[exim] Exim always expands sender_rcvhost to unverified IP

Top Page
Delete this message
Reply to this message
Author: Matt Corallo
Date:  
To: exim-users
Subject: [exim] Exim always expands sender_rcvhost to unverified IP
Like the title says, for some reason exim 4.94.2-7 (Debian stable) is refusing to ever expand
sender_rcvhost to a verified hostname. The below shows a simple email inbound from github, as well
as the relevant DNS traffic from exim to the DNS server (with spamd stopped to ensure we're not
confusing spamd queries with exim queries).

Possibly-relevant config entries are:

dkim_verify_signers = :
host_lookup = *
dns_dnssec_ok = 1
slow_lookup_log = 250

"options trust-ad" is set in resolv.conf.

Exim log:

Nov 16 16:36:55 mail exim[789201]: 2021-11-16 16:36:55 1mn1S3-003JJ3-Bt spam acl condition: spamd:
failed to connect to any address for 127.0.0.1: Connection refused
Nov 16 16:36:55 mail exim[789201]: 2021-11-16 16:36:55 1mn1S3-003JJ3-Bt spam acl condition: all
spamd servers failed
Nov 16 16:36:55 mail exim[789201]: 2021-11-16 16:36:55 1mn1S3-003JJ3-Bt spam acl condition: all
spamd servers failed
Nov 16 16:36:55 mail exim[789201]: 2021-11-16 16:36:55 1mn1S3-003JJ3-Bt H=out-25.smtp.github.com
(smtp.github.com) [192.30.252.208] Warning: ACL "warn" statement skipped: condition test deferred
Nov 16 16:36:55 mail exim[789201]: 2021-11-16 16:36:55 1mn1S3-003JJ3-Bt <= noreply@???
H=out-25.smtp.github.com (smtp.github.com) [192.30.252.208] P=esmtps
X=TLS1.2:ECDHE_X25519__ECDSA_SHA512__AES_256_GCM:256 CV=no S=6196 DKIM=github.com
id=bitcoin/bitcoin/pull/23496/review/807558392@???
Nov 16 16:36:55 mail exim[789202]: 2021-11-16 16:36:55 1mn1S3-003JJ3-Bt => btccore
<gh-core-notifications@???> F=<noreply@???> R=maildrop_router T=maildrop_pipe
Nov 16 16:36:55 mail exim[789202]: 2021-11-16 16:36:55 1mn1S3-003JJ3-Bt Completed

DNS queries, note that the FcRDNS lookup succeeds at 16:36:55.159851.

16:36:55.157242 IP (tos 0x0, ttl 64, id 14817, offset 0, flags [DF], proto UDP (17), length 84)
     69.59.18.99.47444 > 69.59.18.0.53: [udp sum ok] 23619+ [1au] PTR? 208.252.30.192.in-addr.arpa. 
ar: . OPT UDPsize=1200 DO (56)
16:36:55.157707 IP (tos 0x0, ttl 64, id 1218, offset 0, flags [none], proto UDP (17), length 1225)
     69.59.18.0.53 > 69.59.18.99.47444: [bad udp cksum 0xb39f -> 0xb0a2!] 23619 q: PTR? 
208.252.30.192.in-addr.arpa. 1/4/17 208.252.30.192.in-addr.arpa. [11m14s] PTR 
out-25.smtp.github.com. ns: 252.30.192.in-addr.arpa. [6h54m9s] NS dns2.p04.nsone.net., 
252.30.192.in-addr.arpa. [6h54m9s] NS dns1.p04.nsone.net., 252.30.192.in-addr.arpa. [6h54m9s] NS 
dns4.p04.nsone.net., 252.30.192.in-addr.arpa. [6h54m9s] NS dns3.p04.nsone.net. ar: 
dns1.p04.nsone.net. [5h27m] A 198.51.44.4, dns2.p04.nsone.net. [5h28m16s] A 198.51.45.4, 
dns3.p04.nsone.net. [5h27m39s] A 198.51.44.68, dns4.p04.nsone.net. [5h28m46s] A 198.51.45.68, 
dns1.p04.nsone.net. [5h31m24s] AAAA 2620:4d:4000:6259:7:4:0:1, dns2.p04.nsone.net. [5h32m41s] AAAA 
2a00:edc0:6259:7:4::2, dns3.p04.nsone.net. [5h31m15s] AAAA 2620:4d:4000:6259:7:4:0:3, 
dns4.p04.nsone.net. [5h31m39s] AAAA 2a00:edc0:6259:7:4::4, dns1.p04.nsone.net. [5h27m] RRSIG, 
dns1.p04.nsone.net. [5h31m24s] RRSIG, dns2.p04.nsone.net. [5h28m16s] RRSIG, dns2.p04.nsone.net. 
[5h32m41s] RRSIG, dns3.p04.nsone.net. [5h27m39s] RRSIG, dns3.p04.nsone.net. [5h31m15s] RRSIG, 
dns4.p04.nsone.net. [5h28m46s] RRSIG, dns4.p04.nsone.net. [5h31m39s] RRSIG, . OPT UDPsize=1432 DO (1197)
16:36:55.158465 IP (tos 0x0, ttl 64, id 14818, offset 0, flags [DF], proto UDP (17), length 79)
     69.59.18.99.41522 > 69.59.18.0.53: [udp sum ok] 64096+ [1au] AAAA? out-25.smtp.github.com. ar: 
. OPT UDPsize=1200 DO (51)
16:36:55.158976 IP (tos 0x0, ttl 64, id 1219, offset 0, flags [none], proto UDP (17), length 176)
     69.59.18.0.53 > 69.59.18.99.41522: [bad udp cksum 0xaf86 -> 0x074b!] 64096 q: AAAA? 
out-25.smtp.github.com. 0/1/1 ns: github.com. [2m12s] SOA ns-1707.awsdns-21.co.uk. 
awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ar: . OPT UDPsize=1432 DO (148)
16:36:55.159421 IP (tos 0x0, ttl 64, id 14819, offset 0, flags [DF], proto UDP (17), length 79)
     69.59.18.99.35042 > 69.59.18.0.53: [udp sum ok] 36466+ [1au] A? out-25.smtp.github.com. ar: . 
OPT UDPsize=1200 DO (51)
16:36:55.159851 IP (tos 0x0, ttl 64, id 1220, offset 0, flags [none], proto UDP (17), length 1211)
     69.59.18.0.53 > 69.59.18.99.35042: [bad udp cksum 0xb391 -> 0x4d29!] 36466 q: A? 
out-25.smtp.github.com. 1/8/22 out-25.smtp.github.com. [11m14s] A 192.30.252.208 ns: github.com. 
[23m34s] NS ns-1283.awsdns-32.org., github.com. [23m34s] NS dns3.p08.nsone.net., github.com. 
[23m34s] NS dns1.p08.nsone.net., github.com. [23m34s] NS ns-421.awsdns-52.com., github.com. [23m34s] 
NS dns2.p08.nsone.net., github.com. [23m34s] NS dns4.p08.nsone.net., github.com. [23m34s] NS 
ns-520.awsdns-01.net., github.com. [23m34s] NS ns-1707.awsdns-21.co.uk. ar: dns1.p08.nsone.net. 
[5h46m52s] A 198.51.44.8, dns2.p08.nsone.net. [5h46m54s] A 198.51.45.8, dns3.p08.nsone.net. 
[5h46m20s] A 198.51.44.72, dns4.p08.nsone.net. [5h46m15s] A 198.51.45.72, ns-421.awsdns-52.com. 
[1d5h26m42s] A 205.251.193.165, ns-520.awsdns-01.net. [1d5h27m1s] A 205.251.194.8, 
ns-1283.awsdns-32.org. [1d5h8m37s] A 205.251.197.3, ns-1707.awsdns-21.co.uk. [1d5h27m34s] A 
205.251.198.171, dns1.p08.nsone.net. [5h11m4s] AAAA 2620:4d:4000:6259:7:8:0:1, dns2.p08.nsone.net. 
[5h12m40s] AAAA 2a00:edc0:6259:7:8::2, dns3.p08.nsone.net. [5h50m18s] AAAA 
2620:4d:4000:6259:7:8:0:3, dns4.p08.nsone.net. [5h50m50s] AAAA 2a00:edc0:6259:7:8::4, 
ns-421.awsdns-52.com. [1d5h49m59s] AAAA 2600:9000:5301:a500::1, ns-520.awsdns-01.net. [1d5h49m41s] 
AAAA 2600:9000:5302:800::1, ns-1283.awsdns-32.org. [1d5h11m18s] AAAA 2600:9000:5305:300::1, 
ns-1707.awsdns-21.co.uk. [1d5h50m42s] AAAA 2600:9000:5306:ab00::1, dns1.p08.nsone.net. [5h46m52s] 
RRSIG, dns1.p08.nsone.net. [5h11m4s] RRSIG, dns2.p08.nsone.net. [5h46m54s] RRSIG, 
dns2.p08.nsone.net. [5h12m40s] RRSIG, dns3.p08.nsone.net. [5h46m20s] RRSIG, . OPT UDPsize=1432 DO (1183)
16:36:55.419515 IP (tos 0x0, ttl 64, id 15076, offset 0, flags [DF], proto UDP (17), length 85)
     69.59.18.99.57791 > 69.59.18.0.53: [udp sum ok] 25020+ [1au] TXT? pf2014._domainkey.github.com. 
ar: . OPT UDPsize=1200 DO (57)
16:36:55.420095 IP (tos 0x0, ttl 64, id 1221, offset 0, flags [none], proto UDP (17), length 1133)
     69.59.18.0.53 > 69.59.18.99.57791: [bad udp cksum 0xb343 -> 0x2097!] 25020 q: TXT? 
pf2014._domainkey.github.com. 1/8/19 pf2014._domainkey.github.com. [57m25s] TXT "v=DKIM1; k=rsa; 
p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDaCCQ+CiOqRkMAM/Oi04Xjhnxv3bXkTtA8KXt49RKQExLCmBxRpMp0PMMI73noKL/bZwEXljPO8HIfzG43ntPp1QRBUpn1UEvbp1/rlWPUop3i1j6aUpjxYGHEEzgmT+ncLUBDEPO4n4Zzt36DG3ZcJaLhvKtRkk2off5XD+BMvQIDAQAB" 
ns: github.com. [23m34s] NS ns-1283.awsdns-32.org., github.com. [23m34s] NS 
ns-1707.awsdns-21.co.uk., github.com. [23m34s] NS dns3.p08.nsone.net., github.com. [23m34s] NS 
dns4.p08.nsone.net., github.com. [23m34s] NS dns1.p08.nsone.net., github.com. [23m34s] NS 
ns-520.awsdns-01.net., github.com. [23m34s] NS ns-421.awsdns-52.com., github.com. [23m34s] NS 
dns2.p08.nsone.net. ar: dns1.p08.nsone.net. [5h46m52s] A 198.51.44.8, dns2.p08.nsone.net. [5h46m54s] 
A 198.51.45.8, dns3.p08.nsone.net. [5h46m20s] A 198.51.44.72, dns4.p08.nsone.net. [5h46m15s] A 
198.51.45.72, ns-421.awsdns-52.com. [1d5h26m42s] A 205.251.193.165, ns-520.awsdns-01.net. 
[1d5h27m1s] A 205.251.194.8, ns-1283.awsdns-32.org. [1d5h8m37s] A 205.251.197.3, 
ns-1707.awsdns-21.co.uk. [1d5h27m34s] A 205.251.198.171, dns1.p08.nsone.net. [5h11m4s] AAAA 
2620:4d:4000:6259:7:8:0:1, dns2.p08.nsone.net. [5h12m40s] AAAA 2a00:edc0:6259:7:8::2, 
dns3.p08.nsone.net. [5h50m18s] AAAA 2620:4d:4000:6259:7:8:0:3, dns4.p08.nsone.net. [5h50m50s] AAAA 
2a00:edc0:6259:7:8::4, ns-421.awsdns-52.com. [1d5h49m59s] AAAA 2600:9000:5301:a500::1, 
ns-520.awsdns-01.net. [1d5h49m41s] AAAA 2600:9000:5302:800::1, ns-1283.awsdns-32.org. [1d5h11m18s] 
AAAA 2600:9000:5305:300::1, ns-1707.awsdns-21.co.uk. [1d5h50m42s] AAAA 2600:9000:5306:ab00::1, 
dns1.p08.nsone.net. [5h46m52s] RRSIG, dns1.p08.nsone.net. [5h11m4s] RRSIG, . OPT UDPsize=1432 DO (1105)