Repository: Mailu/Mailu

Issue:
Cannot send email after upgrade to 1.9 `non DNSSEC destination`
## Before you open your issue
- [x] Check if no issue or pull-request for this already exists.
- [x] Check [documentation](https://mailu.io/master/) and [FAQ](https://mailu.io/master/faq.html). (Tip, use the search function on the documentation page)
- [x] You understand `Mailu` is made by volunteers in their **free time** — be conscise, civil and accept that delays can occur.
- [x] The title of the issue should be short and simple. It should contain specific terms related to the actual issue. Be specific while writing the title.

## Environment & Versions
### Environment
 - [x] docker-compose
 - [ ] kubernetes
 - [ ] docker swarm

### Versions
1.9

## Description
Thanks for all the work! 1.9 seems like an amazing release overall ❤️ 

I upgraded to 1.9, generated the new docker-compose file with the tool.
Copied the relevant env variables over and started everything.
I can still receive mails, and send internal one (from and to my own domain)
I cannot send mails to external providers.

after restoring from backup everything works in 1.8

```
Final-Recipient: rfc822; ******
Original-Recipient: rfc822;******
Action: delayed
Status: 4.7.5
Diagnostic-Code: X-Postfix; non DNSSEC destination
Will-Retry-Until: Fri,  7 Jan 2022 18:38:34 +0000 (UTC)
Return-Path: <*****>
From: Cloud <*******>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nicco.io; s=dkim;
	t=1641148715;
	h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
	 to:to:cc:mime-version:mime-version:content-type:content-type:
	 in-reply-to:in-reply-to:references:references;
	bh=Q0j3Ph9l8nLeBMIzdq6aOtNcsZOyiD8WuiQSGgc2oeY=;
	b=nF+9OZeRSSEDZ995inbj/6nDYgbTDMhPGc63Gab3FN1A984PxY7rDoHIhkO5nvh2wzNZG6
	5jIAmfCyYfHriJawNrtcKeUA4wBO5YgYPWag6CbGmWQ8sGSIty2fjIO0W4dWfWy+OjsksX
	sJ2TK8uft8Ax9F9QmQKMuZHBP3Myh/I=
Content-Type: multipart/mixed;
	boundary="Apple-Mail=_DD0DBE9A-59E8-455E-B4DD-1317DF1D24F9"
Mime-Version: 1.0
Subject: =*****
Date: Sun, 2 Jan 2022 19:38:33 +0100
References: <****>
<****>
<****>
<****>
To: ***
In-Reply-To: ****
Message-Id: ****
X-Spam-Level: *
X-Spamd-Bar: +
Authentication-Results: *****;
	auth=pass smtp.mailfrom=*****
```


Discussion:
Is your local DNS resolver supporting DNSSEC? If not can you retry with unbound configured (it's an option in setup)?

Is it failing for all outgoing destinations or just one? If it's one, would you mind sharing the target FQDN?
How can I check? I can try unbound, don't have it in the config rn.
Yes, gmail delivery fails and some other providers too.
Thanks for the quick reply!
I am having the same issue:
```
2022-01-04T14:28:48.456222-06:00 cca953dfc6f8 postfix/smtp[428]: warning: TLS policy lookup for gmail.com/gmail-smtp-in.l.google.com: non DNSSEC destination
2022-01-04T14:28:48.456465-06:00 cca953dfc6f8 postfix/smtp[428]: warning: TLS policy lookup for gmail.com/gmail-smtp-in.l.google.com: non DNSSEC destination
2022-01-04T14:28:48.519750-06:00 cca953dfc6f8 postfix/smtp[428]: warning: TLS policy lookup for gmail.com/alt1.gmail-smtp-in.l.google.com: non DNSSEC destination
2022-01-04T14:28:48.519937-06:00 cca953dfc6f8 postfix/smtp[428]: warning: TLS policy lookup for gmail.com/alt1.gmail-smtp-in.l.google.com: non DNSSEC destination
2022-01-04T14:28:48.573257-06:00 cca953dfc6f8 postfix/smtp[428]: warning: TLS policy lookup for gmail.com/alt2.gmail-smtp-in.l.google.com: non DNSSEC destination
2022-01-04T14:28:48.587170-06:00 cca953dfc6f8 postfix/smtp[428]: B66B71C4140: to=<XXXX@gmail.com>, relay=none, delay=0.94, delays=0.24/0.07/0.63/0, dsn=4.7.5, status=deferred (non DNSSEC destination)
```
Setting `DEFER_ON_TLS_ERROR` in the env seems to have fixed this for now. Although it looks like it "magically" validated DNSSEC so maybe when I added that to the env file and redeployed it fixed something too?
I suspect that this is down to not having access to a DNSSEC validating resolver.

To fix it you need to either:
- enable DNSSEC validation on your current DNS resolver
- enable unbound (so that Mailu uses its own resolver)
- switch to a different DNS resolver (keep in mind that public DNS resolvers such as 8.8.8.8 are usually unsuitable to use with Mailu as they are rate limited on RBLs)
@cupcakearmy would you mind retrying 1.9 with unbound enabled please?
I added 

```
resolver:
    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-1.9}
    env_file: .env
    restart: unless-stopped
    networks:
      default:
        ipv4_address: 192.168.203.254
```

To my compose file and the depends_on in the smtp and antivirus but no luck. I checked the generated config but there seems nothing to be configured there? Am I doing something wront?
You should have the following for all containers except unbound in your docker-compose.yml:
```
    depends_on:
      - resolver
    dns:
      - <ip of unbound>
```

And yes, there's nothing to configure

Resolving patch:
diff --git a/core/admin/start.py b/core/admin/start.py
--- a/core/admin/start.py
+++ b/core/admin/start.py
@@ -18,6 +18,34 @@
     log.info("Creating initial admin accout %s@%s with mode %s",account,domain,mode)
     os.system("flask mailu admin %s %s '%s' --mode %s" % (account, domain, password, mode))
 
+def test_DNS():
+    import dns.resolver
+    import dns.exception
+    import dns.flags
+    import dns.rdtypes
+    import dns.rdatatype
+    import dns.rdataclass
+    import time
+    # DNS stub configured to do DNSSEC enabled queries
+    resolver = dns.resolver.Resolver()
+    resolver.use_edns(0, 0, 1232)
+    resolver.flags = dns.flags.AD | dns.flags.RD
+    nameservers = resolver.nameservers
+    for ns in nameservers:
+        resolver.nameservers=[ns]
+        while True:
+            try:
+                result = resolver.query('example.org', dns.rdatatype.A, dns.rdataclass.IN, lifetime=10)
+            except Exception as e:
+                log.critical("Your DNS resolver at %s is not working (%s). Please use another resolver or enable unbound via https://setup.mailu.io.", ns, e);
+            else:
+                if result.response.flags & dns.flags.AD:
+                    break
+                log.critical("Your DNS resolver at %s isn't doing DNSSEC validation; Please use another resolver or enable unbound via https://setup.mailu.io.", ns)
+            time.sleep(5)
+
+test_DNS()
+
 start_command="".join([
     "gunicorn --threads ", str(os.cpu_count()),
     " -b :80 ",


Test patch:
diff --git a/tests/compose/core/docker-compose.yml b/tests/compose/core/docker-compose.yml
--- a/tests/compose/core/docker-compose.yml
+++ b/tests/compose/core/docker-compose.yml
@@ -40,8 +40,11 @@ services:
     volumes:
       - "/mailu/data:/data"
       - "/mailu/dkim:/dkim"
+    dns:
+      - 192.168.203.254
     depends_on:
       - redis
+      - resolver
 
   imap:
     image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${PINNED_MAILU_VERSION:-local}
@@ -75,7 +78,13 @@ services:
 
   # Optional services
 
-
+  resolver:
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-local}
+    env_file: mailu.env
+    restart: always
+    networks:
+      default:
+        ipv4_address: 192.168.203.254
 
   # Webmail
 
diff --git a/tests/compose/fetchmail/docker-compose.yml b/tests/compose/fetchmail/docker-compose.yml
--- a/tests/compose/fetchmail/docker-compose.yml
+++ b/tests/compose/fetchmail/docker-compose.yml
@@ -42,6 +42,9 @@ services:
       - "/mailu/dkim:/dkim"
     depends_on:
       - redis
+      - resolver
+    dns:
+      - 192.168.203.254
 
   imap:
     image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${PINNED_MAILU_VERSION:-local}
@@ -81,6 +84,15 @@ services:
     restart: always
     env_file: mailu.env
 
+  resolver:
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-local}
+    env_file: mailu.env
+    restart: always
+    networks:
+      default:
+        ipv4_address: 192.168.203.254
+
+
   # Webmail
 
 
diff --git a/tests/compose/filters/docker-compose.yml b/tests/compose/filters/docker-compose.yml
--- a/tests/compose/filters/docker-compose.yml
+++ b/tests/compose/filters/docker-compose.yml
@@ -40,8 +40,11 @@ services:
     volumes:
       - "/mailu/data:/data"
       - "/mailu/dkim:/dkim"
+    dns:
+      - 192.168.203.254
     depends_on:
       - redis
+      - resolver
 
   imap:
     image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${PINNED_MAILU_VERSION:-local}
@@ -81,7 +84,13 @@ services:
     volumes:
       - "/mailu/filter:/data"
 
-
+  resolver:
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-local}
+    env_file: mailu.env
+    restart: always
+    networks:
+      default:
+        ipv4_address: 192.168.203.254
 
   # Webmail
 
diff --git a/tests/compose/rainloop/docker-compose.yml b/tests/compose/rainloop/docker-compose.yml
--- a/tests/compose/rainloop/docker-compose.yml
+++ b/tests/compose/rainloop/docker-compose.yml
@@ -42,6 +42,9 @@ services:
       - "/mailu/dkim:/dkim"
     depends_on:
       - redis
+      - resolver
+    dns:
+      - 192.168.203.254
 
   imap:
     image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${PINNED_MAILU_VERSION:-local}
@@ -75,7 +78,13 @@ services:
 
   # Optional services
 
-
+  resolver:
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-local}
+    env_file: mailu.env
+    restart: always
+    networks:
+      default:
+        ipv4_address: 192.168.203.254
 
   # Webmail
   webmail:
diff --git a/tests/compose/roundcube/docker-compose.yml b/tests/compose/roundcube/docker-compose.yml
--- a/tests/compose/roundcube/docker-compose.yml
+++ b/tests/compose/roundcube/docker-compose.yml
@@ -42,6 +42,9 @@ services:
       - "/mailu/dkim:/dkim"
     depends_on:
       - redis
+      - resolver
+    dns:
+      - 192.168.203.254
 
   imap:
     image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${PINNED_MAILU_VERSION:-local}
@@ -75,7 +78,13 @@ services:
 
   # Optional services
 
-
+  resolver:
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-local}
+    env_file: mailu.env
+    restart: always
+    networks:
+      default:
+        ipv4_address: 192.168.203.254
 
   # Webmail
   webmail:
diff --git a/tests/compose/webdav/docker-compose.yml b/tests/compose/webdav/docker-compose.yml
--- a/tests/compose/webdav/docker-compose.yml
+++ b/tests/compose/webdav/docker-compose.yml
@@ -40,8 +40,11 @@ services:
     volumes:
       - "/mailu/data:/data"
       - "/mailu/dkim:/dkim"
+    dns:
+      - 192.168.203.254
     depends_on:
       - redis
+      - resolver
 
   imap:
     image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${PINNED_MAILU_VERSION:-local}
@@ -82,6 +85,13 @@ services:
     volumes:
       - "/mailu/dav:/data"
 
+  resolver:
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-local}
+    env_file: mailu.env
+    restart: always
+    networks:
+      default:
+        ipv4_address: 192.168.203.254
 
   # Webmail