0

IPv4 mail is working fine with DKIM, SPF, etc. I can send to Gmail no problem and all validations pass. Hotmail/Outlook also work after doing validation with them.

I can send IPv6 mail through my server from another server on my side of my IPv6 firewall no problem (using the Python encrypted SMTP libraries). I look at the headers, and all connections are IPv6. I have reverse DNS for my IPv6 addresses pointing to mail.example.org and have validated that many times.

When I send a message FROM my Gmail account since I added my AAAA records for my domain, there is about a 30-45 second delay after it is sent (not the undo delay...this is after that) where the mail finally arrives on IPv4. If I remove the AAAA records, the mail is sent instantly.

In my mind, this is all pointing to attempts to validate the MX records via IPv6, failing, and falling back to IPv4 for some reason. I don't see any IPv6 connection attempts on my exim server. It seems the remote mail servers do DNS lookups and making decisions based on that without any mail server connections

From a remote IPv6 host I can manually connect with openssl to both 587 (explicit TLS) and 465 (implicit TLS) and see the correct certificate using these commands:

openssl s_client -showcerts -servername mail.example.org -starttls smtp -connect mail.example.org:587

openssl s_client -showcerts -servername mail.example.org -connect mail.example.org:465

I can also send an email manually with the following commands which I got from here: https://www.stevenrombauts.be/2018/12/test-smtp-with-telnet-or-openssl/

MAIL FROM: [email protected]
rcpt to: [email protected]
DATA
From: [email protected]
Subject: Test message!

Hi,

This is a test message!

Best,
User!

Mxtoolbox doesn't have great support for IPv6 and only seems to really check AAAA records, and doesn't offer the smtp test on IPv6. Other locations seem to have broken implementations (I think) that say the certificate is bad, but I have verified that with the above commands.

Ideas?

Yes IPv4 works, but I'd like to get IPv6 working even if for nothing more than self satisfaction.

4
  • Are you able to connect to port 25 from the remote IPv6 host, and are you verifying that the connection is done over IPv6? Ports 465/587 are SMTP submit ports, not server-to-server ports. Jan 22, 2023 at 15:34
  • @user1686 good point, I'll need to get my remote host opened for port 25. It's an HE.net IPv6 tunnel, but I don't see how that can be a problem aside from maybe being on a blacklist. From the HE.net servers: 25/tcp open smtp 465/tcp open smtps 587/tcp open submission
    – Brian
    Jan 22, 2023 at 15:37
  • son of a diddly. HE.net blocks port 25 by default for obvious reasons! I read that a few days ago too! I suspect that is the issue. Their port scan showed open, but maybe that is because they are on my side of their firewall.
    – Brian
    Jan 22, 2023 at 16:07
  • @user1686 make an answer if you want and I'll accept. Indeed, the tunnel port was just opened and it works great now.
    – Brian
    Jan 23, 2023 at 0:03

0

You must log in to answer this question.

Browse other questions tagged .