Fatal: cannot assign requested address

[fairking]

Hi guys,

I someone could help me with running the service.

System: Fedora 37 amd64 User : mox X.X.X.X - My External IP (Dynamic DNS), IP could change. mymail.com - My domain

The command: ./mox serve gives me the following response:

l=debug m="autotls setting allowed hostnames" pkg=autotls hostnames=[mymail.com;mta-sts.mymail.com] publicips=[X.X.X.X]
l=print m="starting as root, initializing network listeners" pkg=serve version=v0.0.6 pid=9219 moxconf=/home/mox/config/mox.conf domainsconf=/home/mox/config/domains.conf
l=print m="listening for smtp" pkg=smtpserver listener=public address=X.X.X.X:50465 protocol=submissions
l=fatal m="smtp: listen for smtp" err="listen tcp4 X.X.X.X:50465: bind: cannot assign requested address" pkg=smtpserver protocol=submissions listener=public

I also have the following ports forwarded on my router:

My mox.conf as follows:

# Directory where all data is stored, e.g. queue, accounts and messages, ACME TLS
# certs/keys. If this is a relative path, it is relative to the directory of
# mox.conf.
DataDir: ../data

# Default log level, one of: error, info, debug, trace, traceauth, tracedata.
# Trace logs SMTP and IMAP protocol transcripts, with traceauth also messages with
# passwords, and tracedata on top of that also the full data exchanges (full
# messages), which can be a large amount of data.
LogLevel: debug

# User to switch to after binding to all sockets as root. Default: mox. If the
# value is not a known user, it is parsed as integer and used as uid and gid.
# (optional)
User: mox

# Full hostname of system, e.g. mail.<domain>
# Hostname: localhost.localdomain
Hostname: mymail.com

# If enabled, a single DNS TXT lookup of _updates.xmox.nl is done every 24h to
# check for a new release. Each time a new release is found, a changelog is
# fetched from https://updates.xmox.nl and delivered to the postmaster mailbox.
# (optional)
#
# RECOMMENDED: please enable to stay up to date
#
#CheckUpdates: true

# Automatic TLS configuration with ACME, e.g. through Let's Encrypt. The key is a
# name referenced in TLS configs, e.g. letsencrypt. (optional)
ACME:
    letsencrypt:

        # For letsencrypt, use https://acme-v02.api.letsencrypt.org/directory.
        DirectoryURL: https://acme-v02.api.letsencrypt.org/directory

        # Email address to register at ACME provider. The provider can email you when
        # certificates are about to expire. If you configure an address for which email is
        # delivered by this server, keep in mind that TLS misconfigurations could result
        # in such notification emails not arriving.
        ContactEmail: mox@mymail.com

# File containing hash of admin password, for authentication in the web admin
# pages (if enabled). (optional)
AdminPasswordFile: adminpasswd

# Listeners are groups of IP addresses and services enabled on those IP addresses,
# such as SMTP/IMAP or internal endpoints for administration or Prometheus
# metrics. All listeners with SMTP/IMAP services enabled will serve all configured
# domains. If the listener is named 'public', it will get a few helpful additional
# configuration checks, for acme automatic tls certificates and monitoring of ips
# in dnsbls if those are configured.
Listeners:
    internal:

        # Use 0.0.0.0 to listen on all IPv4 and/or :: to listen on all IPv6 addresses, but
        # it is better to explicitly specify the IPs you want to use for email, as mox
        # will make sure outgoing connections will only be made from one of those IPs.
        IPs:
            - 127.0.0.1
            - ::1
            - 192.168.0.5
            - fd25:e2db:a5bc::263
            - fd25:e2db:a5bc:0:2e3:5cff:fe68:818a

        # If empty, the config global Hostname is used. (optional)
        Hostname: localhost

        # Account web interface, for email users wanting to change their accounts, e.g.
        # set new password, set new delivery rulesets. Served at /. (optional)
        AccountHTTP:
            Enabled: true

        # Admin web interface, for managing domains, accounts, etc. Served at /admin/.
        # Preferrably only enable on non-public IPs. Hint: use 'ssh -L 8080:localhost:80
        # you@yourmachine' and open http://localhost:8080/admin/, or set up a tunnel (e.g.
        # WireGuard) and add its IP to the mox 'internal' listener. (optional)
        AdminHTTP:
            Enabled: true

        # Serve prometheus metrics, for monitoring. You should not enable this on a public
        # IP. (optional)
        MetricsHTTP:
            Enabled: true
    public:

        # Use 0.0.0.0 to listen on all IPv4 and/or :: to listen on all IPv6 addresses, but
        # it is better to explicitly specify the IPs you want to use for email, as mox
        # will make sure outgoing connections will only be made from one of those IPs.
        IPs:
            - X.X.X.X

        # For SMTP/IMAP STARTTLS, direct TLS and HTTPS connections. (optional)
        TLS:

            # Name of provider from top-level configuration to use for ACME, e.g. letsencrypt.
            # (optional)
            ACME: letsencrypt

        # (optional)
        SMTP:
            Enabled: false

            # Addresses of DNS block lists for incoming messages. Block lists are only
            # consulted for connections/messages without enough reputation to make an
            # accept/reject decision. This prevents sending IPs of all communications to the
            # block list provider. If any of the listed DNSBLs contains a requested IP
            # address, the message is rejected as spam. The DNSBLs are checked for healthiness
            # before use, at most once per 4 hours. Example DNSBLs: sbl.spamhaus.org,
            # bl.spamcop.net (optional)
            #DNSBLs:
                #- sbl.spamhaus.org
                #- bl.spamcop.net

        # SMTP over TLS for submitting email, by email applications. Requires a TLS
        # config. (optional)
        Submissions:
            Enabled: true
            Port: 50465

        # IMAP over TLS for reading email, by email applications. Requires a TLS config.
        # (optional)
        IMAPS:
            Enabled: true

        # Serve autoconfiguration/autodiscovery to simplify configuring email
        # applications, will use port 443. Requires a TLS config. (optional)
        AutoconfigHTTPS:
            Enabled: false

        # Serve MTA-STS policies describing SMTP TLS requirements. Requires a TLS config.
        # (optional)
        MTASTSHTTPS:
            Enabled: true

        # All configured WebHandlers will serve on an enabled listener. (optional)
        WebserverHTTP:
            Enabled: true

        # All configured WebHandlers will serve on an enabled listener. Either ACME must
        # be configured, or for each WebHandler domain a TLS certificate must be
        # configured. (optional)
        WebserverHTTPS:
            Enabled: true

# Destination for emails delivered to postmaster address.
Postmaster:
    Account: mox

    # E.g. Postmaster or Inbox.
    Mailbox: Postmaster

My domains.conf as follows:

# Domains for which email is accepted. For internationalized domains, use their
# IDNA names in UTF-8.
Domains:
    mymail.com:

        # If not empty, only the string before the separator is used to for email delivery
        # decisions. For example, if set to "+", you+anything@example.com will be
        # delivered to you@example.com. (optional)
        LocalpartCatchallSeparator: +

        # With DKIM signing, a domain is taking responsibility for (content of) emails it
        # sends, letting receiving mail servers build up a (hopefully positive) reputation
        # of the domain, which can help with mail delivery. (optional)
        DKIM:

            # Emails can be DKIM signed. Config parameters are per selector. A DNS record must
            # be created for each selector. Add the name to Sign to use the selector for
            # signing messages.
            Selectors:
                2023a:

                    # Period a signature is valid after signing, as duration, e.g. 72h. The period
                    # should be enough for delivery at the final destination, potentially with several
                    # hops/relays. In the order of days at least. (optional)
                    Expiration: 72h

                    # Either an RSA or ed25519 private key file in PKCS8 PEM form.
                    PrivateKeyFile: dkim/2023a._domainkey.mymail.com.20230510T232710.ed25519key.pkcs8.pem
                2023b:

                    # Period a signature is valid after signing, as duration, e.g. 72h. The period
                    # should be enough for delivery at the final destination, potentially with several
                    # hops/relays. In the order of days at least. (optional)
                    Expiration: 72h

                    # Either an RSA or ed25519 private key file in PKCS8 PEM form.
                    PrivateKeyFile: dkim/2023b._domainkey.mymail.com.20230510T232710.rsakey.pkcs8.pem
                2023c:

                    # Period a signature is valid after signing, as duration, e.g. 72h. The period
                    # should be enough for delivery at the final destination, potentially with several
                    # hops/relays. In the order of days at least. (optional)
                    Expiration: 72h

                    # Either an RSA or ed25519 private key file in PKCS8 PEM form.
                    PrivateKeyFile: dkim/2023c._domainkey.mymail.com.20230510T232710.ed25519key.pkcs8.pem
                2023d:

                    # Period a signature is valid after signing, as duration, e.g. 72h. The period
                    # should be enough for delivery at the final destination, potentially with several
                    # hops/relays. In the order of days at least. (optional)
                    Expiration: 72h

                    # Either an RSA or ed25519 private key file in PKCS8 PEM form.
                    PrivateKeyFile: dkim/2023d._domainkey.mymail.com.20230510T232710.rsakey.pkcs8.pem

            # List of selectors that emails will be signed with. (optional)
            Sign:
                - 2023a
                - 2023b

        # With DMARC, a domain publishes, in DNS, a policy on how other mail servers
        # should handle incoming messages with the From-header matching this domain and/or
        # subdomain (depending on the configured alignment). Receiving mail servers use
        # this to build up a reputation of this domain, which can help with mail delivery.
        # A domain can also publish an email address to which reports about DMARC
        # verification results can be sent by verifying mail servers, useful for
        # monitoring. Incoming DMARC reports are automatically parsed, validated, added to
        # metrics and stored in the reporting database for later display in the admin web
        # pages. (optional)
        DMARC:

            # Address-part before the @ that accepts DMARC reports. Must be
            # non-internationalized. Recommended value: dmarc-reports.
            Localpart: dmarc-reports

            # Account to deliver to.
            Account: mox

            # Mailbox to deliver to, e.g. DMARC.
            Mailbox: DMARC

        # With MTA-STS a domain publishes, in DNS, presence of a policy for
        # using/requiring TLS for SMTP connections. The policy is served over HTTPS.
        # (optional)
        MTASTS:

            # Policies are versioned. The version must be specified in the DNS record. If you
            # change a policy, first change it in mox, then update the DNS record.
            PolicyID: 20230510T222710

            # testing, enforce or none. If set to enforce, a remote SMTP server will not
            # deliver email to us if it cannot make a TLS connection.
            Mode: enforce

            # How long a remote mail server is allowed to cache a policy. Typically 1 or
            # several weeks.
            MaxAge: 24h0m0s

            # List of server names allowed for SMTP. If empty, the configured hostname is set.
            # Host names can contain a wildcard (*) as a leading label (matching a single
            # label, e.g. *.example matches host.example, not sub.host.example). (optional)
            MX:
                - localhost.localdomain

        # With TLSRPT a domain specifies in DNS where reports about encountered SMTP TLS
        # behaviour should be sent. Useful for monitoring. Incoming TLS reports are
        # automatically parsed, validated, added to metrics and stored in the reporting
        # database for later display in the admin web pages. (optional)
        TLSRPT:

            # Address-part before the @ that accepts TLSRPT reports. Recommended value:
            # tls-reports.
            Localpart: tls-reports

            # Account to deliver to.
            Account: mox

            # Mailbox to deliver to, e.g. TLSRPT.
            Mailbox: TLSRPT

# Accounts to which email can be delivered. An account can accept email for
# multiple domains, for multiple localparts, and deliver to multiple mailboxes.
Accounts:
    mox:

        # Default domain for addresses specified in Destinations. An address can specify a
        # domain override.
        Domain: mymail.com

        # Destinations, specified as (encoded) localpart for Domain, or a full address
        # including domain override.
        Destinations:
            mox@mymail.com: nil
#           If you receive email from mailing lists, you probably want to configure them like the example below.
#           mox@mymail.com:
#       
#               # Mailbox to deliver to if none of Rulesets match. Default: Inbox. (optional)
#               Mailbox: 
#       
#               # Delivery rules based on message and SMTP transaction. You may want to match each
#               # mailing list by SMTP MailFrom address, VerifiedDomain and/or List-ID header
#               # (typically <listname.example.org> if the list address is listname@example.org),
#               # delivering them to their own mailbox. (optional)
#               Rulesets:
#                   -
#       
#                       # Matches if this regular expression matches (a substring of) the SMTP MAIL FROM
#                       # address (not the message From-header). E.g. user@example.org. (optional)
#                       SMTPMailFromRegexp: 
#       
#                       # Matches if this domain matches an SPF- and/or DKIM-verified (sub)domain.
#                       # (optional)
#                       VerifiedDomain: list.example.org
#       
#                       # Matches if these header field/value regular expressions all match (substrings
#                       # of) the message headers. Header fields and valuees are converted to lower case
#                       # before matching. Whitespace is trimmed from the value before matching. A header
#                       # field can occur multiple times in a message, only one instance has to match. For
#                       # mailing lists, you could match on ^list-id$ with the value typically the mailing
#                       # list address in angled brackets with @ replaced with a dot, e.g.
#                       # <name\.lists\.example\.org>. (optional)
#                       HeadersRegexp:
#                           ^list-id$: <name\.list\.example\.org>
#       
#                       # Influence the spam filtering, this does not change whether this ruleset applies
#                       # to a message. If this domain matches an SPF- and/or DKIM-verified (sub)domain,
#                       # the message is accepted without further spam checks, such as a junk filter or
#                       # DMARC reject evaluation. DMARC rejects should not apply for mailing lists that
#                       # are not configured to rewrite the From-header of messages that don't have a
#                       # passing DKIM signature of the From-domain. Otherwise, by rejecting messages, you
#                       # may be automatically unsubscribed from the mailing list. The assumption is that
#                       # mailing lists do their own spam filtering/moderation. (optional)
#                       ListAllowDomain: list.example.org
#       
#                       # Mailbox to deliver to if this ruleset matches.
#                       Mailbox: Lists/Example
#       

        # If configured, messages classified as weakly spam are rejected with instructions
        # to retry delivery, but this time with a signed token added to the subject.
        # During the next delivery attempt, the signed token will bypass the spam filter.
        # Messages with a clear spam signal, such as a known bad reputation, are
        # rejected/delayed without a signed token. (optional)
        SubjectPass:

            # How long unique values are accepted after generating, e.g. 12h.
            Period: 12h0m0s

        # Mail that looks like spam will be rejected, but a copy can be stored temporarily
        # in a mailbox, e.g. Rejects. If mail isn't coming in when you expect, you can
        # look there. The mail still isn't accepted, so the remote mail server may retry
        # (hopefully, if legitimate), or give up (hopefully, if indeed a spammer).
        # Messages are automatically removed from this mailbox, so do not set it to a
        # mailbox that has messages you want to keep. (optional)
        RejectsMailbox: Rejects

        # Automatically set $Junk and $NotJunk flags based on mailbox messages are
        # delivered/moved/copied to. Email clients typically have too limited
        # functionality to conveniently set these flags, especially $NonJunk, but they can
        # all move messages to a different mailbox, so this helps them. (optional)
        AutomaticJunkFlags:

            # If enabled, flags will be set automatically if they match a regular expression
            # below. When two of the three mailbox regular expressions are set, the remaining
            # one will match all unmatched messages. Messages are matched in the order
            # specified and the search stops on the first match. Mailboxes are lowercased
            # before matching.
            Enabled: true

            # Example: ^(junk|spam). (optional)
            JunkMailboxRegexp: ^(junk|spam)

            # Example: ^(inbox|neutral|postmaster|dmarc|tlsrpt|rejects), and you may wish to
            # add trash depending on how you use it, or leave this empty. (optional)
            NeutralMailboxRegexp: ^(inbox|neutral|postmaster|dmarc|tlsrpt|rejects)

        # Content-based filtering, using the junk-status of individual messages to rank
        # words in such messages as spam or ham. It is recommended you always set the
        # applicable (non)-junk status on messages, and that you do not empty your Trash
        # because those messages contain valuable ham/spam training information.
        # (optional)
        JunkFilter:

            # Approximate spaminess score between 0 and 1 above which emails are rejected as
            # spam. Each delivery attempt adds a little noise to make it slightly harder for
            # spammers to identify words that strongly indicate non-spaminess and use it to
            # bypass the filter. E.g. 0.95.
            Threshold: 0.950000
            Params:

                # Track ham/spam ranking for single words. (optional)
                Onegrams: true

                # Maximum power a word (combination) can have. If spaminess is 0.99, and max power
                # is 0.1, spaminess of the word will be set to 0.9. Similar for ham words.
                MaxPower: 0.010000

                # Number of most spammy/hammy words to use for calculating probability. E.g. 10.
                TopWords: 10

                # Ignore words that are this much away from 0.5 haminess/spaminess. E.g. 0.1,
                # causing word (combinations) of 0.4 to 0.6 to be ignored. (optional)
                IgnoreWords: 0.100000

                # Occurrences in word database until a word is considered rare and its influence
                # in calculating probability reduced. E.g. 1 or 2. (optional)
                RareWords: 2

Not sure what I am doing wrong. The error does not mean anything.

[mjl-]

Could it be your external IP ("x.x.x.x") is not configured on a network interface on this fedora machine, but on a (nat) router? I would think so, given the screenshot of port forwards. The error says it cannot bind to the requested IP, so that would make sense in case of NAT. If that's the case, you could specify the 192.... address in the "public" Listener (and remove it from the "internal" Listener), and configure your external IP address in the public listener under "NATIPs".

Keep in mind that you will run into deliverability issues when you external/public IP address changes. Once you get further, you'll set DNS records (e.g. SPF) that tie your domain in with your external IP. I'm also guessing you cannot set up reverse DNS for your external IP, which is used by some mail servers to increase the "looks like spam score". Receiving email should be OK, but it's not great if your IP changes and someone else temporarily has the IP for your MX record...

[kikoreis]

I had a similar issue and as mjl said, mox expects addresses listed under IPs to be bind()able from the local machine. You can use NATIPs to indicate the routable IP, and specify the address for the local interface under IPs.

However, a bigger issue will be running an SMTP server behind a dynamic IP address; at the very least that IP range will likely be present on multiple DNSBL lists. Do you not have access to a static IP address you could use instead?

[mjl-]

I hope this has been resolved by now, or is no longer an issue? Given the lack of activity. I'll close this issue for now, feel free to reopen if help is still needed.