postfix->dns too short timeouts?

[Mipam]

Hi,

By accident i run into some icmp type 3 code 3 from the mailserver to the
dns server. Actually quite a lot of them, it happens all the time.
After checking i found this:

postfix does a request for the mx record of a domain in order to be able
to deliver the mail:

11:29:27.750125 x.x.x.x.56849 > y.y.y.y.53: [bad udp cksum
af79!] 64858+ MX? netland.nl. (28) (ttl 64, id 27385, len 56, bad cksum
0!)

(note that the NIC has tcp checksum offloading, therefore the bad
checksums in the tcpdump outputs.
Later i got this response:

11:30:22.825167 y.y.y.y.53 > x.x.x.x.56849: [udp sum ok]
64858 ServFail q: MX? netland.nl. 0/0/0 (28) (ttl 64, id 11282, len 56)

The postfix machine answered:

11:30:22.825193 x.x.x.x > y.y.y.y: icmp: 82.201.105.244 udp
port 56849 unreachable for y.y.y.y.53 > x.x.x.x.56849: [no cksum]
[|domain] (ttl 64, id 11282, len 56) (ttl 64, id 27415, len 56, bad cksum 0!)
4500 0038 6b17 0000 4001 0000 xxxx xxxx
yyyy yyyy 0303 1e92 0000 0000 4500 0038
2c12 0000 4011 d527 52c9 69f5 52c9 69f4
0035 de11 0024 0000

Actually, i'm seeing these message many many times.
All the time: after 55 seconds the dns responds back to postfix that
there's ServFail and postfix allready seems to have closed the listening
port so an icmp type 3 code 3 is being generated.
Note that this only happens in the case of ServFails most domains can be
resolved in time of course.
These icmps come when a SerFail has been reported.
In the postfix logs i see:

May 10 11:30:07 mail01 postfix/smtpd[29714]: 80FAB5C98: reject: RCPT from
host.domain.com[z.z.z.z]: 450 <***@netland.nl>: Recipient
address rejected: Domain not found;

So seemingly postfix waits 40 seconds for an answer, if no dns response
haas been received within this time, the message is rejected and the port
is being closed. Is there a time which i can adjust to match the dns timer
or maybe i should adjust the dns timer?
Bye,

Mipam.

[Wietse Venema]

Postfix uses the DNS client in the SYSTEM LIBRARY: res_query() and
friends. There is no timeout option in the resolver(3) manual.

Wietse

[V***@MorganStanley.com]

Post by Mipam
Hi,
All the time: after 55 seconds the dns responds back to postfix that
there's ServFail and postfix allready seems to have closed the listening
port so an icmp type 3 code 3 is being generated. Note that this only
happens in the case of ServFails most domains can be resolved in time of
course. These icmps come when a SerFail has been reported. In the
May 10 11:30:07 mail01 postfix/smtpd[29714]: 80FAB5C98: reject: RCPT from
address rejected: Domain not found;
So seemingly postfix waits 40 seconds for an answer, if no dns response
haas been received within this time, the message is rejected and the
port is being closed. Is there a time which i can adjust to match the
dns timer or maybe i should adjust the dns timer? Bye,

What point is there in waiting longer if the result is a SERVFAIL anyway?
The DNS resolver timeouts are set in the C library. Postfix just uses the
defaults. For enlightenment, see the man page for resolv.conf for
available tuning options, and then *don't* change anything! If the domain
being queried is yours, fix the real problem (the SERVFAIL is caused by a
misconfiguration somewhere).

[V***@MorganStanley.com]

Post by Wietse Venema
Postfix uses the DNS client in the SYSTEM LIBRARY: res_query() and
friends. There is no timeout option in the resolver(3) manual.

On many platforms the DNS timeouts can be tuned (globally for all
applications) in resolv.conf(5). Unless the platform-wide defaults are
blatantly wrong is not a good idea. Also on a per-application basis the
timeouts can be changed by modifying _res.options after calling res_init()
(this too is typically not a good idea).

[Mipam]

Post by V***@MorganStanley.com

Post by Mipam
So seemingly postfix waits 40 seconds for an answer, if no dns response
haas been received within this time, the message is rejected and the
port is being closed. Is there a time which i can adjust to match the
dns timer or maybe i should adjust the dns timer? Bye,

What point is there in waiting longer if the result is a SERVFAIL anyway?
The DNS resolver timeouts are set in the C library. Postfix just uses the
defaults. For enlightenment, see the man page for resolv.conf for
available tuning options, and then *don't* change anything! If the domain
being queried is yours, fix the real problem (the SERVFAIL is caused by a
misconfiguration somewhere).

I checked man 5 resolv.conf, no tunable options could be found concerning
timers etc. Anyway, the point was like this:
I noticed that consequently postfix waits for 40 seconds for an answer on
the mx record query. I guess this is set in the DNS client in the
SYSTEM LIBRARY, as i read in the previous message. Consequently bind 8
answered after 55 seconds that
there was a ServFail. That's a difference of 15 seconds. I dont say
either is wrong or bad or, i just noticed it and wondered if it was
possible to change.
I tried to resolve the mx records at three different dns servers with 3
other providers, all came back with the same ServFail message.
Most likely that the dns of the queried domain
is misconfigured, i checked
the config of my own dns but couldnt find errors in the configs.
But that's just me saying so, maybe others can find errors in it.

How many error free correct DNS servers are there anyway?
Bye,

Mipam.

[V***@MorganStanley.com]

Post by Mipam
I checked man 5 resolv.conf, no tunable options could be found concerning
timers etc.

This is platform dependent. For example, on one of the Linux machines I
have access to, man 5 resolv.conf:

options Allows certain internal resolver variables to be modified. The
syntax is
options option ...
where option is one of the following:
...
timeout:n
sets the amount of time the resolver will wait for a
response from a remote name server before retrying the
query via a different name server. Measured in sec-
onds, the default is RES_TIMEOUT (see <resolv.h> ).

attempts:n
sets the number of times the resolver will send a
query to its name servers before giving up and return-
ing an error to the calling application. The default
is RES_DFLRETRY (see <resolv.h> ).
...

Post by Mipam
I noticed that consequently postfix waits for 40 seconds for an answer on
the mx record query. I guess this is set in the DNS client in the
SYSTEM LIBRARY, as i read in the previous message. Consequently bind 8
answered after 55 seconds that
there was a ServFail. That's a difference of 15 seconds. I dont say
either is wrong or bad or, i just noticed it and wondered if it was
possible to change.

The client gives up in a reasonable time (perhaps even too long given
typical SMTP response timeouts).

Post by Mipam
I tried to resolve the mx records at three different dns servers with 3
other providers, all came back with the same ServFail message. Most
likely that the dns of the queried domain is misconfigured, i checked
the config of my own dns but couldnt find errors in the configs.

If the domain is not yours it is likely not your problem unless this
happens for a lot of domains that you know to not be spammer
domain-of-the-day domains.

Post by Mipam
How many error free correct DNS servers are there anyway?

A majority of DNS servers don't return SERVFAIL for production domains.

[Michael Tokarev]

Post by V***@MorganStanley.com

Post by Wietse Venema
Postfix uses the DNS client in the SYSTEM LIBRARY: res_query() and
friends. There is no timeout option in the resolver(3) manual.

On many platforms the DNS timeouts can be tuned (globally for all
applications) in resolv.conf(5). Unless the platform-wide defaults are
blatantly wrong is not a good idea. Also on a per-application basis the
timeouts can be changed by modifying _res.options after calling res_init()
(this too is typically not a good idea).

There's also $RES_OPTIONS env. var honored by bind-based libreslov,
with the same interpretation as `options' statement in resolv.conf.

RES_OPTIONS="timeout:10 attempts:5"

etc. Not sure how it's portable, however (some systems may use
quite old resolver libraries where that env. var isn't used).

Tweaking _res.* (_res.retrans for timeout, _res.retry for attempts -
not _res.options) is ok too.

/mjt

[Wietse Venema]

Post by V***@MorganStanley.com

Post by Wietse Venema
Postfix uses the DNS client in the SYSTEM LIBRARY: res_query() and
friends. There is no timeout option in the resolver(3) manual.

On many platforms the DNS timeouts can be tuned (globally for all
applications) in resolv.conf(5). Unless the platform-wide defaults are
blatantly wrong is not a good idea. Also on a per-application basis the
timeouts can be changed by modifying _res.options after calling res_init()
(this too is typically not a good idea).

Sorry, there is no timeout option documented, and I will not write
software that uses undocumented interfaces.

[V***@MorganStanley.com]

Post by Wietse Venema

Post by V***@MorganStanley.com

Post by Wietse Venema
Postfix uses the DNS client in the SYSTEM LIBRARY: res_query() and
friends. There is no timeout option in the resolver(3) manual.

On many platforms the DNS timeouts can be tuned (globally for all
applications) in resolv.conf(5). Unless the platform-wide defaults are
blatantly wrong is not a good idea. Also on a per-application basis the
timeouts can be changed by modifying _res.options after calling res_init()
(this too is typically not a good idea).

Sorry, there is no timeout option documented, and I will not write
software that uses undocumented interfaces.

I am not suggesting you do. The OP's report has Postfix giving up before
"named" gave up, this is a non-problem.