Bug report: sni_map missing mail.domain entry (and more) makes outlook.com incoming mails fail with SSL

Virtualmin
1
SYSTEM INFORMATION
OS type and version Ubuntu 20.04-LTS
Webmin version 2.202
Virtualmin version 7.30.3 PRO
Webserver version apache
Related packages PostFix 3.4.13

Ok, everything works, except receiving emails from outlook.com.

But when an email from outlook.com arrives, one domain works fine (it has a mail.domain alias server configured in Virtualmin), and one that hasn’t it doesn’t receive such emails. But once I add the mail.domain alias subdomain, the non-working domain works suddenly.

Before that, I had:

the one that works had this line found in mail.logs:

postfix/smtpd[2679529]: maps_file_find: tls_server_sni_maps: hash:/etc/postfix/sni_map(0,lock|fold_fix|src_rhs_is_file):

and the one that isn’t working, had instead this line is in logs:
maps_file_find: tls_server_sni_maps: mail.mydomain.com: not found

And in the /etc/postfix/sni_map file the mail.domain was missing, but adding it and re-doing a postmap was not enough, as in mail.log , although the previous error disappeared, following errors appeared, after adding mail.domain.com in sni_maps and rehashed:

warning: table hash:/etc/postfix/sni_map.db: key mail.mydomain.com: malformed BASE64 value: /home/mydomain/ssl.key,/home/
warning: tls_server_sni_maps: mail.mydomain.com map lookup problem

Then removed the mail.domain entry in sni_map, re-postmaping the sni_map file into sni_map.db, reloading postfix, verified that original error was back when trying to send email from outlook.com.

Then simply created an alias server mail.domain for the non-working domain (with same email addresses, no apache server as it was already configured, with DNS entries and mail) added the missing mail.domainand .mail.domain entries in sni_map, and probably configured more things, and then the incoming emails from outlook.com arrived fine.

EDIT: complement: the DNS MX entry for the domain, with highest priority, is mail.domain

2

How exactly did you add the mail.domain alias to your virtual server in Virtualmin?

And the mail subdomain is a reserved subdomain which is automatically created when a new virtual server is created in Virtualmin - so what have you done to disable the mail subdomain for this particular virtual server?

3

Simply by selecting the main server in Virtualmin, then Create Server, alias server, removing checkmarks for Apache and DNS which are already configured correctly (as mail.domain already is in the main domain, just not fully configured for SSL-SMTP to meet outlook’s expectation to send mail). Trying to leave all 3 checkmarks fails for Apache, but agrees to add a second main DNS entry for mail.domain).

Yes, it’s there. Didn’t do anything to disable it, left it enabled as is. Just uncheckmarked Apache and DNS server when creating the alias, only leaving “accept mail” option.

To reproduce: Create a free outlook mail and try sending mail. Put postfix into debug mode to see the errors logs completely (adding -v in master.cf and restarting).

4

Ok, that there is your problem. The mail subdomain is not equivalent to an alias. If you use the mail subdomain as an alias, it will conflict with other things and produce quirky results since mail is a reserved subdomain.

In Virtualmin, when you create a virtual server for domain.tld, Virtualmin automatically creates www.domain.tld, mail.domain.tld, admin.domain.tld etc. and these are linked to things like mx records and Webmin. The basic assumption that the Virtualmin ecosystem makes is that the reserved subdomains are set up the way that they are supposed to be for things like mailboxes to work.

Due to your usurping of reserved subdomains, I suspect that that there exist on your system two different mailboxes - one in which mail is being delivered and one which Outlook syncs with - and it is this which is causing the confusion.

5

So, wait. You want to receive mail on the domain mail.domain.tld (and not domain.tld). I mean, you really want mail to be addressed to beat@mail.domain.tld instead of to beat@domain.tld?