...' and '@s...')

I've checked: the text for 'Host TLSRPT' and 'Domain TLSRPT' seems to be exactly the same (with exception of the domain endings). Something seems to be off...

mjl- commented 11 months ago

The immediate problem (as far as mox sees is) seems to be the DNS records. The one for mail.s... can't be found, and kazsi appears to have multiple. I can think of a few causes. Could you check which DNS records are present at the two domains?

dig _smtp._tls.mail.s... txt
dig _smtp._tls.kazsi... txt

Mox seems to get zero records for the first, and 2 or more records for the second. If those are not configured in the DNS zone file, it could be related to DNS caching, or perhaps wildcard records (though unlikely for these names). If there would be any duplicate records, I would expect them to be under the mail.s... hostname/domainname, where mox would recommend it as a "domain tlsrpt" record for domain mail.s... and as a "host tlsrpt" record for domain kazsi....

I think we can investigate further by seeing which TLSRPT records mox recommends for the two domains, and seeing if those correspond with the records you get when requesting them with dig.

zkazsi commented 11 months ago

And you're right again :) I guess the intruction was logical / self-evident ... however not to my logic.

There is 2 records indeed for '_smtp._tls.kazsi... txt', and none for '_smtp._tls.mail.s...'. (I also had two corresponding records in '_smtp._tls.s...' (but not for 'mail.s...')

Now that I understand how it was meant, I've fixed them in dns: now all 3 respective domains ('mail.s...', 'kazsi...' and 's...') have only one TXT record in dns (knot) for the respective _smtp._tls . It will take a while to propagate fully in dns - I will be able to only validate it on my admin page in a couple of days (I'm traveling right now). Thanks again, and Happy New Year :)

mjl- commented 11 months ago

Good to hear, and happy new year to you too! Let me know if you have suggestions on making the instructions less confusing.

zkazsi commented 10 months ago

I was able to verify: mox settings now correct - closing ticket