[solved] best practice with unbound in pfSense and email-server behind it?

Bob.Dig

@Gertjan said in best practice for running email-server behind pfSense?:

Sorry for the rant.

Yeah, you went totally off topic. My only question is about unbound in pfSense. That is why I posted this in DNS. But I will alter the topic to be more precise.

johnpoz

@Bob-Dig Not sure I understand the question. If you block domainx.tld from a client going there via dns filtering. Why would you want your email server to send email there?

Why would you think there should be something different setup?

Bob.Dig

@johnpoz So my first question is, is the pfSense default config for unbound good (Services - DNS Resolver - Advanced Settings) or could it be optimized for this usecase? I know it is kinda broad question...

I do DNS Query Forwarding though, lets say to cloudflare, will this change stuff?

Other question, if I have a dns redirect by portforwarding active, could it interfere with the ability of the email-server itself for doing its own DNSBL stuff? I guess, so I don't do it.

I have read somewhere that it is advised to run your own DNS-server for an email-server but that is probably not the case for my very light used email-server.

Again, everything is working fine but I want to optimize, if I can. And I am unclear about DNSBL in general. I think I get it how it works with pfBlocker but I am not sure how this is implemented in mail-servers exactly and that I don't mess with it.

@Gertjan said in best practice with unbound in pfSense for an email-server behind it?:

Forget about GUI administration : and repeat after me "that doesn't exists". It will be 'ssh' / Putty / an SFTP all the way.

I am not that bright so I have to stick to GUIs, that is why I use pfSense.

johnpoz

@Bob-Dig said in best practice with unbound in pfSense for an email-server behind it?:

somewhere that it is advised to run your own DNS-server

Not sure where you read that? That sure isn't true..

Be it you resolve, be it you forward, be it you filter dns has really little to do with having a normal client, or a box sending receiving email.

If your going to forward.. There is little reason to change anything in the resolver settings, other than turning off dnssec.. When you forward there is just no reason to have that checked. Where you forward to is going to be doing dnssec or they are not. Having that enabled in unbound settings is just going to cause possible issues.

A email server isn't really different than any other client.. But vs looking up say www.domainx.tld A record, the email server would most likely be only doing MX look ups for domainx.tld when someone wants to send email there.

Now you might have yours setup to check the PTR of some IP trying to send email to the server.. But again - that is just another query, and there is nothing special that you need to do.

darcey

@Gertjan said in best practice with unbound in pfSense for an email-server behind it?:

A mail server like postfix can use "DNSBL" to filter incoming mail (never outgoing, that would be .... stupid)
I've this in my main.cf :

@Bob-Dig If you are using unbound and have rebind protection enabled, I believe you may need to exclude those dnsbl hosts you're using. For example:

private-domain: "zen.spamhaus.org"
private-domain: "b.barracudacentral.org"

I'm also guessing that it is best to allow the mail server to perform its own dnsbl lookups, rather than use any cached information provided by pfblocker. Since AIUI DNSBL such as zen returns subtley different responses according to the their BL.

darcey

I seem to be successfully hosting mail on my domestic broadband IP. However I have a static IP and I send via the ISP's relay to avoind PBL issues.
It's more out of interest than anything and I would not do it this way if my business relied upon it. I'd pay for proper mail hosting.

SteveITS

@darcey said in best practice with unbound in pfSense for an email-server behind it?:

private-domain: "zen.spamhaus.org"

Note (for the forum and @Bob-Dig) Spamhaus returns an error when forwarding DNS to public DNS, resulting in all mail being blocked:
https://www.spamhaus.com/resource-center/successfully-accessing-spamhauss-free-block-lists-using-a-public-dns/
https://pro-it.rocks/all-mails-rejected-by-spamhaus/

Another option when hosting your own email is to use a third party spam filter, and only allow those IPs to connect to your mail server. Often those services will provide outbound relaying/smart host as well.

Bob.Dig

@SteveITS Now it is getting interesting because I don't understand this: "Spamhaus returns an error when forwarding DNS to public DNS"
In what case does this happen?

And just for completeness, I am using an email-server with spamassassin and stuff (with GUI), have my own domain and "businesses-IP", etc. Here in this thread it is only about pfSense and unbound before an email-server.

darcey

@Bob-Dig I think this means you need to point your mailserver at (your own) recursive dns resolver e.g. unbound. If that's unbound on pfsense, you may want to reconsider whether to run pfblocker dnsbl. I decided not use pfblocker dnsbl, though I do use the IP blocking and instead run pihole for certain LAN hosts.
Having the business IP should at least mean you're not on the PBL and therefore deliver mail directly.

Bob.Dig

@darcey What I am missing on is the connection between e.g. Spamhaus and unbound or my upstream DNS.
I guess and I could be wrong, my email server is asking Spamhaus directly, my unbound is not involved, right? I really don't know how this part works though.

Bob.Dig

@darcey said in best practice with unbound in pfSense for an email-server behind it?:

Having the business IP should at least mean you're not on the PBL and therefore deliver mail directly.

Again, not the point of this thread.

darcey

@Bob-Dig Say you're using one or more of the dnsbl services with e.g. postfix's postscreen. The dnsbl checks are made by postfix, via regular dns queries, to whatever the mailserver host's configued dns is.

The dns queries are of the form 12.34.56.78.zen.spamhaus.org
The replies (from spamhaus's NS ideally via recursive lookup) are of the form 127.0.0.X. Which is then interpretted by your mailserver. Usually you query several dnsblservers, optionally weighted according to which you prefer.

SteveITS

@Bob-Dig said in best practice with unbound in pfSense for an email-server behind it?:

my email server is asking Spamhaus directly, my unbound is not involved

Incorrect, it's a DNS based lookup:

# dig +short 2.0.0.127.zen.spamhaus.org
127.0.0.2
127.0.0.10
127.0.0.4
# dig +short 2.0.0.127.zen.spamhaus.org txt
"https://www.spamhaus.org/query/ip/127.0.0.2"
"https://www.spamhaus.org/sbl/query/SBL2"

They have blocked Quad9/CloudFlare from connecting to their services by telling any queries that all IPs are bad. I thought Google also, actually but they don't seem to be blocked today?

#dig +short 2.0.0.127.zen.spamhaus.org  @9.9.9.9
127.255.255.254
#dig +short 2.0.0.127.zen.spamhaus.org txt  @9.9.9.9
"Error: open resolver; https://www.spamhaus.org/returnc/pub/2620:171:fe:f0::237"
#dig +short 2.0.0.127.zen.spamhaus.org txt  @1.1.1.1
"Error: open resolver; https://www.spamhaus.org/returnc/pub/172.70.177.38"

So in Unbound, uncheck "DNS Query Forwarding." Unless maybe if you're using Google DNS.

Bob.Dig

Ok, this is the hard part, I don't get. DNS is hard it seems.

SteveITS

@Bob-Dig said in best practice with unbound in pfSense for an email-server behind it?:

Ok, this is the hard part, I don't get. DNS is hard it seems.

Nah, ask a question, get an answer, simple.

Bob.Dig

I think I kinda getting it slowly. Will try tomorrow if I get the whole picture. And so my DNS configured in pfSense can make a big difference if this stuff will actually work or not. Thanks guys!

darcey

@Bob-Dig

Don't use upstream public DNS.
If using unbound, either disable rebind protection or use the unbound config mentioned above for your specific dnsbl's.
Be selective with the dnsbl's and,with postfix, you can also weight them:

postscreen_dnsbl_sites = zen.spamhaus.org*2,dnsbl.sorbs.net*1,bl.spamcop.net*1,b.barracudacentral.org*1
postscreen_dnsbl_threshold = 2

This has been working reasonably well for me other than some recent paypal 'communications' getting blocked by sorbs. None of the transaction related mail was affected.

Bob.Dig

@SteveITS @darcey Thank you both for helping me understand that topic and also showing me ways to validate my solution myself.
For now on one Site I am using a DNS Provider that is not blocked by any of those services I use and gave the mx that DNS server directly, not going through unbound anymore. One another Site I turned off DNS Query Forwarding in pfSense and turned on Python Group Policy in pfBlocker for the mx, just to make sure. In the end I can make it work now, thanks to you guys.

A note to @biggsy , thanks you for your kindly offer, I am good now, topic is closed.

Bob.Dig

Just to recap, I couldn't use Unbound in resolver-mode for those mx because sites like zen.spamhaus.org wouldn't work with it, I don't know the reason.
Also I couldn't disable rebind protection because split-DNS wouldn't work anymore when I was using my domain with DNSSEC.
So I have to use a third party DNS-server for those mx which is not blocked by spamhaus.org and alike. And because I still have a need for some split-DNS like behavior for my mx, I made a port forward from one external to one internal address in pfSense to cope with that.
And it is running smoothly now. But it is more complicated than I had imagined.