# MIAB refusing email from hosts on the internal network the miab server is on

**URL:** <https://discourse.mailinabox.email/t/miab-refusing-email-from-hosts-on-the-internal-network-the-miab-server-is-on/11930>\
**Category:** Help with Unusual Circumstances\
**Created:** [May 22, 2024, 11:17pm UTC](https://discourse.mailinabox.email/t/miab-refusing-email-from-hosts-on-the-internal-network-the-miab-server-is-on/11930 "2024-05-22T23:17:20Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![tfrohling](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/tfrohling/32/2705_2.png) [@tfrohling](https://discourse.mailinabox.email/u/tfrohling)\
**Post date:** [May 22, 2024, 11:17pm UTC](https://discourse.mailinabox.email/t/miab-refusing-email-from-hosts-on-the-internal-network-the-miab-server-is-on/11930/1 "2024-05-22T23:17:20Z")

</div>

My MIAB box is on a an internal net 10.9.26/24 and I have forwarding rules on the router to forward email to this host from the outside. I have MX records pointing to the external IPv4 address of the oiutside for the three domains that occupy the internal net. When I send email from a host on the internal net ([files.summertrail.org](http://files.summertrail.org)) with a destination of [ted@frohling.org](mailto:ted@frohling.org) (one of the advertised domains and the one that is the most well known and the PTR record for the outside address is [frohling.org](http://frohling.org) (it this matters in this case) MIAB rejects emails from files… like so:

```auto
This is the mail system at host files.summertrail.org.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

                   The mail system

<ted@frohling.org> (expanded from <root>): host
    box.summertrail.org[10.9.26.107] said: 550 5.7.27
    <root@files.summertrail.org>: Sender address rejected: Domain
    files.summertrail.org does not accept mail (nullMX) (in reply to RCPT TO
    command)

Reporting-MTA: dns; files.summertrail.org
X-Postfix-Queue-ID: F0FCF4165B
X-Postfix-Sender: rfc822; root@files.summertrail.org
Arrival-Date: Tue, 21 May 2024 06:26:52 -0700 (MST)

Final-Recipient: rfc822; ted@frohling.org
Original-Recipient: rfc822;root@files.summertrail.org
Action: failed
Status: 5.7.27
Remote-MTA: dns; box.summertrail.org
Diagnostic-Code: smtp; 550 5.7.27 <root@files.summertrail.org>: Sender address
    rejected: Domain files.summertrail.org does not accept mail (nullMX)

Return-Path: <root@files.summertrail.org>
Received: by files.summertrail.org (Postfix)
	id F0FCF4165B; Tue, 21 May 2024 06:26:52 -0700 (MST)
Delivered-To: root@files.summertrail.org
Received: by files.summertrail.org (Postfix, from userid 0)
	id E3F12416C2; Tue, 21 May 2024 06:26:52 -0700 (MST)
From: root@files.summertrail.org (Cron Daemon)
To: root@files.summertrail.org
Subject: Cron <root@files> test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
Message-Id: <20240521132652.E3F12416C2@files.summertrail.org>
Date: Tue, 21 May 2024 06:26:52 -0700 (MST)

```

It’s true, [files.summertrail.org](http://files.summertrail.org) is not setup to receive emails.

Can’t figure out why this is happening. Please let me know what other log dumps would be helpful in solving this problem.

Thanks

Ted

---

<div class="post-metadata">

**Author:** ![stylnchris](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/stylnchris/32/2189_2.png) [@stylnchris](https://discourse.mailinabox.email/u/stylnchris)\
**Post date:** [May 23, 2024, 12:06am UTC](https://discourse.mailinabox.email/t/miab-refusing-email-from-hosts-on-the-internal-network-the-miab-server-is-on/11930/2 "2024-05-23T00:06:21Z")

</div>

Sounds like your router doesn’t support hair-pinning.

In which case you would need to run “internal DNS” and basically poison internal DNS to resolve dns names that are local, locally.

Right now your trying to resolve [files.summertrail.org](http://files.summertrail.org) if you go to your PC and do a “nslookup [files.summertrail.org](http://files.summertrail.org)” (assuming that is the name of your MIAB server) what does it return? Your public IP or your interal private IP.

So say your PC is 10.9.26.100/24 and your MIAB server is 10.9.26.25/24

you would need some kind of DNS to tell your PC not to return some public IP.

Right now if I do a “nslookup [files.summertrail.org](http://files.summertrail.org)” it returns 10.9.26.190.

This is a private IP space so it will never work on the internet.

What is your public IP?

What is the contents of /etc/mailinabox.conf

```auto
cat /etc/mailinabox.conf

```

```auto
C:\Users\chris>nslookup frohling.org

Non-authoritative answer:
Name: frohling.org
Address: 216.183.79.79

```

Pretty sure this one above is using your Public IP appropriately.

Are you using DNS on your box or external DNS (from the domain registrar?)

---

<div class="post-metadata">

**Author:** ![tfrohling](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/tfrohling/32/2705_2.png) [@tfrohling](https://discourse.mailinabox.email/u/tfrohling)\
**Post date:** [May 23, 2024, 7:44pm UTC](https://discourse.mailinabox.email/t/miab-refusing-email-from-hosts-on-the-internal-network-the-miab-server-is-on/11930/3 "2024-05-23T19:44:13Z")

</div>

Thanks for replying to my problem and helping me solve this one.

Actually in checking this from other systems on my internal network, none can get MIAB to accept their emails.

Looking at the main.cf I have this mynetworks = 127.0.0.0/8 10.9.26.0/24

here is /etc/mailinabox.conf

root@box:/etc# cat mailinabox.conf  
STORAGE\_USER=user-data  
STORAGE\_ROOT=/home/user-data  
PRIMARY\_HOSTNAME=[box.summertrail.org](http://box.summertrail.org)  
PUBLIC\_IP=216.183.79.79  
PUBLIC\_IPV6=  
PRIVATE\_IP=10.9.26.107  
PRIVATE\_IPV6=  
MTA\_STS\_MODE=enforce

The files machine doesn’t have any problem getting to any of the systems on the internal net. I did add [files.summertrail.org](http://files.summertrail.org) at 10.9.26.107 in the custom DNS for MIAB to see if that would get me around the problem. All the hosts on my network point there DNS to my pi-hole DNS server. I tried adding that nameserver address to /etc/resolv.conf to see if that will get around the problem on the MIAB system (box…)

10.9.26.8 is the address of the pi-hole DNS server.

Here is an example of nslookup on the MIAB box

root@box:/etc/postfix# nslookup [files.summertrail.org](http://files.summertrail.org)  
Server: 10.9.26.8  
Address: 10.9.26.8#53

Name: [files.summertrail.org](http://files.summertrail.org)  
Address: 10.9.26.190

Here’s resolv.conf

nameserver 10.9.26.8  
nameserver 127.0.0.1

Here is my main.cf:  
root@box:/etc/postfix# postconf -n  
alias\_database = hash:/etc/aliases  
alias\_maps = hash:/etc/aliases  
append\_dot\_mydomain = no  
biff = no  
bounce\_queue\_lifetime = 1d  
compatibility\_level = 3.6  
delay\_warning\_time = 3h  
inet\_interfaces = all  
inet\_protocols = all  
local\_recipient\_maps = $virtual\_mailbox\_maps  
mailbox\_size\_limit = 0  
maximal\_queue\_lifetime = 2d  
message\_size\_limit = 134217728  
milter\_default\_action = accept  
mydestination = localhost  
myhostname = [box.summertrail.org](http://box.summertrail.org)  
mynetworks = 127.0.0.0/8 10.9.26.0/24  
non\_smtpd\_milters = $smtpd\_milters  
readme\_directory = no  
recipient\_delimiter = +  
relayhost =  
smtp\_bind\_address = 10.9.26.107  
smtp\_bind\_address6 =  
smtp\_dns\_support\_level = dnssec  
smtp\_tls\_CAfile = /etc/ssl/certs/ca-certificates.crt  
smtp\_tls\_CApath = /etc/ssl/certs  
smtp\_tls\_ciphers = medium  
smtp\_tls\_exclude\_ciphers = aNULL,RC4  
smtp\_tls\_loglevel = 2  
smtp\_tls\_mandatory\_ciphers = high  
smtp\_tls\_mandatory\_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1  
smtp\_tls\_protocols = !SSLv2,!SSLv3  
smtp\_tls\_security\_level = dane  
smtp\_tls\_session\_cache\_database = btree:${data\_directory}/smtp\_scache  
smtpd\_banner = $myhostname ESMTP Hi, I’m a Mail-in-a-Box (Ubuntu/Postfix; see [https://mailinabox.email/](https://mailinabox.email/))  
smtpd\_forbid\_bare\_newline = normalize  
smtpd\_milters = inet:127.0.0.1:8891 inet:127.0.0.1:8893  
smtpd\_recipient\_restrictions = permit\_sasl\_authenticated,permit\_mynetworks,reject\_rbl\_client zen.spamhaus.org=127.0.0.[2…11],reject\_unlisted\_recipient,check\_policy\_service inet:127.0.0.1:10023  
smtpd\_relay\_restrictions = permit\_sasl\_authenticated,permit\_mynetworks,reject\_unauth\_destination  
smtpd\_sasl\_auth\_enable = no  
smtpd\_sasl\_path = private/auth  
smtpd\_sasl\_type = dovecot  
smtpd\_sender\_login\_maps = sqlite:/etc/postfix/sender-login-maps.cf  
smtpd\_sender\_restrictions = reject\_non\_fqdn\_sender,reject\_unknown\_sender\_domain,reject\_authenticated\_sender\_login\_mismatch,reject\_rhsbl\_sender dbl.spamhaus.org=127.0.1.[2…99]  
smtpd\_tls\_auth\_only = yes  
smtpd\_tls\_cert\_file = /home/user-data/ssl/ssl\_certificate.pem  
smtpd\_tls\_ciphers = medium  
smtpd\_tls\_dh1024\_param\_file = /home/user-data/ssl/dh2048.pem  
smtpd\_tls\_exclude\_ciphers = aNULL,RC4  
smtpd\_tls\_key\_file = /home/user-data/ssl/ssl\_private\_key.pem  
smtpd\_tls\_mandatory\_ciphers = high  
smtpd\_tls\_mandatory\_exclude\_ciphers = aNULL,DES,3DES,MD5,DES+MD5,RC4  
smtpd\_tls\_mandatory\_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1  
smtpd\_tls\_protocols = !SSLv2,!SSLv3  
smtpd\_tls\_received\_header = yes  
smtpd\_tls\_security\_level = may  
smtputf8\_enable = no  
tls\_high\_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384  
tls\_medium\_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA  
tls\_preempt\_cipherlist = no  
virtual\_alias\_maps = sqlite:/etc/postfix/virtual-alias-maps.cf  
virtual\_mailbox\_domains = sqlite:/etc/postfix/virtual-mailbox-domains.cf  
virtual\_mailbox\_maps = sqlite:/etc/postfix/virtual-mailbox-maps.cf  
virtual\_transport = lmtp:[127.0.0.1]:10025

> Blockquote

---

<div class="post-metadata">

**Author:** ![andrew](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/andrew/32/1449_2.png) [@andrew](https://discourse.mailinabox.email/u/andrew)\
**Post date:** [May 24, 2024, 12:11am UTC](https://discourse.mailinabox.email/t/miab-refusing-email-from-hosts-on-the-internal-network-the-miab-server-is-on/11930/4 "2024-05-24T00:11:54Z")

</div>

Here’s what I’ve done to get local servers to send via MIAB:

- In MIAB / admin / custom\_dns, added A, AAAA, and MX records for the full local name of each server (eg [myserver.mydomain.com](http://myserver.mydomain.com))

- In `/etc/postfix/main.cf` adjust the `mynetworks` line to include your local servers (both IPv4 and IPv6 addresses).

- Whitelist the servers by adding to `/etc/mail/spamassassin/99_local.cf` lines like `whitelist_from *@myserver.mydomain.com`, and `whitelist_from *@myserver.lan` if that name also resolves to your server.

- And list the server domains in `/etc/postgrey/whitelist_clients.local`

- Then reboot the box, try a test email from a server, and you might need to wait 4 mins and try another test email.

Not all of that makes sense (probably not all necessary) but it’s in my notes of what I do on upgrade/rebuild. The whitelisting doesn’t always seem to work and I haven’t looked into what I’ve got wrong about that 🙂

---

<div class="post-metadata">

**Author:** ![tfrohling](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/tfrohling/32/2705_2.png) [@tfrohling](https://discourse.mailinabox.email/u/tfrohling)\
**Post date:** [May 24, 2024, 9:35pm UTC](https://discourse.mailinabox.email/t/miab-refusing-email-from-hosts-on-the-internal-network-the-miab-server-is-on/11930/5 "2024-05-24T21:35:06Z")

</div>

Much thanks Andrew. It looks like these changes have things working. I’ll need to wait till tomorrow as the various cron jobs fire off. After making the changes, I received what were several held messages. Fingers Crossed. 🤞

---

<div class="post-metadata">

**Author:** ![tfrohling](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/tfrohling/32/2705_2.png) [@tfrohling](https://discourse.mailinabox.email/u/tfrohling)\
**Post date:** [May 25, 2024, 7:56pm UTC](https://discourse.mailinabox.email/t/miab-refusing-email-from-hosts-on-the-internal-network-the-miab-server-is-on/11930/6 "2024-05-25T19:56:47Z")

</div>

Got the output of the cron jobs from the other systems. The adds were not documented anywhere that I could find and they work. Sort of non-intuitive that they should have been needed, but Andrew hit the nail on the head. Seems that the MIAB documentation for setup should cover this.  
ted

---

<div class="post-metadata">

**Author:** ![system](https://discourse.mailinabox.email/uploads/default/original/2X/4/4d0933d13c456b7e57f296aa6cc344525b6f0c70.png) [@system](https://discourse.mailinabox.email/u/system)\
**Post date:** [July 4, 2024, 7:57pm UTC](https://discourse.mailinabox.email/t/miab-refusing-email-from-hosts-on-the-internal-network-the-miab-server-is-on/11930/7 "2024-07-04T19:57:47Z")

</div>

This topic was automatically closed 40 days after the last reply. New replies are no longer allowed.