When sendmail forwards emails, receiving server sometimes gives 'Service not available'

1
votes

I host a domain for a client; the domain's A records point to my IP address. When email arrives addressed to someone in his domain, he just wants to forward it to his ISP (charter.net). This works about 90-99% of the time, but a few times a day charter.net rejects the message with 'Service not available'. We tried forwarding to his gmail account instead, and same thing -- it usually works but sometimes gmail returns 'Service not available'. When this happens, my sendmail apparently gives up.

My suspicion is it is not the recipient's server uptime that is at issue; it rejects email that it sees as suspicious.

I have recently added SPF and DKIM records for my server's canonical name but I still get 'Service not available' from charter.net. Now sendmail DKIM-signs any mail that originates on my server, but it is not signing email that it forwards. I have not found a way to configure opendkim to do that. But I have seen that mandrillapp.com resigns email that it forwards; the headers include a DKIM-signature with d=originaldomain.com, and a 2nd DKIM-signature with d=mandrillapp.com.

So I guess my questions are,

1) Does anyone really know why my server gets 'Service not available' from ultimate recipient?

2) Can I configure opendkim to sign email that my server forwards?

3) Might it do any good to set up SPF and/or DKIM records for my client's domain?

Thanks, Bob

ADDENDUM: For forwarding, I have entries like this in /etc/mail/virtusertable:

[email protected] [email protected]

For DKIM, I have this in my sendmail.mc:

INPUT_MAIL_FILTER(`opendkim', `S=inet:[email protected]')

I also have clientdomain.com in /etc/mail/local-host-names, and as I said above clientdomain.com's A records resolve to the same IP as mydomain.com.

1
emailsmtpsendmaildkim
How EXACTLY are the emails forwarded? e.g. via ~/.forward file, via ~/.procmailrc file, … - AnFi
Thanks, see addendum above - Blob

1 Answers

1
votes

Classic sendmail redirects via aliases, ~/.forward file and virtusertable keep unchanged original envelope address (It is used in MAIL FROM command during SMTP session). It may make your forwards break restrictions set by SPF record of the original sender domain.

Possible fixes for "many addresses" redirect:

  • SRS
  • custom sendmail.cf fixes

For more details ask at more suited siter site serverfault.com.