stat=Deferred: 403 4.7.0 TLS handshake failed
哦! 前2天發現公司的mail server無法把信寄到部份別人家去! 簡單的做個檢查:
由公司的email寄到gmail的帳號, 是可以寄過去的, ok!
由公司的email寄到msn.com的帳號, 居然石沉大海, not ok!
看一下mailq, 發現寄到msn.com的信, 出現以下錯訊訊息:
stat=Deferred: 403 4.7.0 TLS handshake failed.
我們mail server有設定TLS/SSL, 但是憑證是私有的, 想來也許對方的mail server對TLS的憑證有一定的要求, 或是TLS的版本必須要新一點! 但這些我們都無法配合, 那是不是可以在寄給對方時, 不要使用TLS呢? 畢竟以前沒有TLS, mail server之間也都是明碼寄來寄去的, 也沒有被拒收過。
找了一下, 用sendmail的作法:
https://serverfault.com/questions/159712/how-to-tell-sendmail-to-explicitly-not-try-tls-for-a-domain
很好! 可以用access檔案來設定特定的主機不要用TLS, 那麼就來試試:
在access檔案加入:
Try_TLS:msn.com NO
結果: 還是寄不過去!
看一下maillog:
Aug 6 17:07:59 mail1 sm-mta[83963]: ruleset=tls_server, arg1=SOFTWARE, relay=msn-com.olc.protection.outlook.com, reject=403 4.7.0 TLS handshake failed.
Aug 6 17:07:59 mail1 sm-mta[83963]: 1762TdUK079715: to=<ops9@msn.com>, delay=06:38:20, xdelay=00:00:01, mailer=esmtp, pri=1291041, relay=msn-com.olc.protection.outlook.com. [104.47.58.33], dsn=4.0.0, stat=Deferred: 403 4.7.0 TLS handshake failed.
Aug 6 17:07:59 mail1 sm-mta[83963]: 1762BWLS079458: to=<ops9@msn.com>, delay=06:56:27, xdelay=00:00:00, mailer=esmtp, pri=1381049, relay=msn-com.olc.protection.outlook.com., dsn=4.0.0, stat=Deferred
Aug 6 17:07:59 mail1 sm-mta[83963]: STARTTLS=client, error: connect failed=0, reason=unknown, SSL_error=5, errno=0, retry=-1
Aug 6 17:07:59 mail1 sm-mta[83963]: ruleset=tls_server, arg1=SOFTWARE, relay=essenptl-com.mail.protection.outlook.com, reject=403 4.7.0 TLS handshake failed.
Aug 6 17:07:59 mail1 sm-mta[83963]: 1761iT50079064: to=<ad113@essenptl.com>,<admin@essenptl.com>,<jasonchen@essenptl.com>, delay=07:23:30, xdelay=00:00:00, mailer=esmtp, pri=1728336, relay=essenptl-com.mail....ction.outlook.com. [104.47.124.36], dsn=4.0.0, stat=Deferred: 403 4.7.0 TLS handshake failed.哦!, 原來msn.com的mail server不是xxx.msn.com, 而是xxx.outlook.com, 用dig來驗證一下:
# dig msn.com mx
...
;; QUESTION SECTION:
;msn.com. IN MX
;; ANSWER SECTION:
msn.com. 3600 IN MX 2 msn-com.olc.protection.outlook.com.果然也是如此!
那就將access加入:
Try_TLS:outlook.com NO
試試, 果然就可以寄過去了!
再觀察2天, 在maillog看到:
reject=550 5.7.1 <ops9@msn.com>... do not try TLS with msn-com.olc.protection.outlook.com [104.47.56.33] reject=550 5.7.1 <ops9@msn.com>... do not try TLS with msn-com.olc.protection.outlook.com [104.47.5.33] reject=550 5.7.1 <ops9@msn.com>... do not try TLS with msn-com.olc.protection.outlook.com [104.47.5.33] reject=550 5.7.1 <nelson.chiang@shl-medical.com>... do not try TLS with shlmedical-com0i.mail.protection.outlook.com [104.47.126.36] reject=403 4.7.0 TLS handshake failed. reject=403 4.7.0 TLS handshake failed. reject=550 5.7.1 <ops9@msn.com>... do not try TLS with msn-com.olc.protection.outlook.com [104.47.56.161] reject=550 5.7.1 <ops9@msn.com>... do not try TLS with msn-com.olc.protection.outlook.com [104.47.56.161] reject=550 5.7.1 <ad113@essenptl.com>,<admin@essenptl.com>,<jasonchen@essenptl.com>... do not try TLS with essenptl-com.mail.protection.outlook.com [104.47.124.36] reject=403 4.7.0 TLS handshake failed. reject=550 5.7.1 <Joleneschwarm@hotmail.com>... do not try TLS with hotmail-com.olc.protection.outlook.com [104.47.6.33] reject=403 4.7.0 TLS handshake failed. reject=550 5.7.1 <lucy.wu@dksh.com>... do not try TLS with dksh-com.mail.protection.outlook.com [104.47.126.36] reject=550 5.7.1 <sw.chin@shl-medical.com>... do not try TLS with shlmedical-com0i.mail.protection.outlook.com [104.47.124.36] reject=550 5.7.1 <yasminereimnitz60bl@hotmail.com>... do not try TLS with hotmail-com.olc.protection.outlook.com [104.47.73.33]
居然有很多其他網域也都是使用outlook.com的mail server來收信的: shl-medical.com, essenptl.com, ksh.com, 想來這都是代管的吧! 那因為這樣, 這些網域的郵件也都可以寄過去了。
留言