Proxmox Mail Gateway to another Proxmox Mail Gateway causes DKIM Header Repetition

pietroaretino

Active Member
Nov 15, 2019
32
4
28
39
I have an Exchange server behind a Proxmox Mail Gateway 7.0-6

On the other end I have a Postfix server behind another Proxmox Mail Gateway 6.4-4

EXCHANGE <---> PROXMOX MG 7.0-6 <-----> WAN <-----> PROXMOX MG 6.4-4 <----> POSTFIX

If I send a test mail from the postfix side to my exchange server, the email gets through with no issue.

However when I send a mail from my exchange server to my postfix server, the email repeats hundreds of times within the tracking window within my Proxmox MG 7.0-6

I eventually receive a bounce-back message from the PROXMOX MG 6.4-4 telling me the headersize is too large.

When I check the header size I see the DKIM signature repeating an insane amount of times.

This only happens between these two servers. If I were to email a Gmail address or another external address this does not happen.

It almost seems like some type of issue between the two proxmox mail gateways. However as I mentioned before, when mail is sent from the PROXMOX MG 6.4-4 server to the PROXMOX MG 7.0-6 server, it arrives without issue. This error only occurs when it is vice versa.

Has anyone encountered anything like this before?

Code:
Diagnostic Information for Administrators:
Generating Server: mailgate.exchange.serverù

user2@postfix.server
192.168.1.2
Remote Server returned '<192.168.1.2 #5.3.4 smtp; 552 5.3.4 Header size exceeds fixed maximum size>'
Intestazioni originali del messaggio:
Return-Path: <user1@exchange.server>
Received: from mailgate.exchange.server (localhost.localdomain [127.0.0.1])
    by mailgate.exchange.server (Proxmox) with ESMTP id 36718E11F3
    for <user2@postfix.server>; Thu, 13 Oct 2022 14:25:26 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=exchange.server;
     h=cc:content-type:content-type:date:from:from:message-id
    :mime-version:reply-to:subject:subject:to:to; s=acx; bh=cx4Q/0/h
    VAESBHVYlVAitnRa7pMDYnEGIMJFVxkujd8=; b=hEvNTgiPtf0bjXRmjCto6wZ4
    Vm8diqChBS43W6ozCj6JGoNTdIRVcxLi5f6nlDq+7GlM869Qmmr8E+FwbkhrHT4R
    SDq4KJhJWxuL+V2OIa7B6W1HLzE9e2UNR3SSPN+xeiQaAjzHMS/6grb8/w/1l6PD
    ufaSIiUpxGBmfhpBbNT+R2cycCuQ8tmBmdjy7D9OfKjBo4G/YpPrf6AqRO2M2E99
    jRGB/FOabjf99P30RE1jtGPCd0ofv21cyAMT4kvXPMmu4WTxk+jd/Dp4JT2b3LhE
    y+SiH+HgpCsjR+I5A6/hQpDzk7qYLAgdddZ5D2Wp63KTEU/Bg7dIsUZMc/29Dg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=exchange.server;
     h=cc:content-type:content-type:date:from:from:message-id
    :mime-version:reply-to:subject:subject:to:to; s=acx; bh=cx4Q/0/h
    VAESBHVYlVAitnRa7pMDYnEGIMJFVxkujd8=; b=hEvNTgiPtf0bjXRmjCto6wZ4
    Vm8diqChBS43W6ozCj6JGoNTdIRVcxLi5f6nlDq+7GlM869Qmmr8E+FwbkhrHT4R
    SDq4KJhJWxuL+V2OIa7B6W1HLzE9e2UNR3SSPN+xeiQaAjzHMS/6grb8/w/1l6PD
    ufaSIiUpxGBmfhpBbNT+R2cycCuQ8tmBmdjy7D9OfKjBo4G/YpPrf6AqRO2M2E99
    jRGB/FOabjf99P30RE1jtGPCd0ofv21cyAMT4kvXPMmu4WTxk+jd/Dp4JT2b3LhE
    y+SiH+HgpCsjR+I5A6/hQpDzk7qYLAgdddZ5D2Wp63KTEU/Bg7dIsUZMc/29Dg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=exchange.server;
     h=cc:content-type:content-type:date:from:from:message-id
    :mime-version:reply-to:subject:subject:to:to; s=acx; bh=cx4Q/0/h
    VAESBHVYlVAitnRa7pMDYnEGIMJFVxkujd8=; b=hEvNTgiPtf0bjXRmjCto6wZ4
    Vm8diqChBS43W6ozCj6JGoNTdIRVcxLi5f6nlDq+7GlM869Qmmr8E+FwbkhrHT4R
    SDq4KJhJWxuL+V2OIa7B6W1HLzE9e2UNR3SSPN+xeiQaAjzHMS/6grb8/w/1l6PD
    ufaSIiUpxGBmfhpBbNT+R2cycCuQ8tmBmdjy7D9OfKjBo4G/YpPrf6AqRO2M2E99
    jRGB/FOabjf99P30RE1jtGPCd0ofv21cyAMT4kvXPMmu4WTxk+jd/Dp4JT2b3LhE
    y+SiH+HgpCsjR+I5A6/hQpDzk7qYLAgdddZ5D2Wp63KTEU/Bg7dIsUZMc/29Dg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=exchange.server;
     h=cc:content-type:content-type:date:from:from:message-id
    :mime-version:reply-to:subject:subject:to:to; s=acx; bh=cx4Q/0/h
    VAESBHVYlVAitnRa7pMDYnEGIMJFVxkujd8=; b=hEvNTgiPtf0bjXRmjCto6wZ4
    Vm8diqChBS43W6ozCj6JGoNTdIRVcxLi5f6nlDq+7GlM869Qmmr8E+FwbkhrHT4R
    SDq4KJhJWxuL+V2OIa7B6W1HLzE9e2UNR3SSPN+xeiQaAjzHMS/6grb8/w/1l6PD
    ufaSIiUpxGBmfhpBbNT+R2cycCuQ8tmBmdjy7D9OfKjBo4G/YpPrf6AqRO2M2E99
    jRGB/FOabjf99P30RE1jtGPCd0ofv21cyAMT4kvXPMmu4WTxk+jd/Dp4JT2b3LhE
    y+SiH+HgpCsjR+I5A6/hQpDzk7qYLAgdddZ5D2Wp63KTEU/Bg7dIsUZMc/29Dg==

THE DKIM HEADER LITERALLY REPEATS ANOTHER HUNDRED PLUS TIMES!!!!!

From: User 1 <user1@exchange.server>
To: User 2 <user2@postfix.server>
Subject: Testing
Thread-Topic: Testing
Thread-Index: Adje/u27vW3crZkQQ2uS5r2t3CnN1Q==
Date: Thu, 13 Oct 2022 12:24:57 +0000
Message-ID: <581fbabaa2fe47b29cc735aaaede5e4a@srvex2013.exchange.server>
Accept-Language: en-US, it-IT
Content-Language: it-IT
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [192.168.2.4]
Content-Type: text/plain
MIME-Version: 1.0
 

Attachments

  • Cattura.PNG
    Cattura.PNG
    148.9 KB · Views: 9
Last edited:
looks a bit like a mail-loop?
where is 'exchange.server' and 'postfix.server' listed in both PMG instances?
(especially check relay-domains)

also please share the complete log of such a mail

I hope this helps!

EDIT: do you have 'Hide internal hosts' enabled on any of the 2 systems?
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!