So far I thought that our mail server is correctly configured, but now something happened that I do not understand:

I sent out several mails by running a script on our mail server castor.foo.bar that pipes the messages to sendmail, which delivers them. The script is run by user business.

Some of the mails came back from reputed ISPs with an error "Relaying denied. Proper authentication required"

Here is one of them, originally sent to addressee@somedomain.com:

-----------------

The original message was received at Wed, 18 Feb 2004 15:23:07 +0100 (CET)
from business@localhost
with id i1IEN7C26044

----- The following addresses had permanent fatal errors -----
addressee@somedomain.hu
(reason: 550 5.7.1 <addressee@somedomain.hu>... Relaying denied. Proper authentication required.)

----- Transcript of session follows -----
... while talking to mx.axelero.hu.:

>>>>>> RCPT To:<addressee@somedomain.hu>

<<< 550 5.7.1 <addressee@somedomain.hu>... Relaying denied. Proper authentication required.
550 5.1.1 addressee@somedomain.hu... User unknown



Reporting-MTA: dns; castor.foo.bar
Arrival-Date: Wed, 18 Feb 2004 15:23:07 +0100 (CET)

Final-Recipient: RFC822; addressee@somedomain.hu
Action: failed
Status: 5.7.1
Remote-MTA: DNS; mx.axelero.hu
Diagnostic-Code: SMTP; 550 5.7.1 <addressee@somedomain.hu>... Relaying denied. Proper authentication required.
Last-Attempt-Date: Wed, 18 Feb 2004 15:23:11 +0100 (CET)

Return-Path: <business>
Received: (from business@localhost)
by castor.foo.bar (8.11.7/8.11.7) id i1IEN7C26044;
Wed, 18 Feb 2004 15:23:07 +0100 (CET)
Date: Wed, 18 Feb 2004 15:23:07 +0100 (CET)
Message-Id: <200402181423.i1IEN7C26044@castor.foo.bar>
--------------------

What I do not understand:

- how can a message sent to a mailbox in a certain domain come back with a "relaying denied" error from a different domain?

- why was the hostname of our mail server (castor) in the header of the message sent out? It should be, in my opinion, masqueraded to mail.foo.bar, since I use the masquerade_all and masquerade_envelope features in sendmail.conf! The real hostname of our mail server is undesirable as it is not an existing host on the internet, only an internal hostname.

Could you help me to find out if these problems are due to a misconfiguration of our mail server?

The mail was handled by mx.axelero.hu because it is apparently one of the MX hosts listed for somedomain.hu. Apparently somedomain.hu added mail.axelero.hu to their MX records in DNS, but didn't make sure that they would actually accept mail for somedomain.hu--oops! That one is their fault.

As to why your hostname is appearing on the header, that is the RFC standard behavior. Your masquerade will only change the e-mail address, not hostnames. RFC822 Received: headers are supposed to list every server that touched a message, and that's what it's doing. If you want that to behave differently, then you should change your internal DNS or hosts files to use different names (or strip all Received: headers before sending the message out).

you could debug it:

1) Send a mail to yourself using your business script. If it comes FROM business@localhost, then your masquerade isn't working. Most sendmail configs are set to reject mails if it cannot resolve the snder's domains.

2) if your mail went out as business@yourdomain.com and yourdomain.com is resolvable then nothing's wrong with your sendmail or your script. Try sending again.

3) Some mail servers can be set incorrectly by not setting confAuthOptions properly. But I doubt reputed ISPs would make this mistake. Some can reject it if it cannot establish a TLS connection etc etc .

4) If (1) is true then check your masquerdes. Post your .mc file. we may be able to help

The FROM headers are OK in the mails; I have problem with the RECEIVED headers, which contain the internal hostname of our mail server, that is not a resolvable host on the internet.

I wonder if this has any drawback?

Chort! You mentioned correcting the DNS and host files; do you mean that I should change the internal hostname of our mail server from castor to mail?
If so, that may be considered, however I think that the present setup is more flexible: if something goes wrong with castor, I just correct the DNS record of mail, assigning that cname to an other host, and the users can send and receive mails, read their POP3 boxes using the new host as if nothing has happened.

So, I like the idea of stripping off the RECEIVED headers much more. How to do it?

I didn't say you need to "correct" your internal DNS, I just said you could change it to match whatever you want it to appear as externally. That way when the Received: header is generated, it will have the external domain.

Actually, come to think of it... You could probably change your /etc/hosts entry for 127.0.0.1 like this:

OLD
127.0.0.1 localhost

NEW
127.0.0.1 localhost.yourdomain.tld localhost

then the Received: header would show:
Received: (from business@localhost.yourdomain.tld)