MikeL's FreeBSD howto - basic sendmail configuration

This is basically a set of tips on how to configure sendmail. The intent is not to cover everything in detail, merely to point you to each of the tasks that must be performed and to help you know why you're doing it.


[20240418]
I'm seeing mailer_deamon bounces from comcast from an address that exists, but includes my system name, in other words, does not exactly match the PTR record. It appears that comcast is checking the envelope sender, or the Return-Path. I tried changing the Return-Path with the H?P?Return-Path: blah-blah but it does not seem to work. (I hacked it directly into the sendmail.cf file and yes, I remembered to restart sendmail.)

I've since done the following to try to change the envelope sender, and it seems to be showing up, so we'll see over time if there's any improvement.
define(`_REC_END_', `for $u; $|;
$.$b
(envelope-from: postmaster@$j)')


[20240327]
So ignore all the stuff immediately below on how to build the system version. You need to build from ports.
cd /usr/ports/mail/sendmail
make config de-select IPV6
While you're in there, you may consider de-selecting PICKY_HELO_CHECK. This causes "X-Authentication-Warning: [] claimed to be []" in the log. This is mildly annoying as it will show up with any gateway, including yourself. Every in-house local LAN (192.168.x.x) email will come through as your DSL modem (gateway) address, thus triggering this. Of course you'll also lose this info from external bad guys - but you're probably not acting on that anyways, so (in my opinion) -- the heck with it.
make
make install
Once built, edit your mailer.conf (see below) to point to /usr/local/sbin/sendmail.
This does fix the comcast "no route to host" problem that was preventing comcast emails from delivery. Note that the comcast error was some bogus "BL000000" error about blacklists - no, it was this IPV6 problem. Their website and submit form were of zero help.

[20240321]
I've had a problem where comcast is consistently rejecting emails from my server, even though everything is working fine (dkim, spf, dmarc, all of it) - mxtoolbox says I'm perfect!
Looking into the maillog, it seems that comcast is trying to go ipv6, and is getting a "no route to host" error. This error not surprising as my upstream ISP has not provided IPV6, only v4. So the issue is, how to stop sendmail from trying to use ipv6 at all. I've googled for hours and tried all sorts of .mc file things, nothing works. Next thing will be to try to recompile from system src without that option.
Test for ipv6 is easy:
sendmail -d0.10 | grep INET6 and hit Ctrl-D to get out.
First off, I seem to have not taken the 'src' option at install time.
In browser, goto http://ftp.freebsd.org/pub/FreeBSD/releases/ and download your appropriate src.txz. Then do tar -C / src.txz.
Edit /etc/make.conf (create if necessary -- note default at /usr/share/examples/etc/make.conf) and add:
SENDMAIL_CFLAGS+= -I/usr/local/include -DSASL2
SENDMAIL_CFLAGS+= -UNETINET6
SENDMAIL_lDLAGS+= -L/usr/local/lib
SENDMAIL_lDLAGS+= -lsasl2
BTW: The following makes are very quick, you don't need to allocate coffee-break time.
cd /usr/src/lib/libsmutil
make cleandir && make obj && make
cd /usr/src/lib/libsm
make cleandir && make obj && make
cd /usr/src/usr.sbin/sendmail
make cleandir && make obj && make && make install
Now find your 'mailer.conf', my old one seems to be at /etc/mail. The newly built one seems to be at /usr/local/etc/mail/, but I'm not sure that it's used.
The new executable seems to be at /usr/libexec/sendmail/sendmail so update your mailer.conf appropriately. Fuck - still seeing IPV6. Now tried the other dir:
cd /usr/local/etc/mail
mv mailer.conf mailer.conf.bak
ln -s /etc/mail/mailer.conf mailer.conf
YAY! Got it!
Now also note that after all this work, we have a version that does not support blacklistd. I guess I must have already been running the port version, so should simply have done the following instead...
cd /usr/ports/mail/sendmail
make config
Deselect IPV6. I also chose to select CYRUSLOOKUP, we'll see what happens...
make
Blows chunks after a while - will try a portsnap update.
[20230101]
Merry New Year - I'm working on computer problems - sigh...

Latest issue was the new install, Thunderbird was not able to send, error:
Relaying denied: IP name lookup failed [192.168.0.34]
Simply needed to add to /etc/mail/access:
Connect:192.168.0 RELAY


[20221229]
Another useful trick for analyzing sendmail problems. Add -d8.20 parm to show detailed DNS info as send progresses.

I'm getting maillog errors:
sendmail: Losing ./qf#####: savemail panic
sendmail: SYSERR(root): savemail: cannot save rejected email anywhere
A super quick and easy way to test your postmaster alias:
date | sendmail -v -Am postmaster
This one turned out to be that I had define(`confLOCAL_MAILER', `cyrusv2') and MAILER(`cyrusv2') in my mc file. This was copied from another system that does work, I don't understand why it's working on that system...
I took that out, no more savemail panic, still not getting mail via imap though. Put it back, now suddenly everything is working. Don't know which other change I made that fixed it, but I'm gonna quit now while I'm ahead!


[20200502]
Notes on how to recompile sendmail. Problem I'm having is related to IPv6 - I'm hoping if I simply recompile without that feature, it'll fix it. https://lists.freebsd.org/pipermail/freebsd-questions/2006-August/128775.html

[20200404]
I'm completely unable to get my email secondary to do local delivery to itself, even when called out by fqdn. Still haven't figured it out yet, but just so I don't forget, one thing I did was create a link for mail.local in /usr/local/libexec to /usr/libexec/. I have a machine that I think works, and it did have this link, whereas it was not present on the non-working box.

[20200330]
Still working on getting rid of following error:
STARTTLS: x509 cert verify: depth=2 /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority, state=0, reason=unable to get certificate CRL
The following seemed informative, this did a dump of MY certificate, and included a URI to a CRL. I fetched that, but it didn't seem to work either.
openssl x509 -in [your .crt file] -text | more
The revoke file IS accessible, I set it and the directory it's in to world-read for a minute while I tested this - no change. Maybe it's having trouble with the format of the file itself? It does appear to be binary... I tried the following to convert it to PEM, doesn't seem to have helped, but here it is in case I need it again...
openssl crl -inform DER -in 20200330-NetworkSolutionsOVServerCA2.crl -outform PEM -out zzz

[20200327] When you're looking through your maillog and you see "may be forged", this probably means that the RDNS lookup does not match the configured name passed into sendmail. If this is your own server, you need to contact your upstream provider to have your PTR change to be:
[your full hostname with doman] dot [your ip address, reversed] dot in-addr.arpa

[20200323] Note that if you're installing mailman, you'll need to modify it's SMTP_MAX_RCPTS setting to match your.mc file MAX_RCPTS_PER_MESSAGE. See mailman config page.

[20190115] Sendmail tweaks I've had to do.
dnl Following fixes following error in /var/log/messages:
dnl [...] sm-mta[47220]: [...] SYSERR(root): timeout writing message to [...]
dnl See:
dnl https://forums.freebsd.org/threads/timeout-writing-message-to-local.55563/
dnl https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869666
FEATURE(`nocanonify')
dnl define(`confDIRECT_SUBMISSION_MODIFIERS', `C')

dnl Following limits size of file that will be sent to spamd, without this
dnl spamass will simply skip parsing of large emails and let them through.
define(`SMTP_MAILER_MAX', `15000000')
define(`confMAX_MESSAGE_SIZE', `15000000')

dnl Following changes from default: upped S and R from 4m to 6m, added T val to F switch

INPUT_MAIL_FILTER(`spamassassin', `S=local:/var/run/spamass-milter.sock, F=T, T=C:15m;S:6m;R:6m;E:10m')

define(`confMILTER_MACROS_CONNECT', `b, j, _, {daemon_name}, {if_name}, {if_addr}'})

define(`confMILTER_MACROS_HELO', confMILTER_MACROS_HELO``, {verify}'')
dnl 20140302 - getting msg Could not retrieve sendmail macro "b"!
dnl in logfile. see:
dnl http://lists.gnu.org/archive/html/spamass-milt-list/2006-05/msg00011.html
define(`confMILTER_MACROS_ENVRCPT', ``b, r, v, Z'')

define(`confINPUT_MAIL_FILTERS', `spamassassin')

dnl put in MAX_RCPTS_PER_MESSAGE after another customer send to hundreds
dnl of senders and it's not looping resending... 16-Aug-2010
define(`confMAX_RCPTS_PER_MESSAGE', `25')

vacation (autoreply)

General

Primary machine

Secondary machine


Copyright © 1995-2024 Mike Lempriere (running on host bayanus)