Proxmox Mail Gateway to another Proxmox Mail Gateway causes DKIM Header Repetition

pietroaretino

Active Member
Nov 15, 2019
33
5
28
40
I have an Exchange server behind a Proxmox Mail Gateway 7.0-6

On the other end I have a Postfix server behind another Proxmox Mail Gateway 6.4-4

EXCHANGE <---> PROXMOX MG 7.0-6 <-----> WAN <-----> PROXMOX MG 6.4-4 <----> POSTFIX

If I send a test mail from the postfix side to my exchange server, the email gets through with no issue.

However when I send a mail from my exchange server to my postfix server, the email repeats hundreds of times within the tracking window within my Proxmox MG 7.0-6

I eventually receive a bounce-back message from the PROXMOX MG 6.4-4 telling me the headersize is too large.

When I check the header size I see the DKIM signature repeating an insane amount of times.

This only happens between these two servers. If I were to email a Gmail address or another external address this does not happen.

It almost seems like some type of issue between the two proxmox mail gateways. However as I mentioned before, when mail is sent from the PROXMOX MG 6.4-4 server to the PROXMOX MG 7.0-6 server, it arrives without issue. This error only occurs when it is vice versa.

Has anyone encountered anything like this before?

Code:
Diagnostic Information for Administrators:
Generating Server: mailgate.exchange.serverù

user2@postfix.server
192.168.1.2
Remote Server returned '<192.168.1.2 #5.3.4 smtp; 552 5.3.4 Header size exceeds fixed maximum size>'
Intestazioni originali del messaggio:
Return-Path: <user1@exchange.server>
Received: from mailgate.exchange.server (localhost.localdomain [127.0.0.1])
    by mailgate.exchange.server (Proxmox) with ESMTP id 36718E11F3
    for <user2@postfix.server>; Thu, 13 Oct 2022 14:25:26 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=exchange.server;
     h=cc:content-type:content-type:date:from:from:message-id
    :mime-version:reply-to:subject:subject:to:to; s=acx; bh=cx4Q/0/h
    VAESBHVYlVAitnRa7pMDYnEGIMJFVxkujd8=; b=hEvNTgiPtf0bjXRmjCto6wZ4
    Vm8diqChBS43W6ozCj6JGoNTdIRVcxLi5f6nlDq+7GlM869Qmmr8E+FwbkhrHT4R
    SDq4KJhJWxuL+V2OIa7B6W1HLzE9e2UNR3SSPN+xeiQaAjzHMS/6grb8/w/1l6PD
    ufaSIiUpxGBmfhpBbNT+R2cycCuQ8tmBmdjy7D9OfKjBo4G/YpPrf6AqRO2M2E99
    jRGB/FOabjf99P30RE1jtGPCd0ofv21cyAMT4kvXPMmu4WTxk+jd/Dp4JT2b3LhE
    y+SiH+HgpCsjR+I5A6/hQpDzk7qYLAgdddZ5D2Wp63KTEU/Bg7dIsUZMc/29Dg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=exchange.server;
     h=cc:content-type:content-type:date:from:from:message-id
    :mime-version:reply-to:subject:subject:to:to; s=acx; bh=cx4Q/0/h
    VAESBHVYlVAitnRa7pMDYnEGIMJFVxkujd8=; b=hEvNTgiPtf0bjXRmjCto6wZ4
    Vm8diqChBS43W6ozCj6JGoNTdIRVcxLi5f6nlDq+7GlM869Qmmr8E+FwbkhrHT4R
    SDq4KJhJWxuL+V2OIa7B6W1HLzE9e2UNR3SSPN+xeiQaAjzHMS/6grb8/w/1l6PD
    ufaSIiUpxGBmfhpBbNT+R2cycCuQ8tmBmdjy7D9OfKjBo4G/YpPrf6AqRO2M2E99
    jRGB/FOabjf99P30RE1jtGPCd0ofv21cyAMT4kvXPMmu4WTxk+jd/Dp4JT2b3LhE
    y+SiH+HgpCsjR+I5A6/hQpDzk7qYLAgdddZ5D2Wp63KTEU/Bg7dIsUZMc/29Dg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=exchange.server;
     h=cc:content-type:content-type:date:from:from:message-id
    :mime-version:reply-to:subject:subject:to:to; s=acx; bh=cx4Q/0/h
    VAESBHVYlVAitnRa7pMDYnEGIMJFVxkujd8=; b=hEvNTgiPtf0bjXRmjCto6wZ4
    Vm8diqChBS43W6ozCj6JGoNTdIRVcxLi5f6nlDq+7GlM869Qmmr8E+FwbkhrHT4R
    SDq4KJhJWxuL+V2OIa7B6W1HLzE9e2UNR3SSPN+xeiQaAjzHMS/6grb8/w/1l6PD
    ufaSIiUpxGBmfhpBbNT+R2cycCuQ8tmBmdjy7D9OfKjBo4G/YpPrf6AqRO2M2E99
    jRGB/FOabjf99P30RE1jtGPCd0ofv21cyAMT4kvXPMmu4WTxk+jd/Dp4JT2b3LhE
    y+SiH+HgpCsjR+I5A6/hQpDzk7qYLAgdddZ5D2Wp63KTEU/Bg7dIsUZMc/29Dg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=exchange.server;
     h=cc:content-type:content-type:date:from:from:message-id
    :mime-version:reply-to:subject:subject:to:to; s=acx; bh=cx4Q/0/h
    VAESBHVYlVAitnRa7pMDYnEGIMJFVxkujd8=; b=hEvNTgiPtf0bjXRmjCto6wZ4
    Vm8diqChBS43W6ozCj6JGoNTdIRVcxLi5f6nlDq+7GlM869Qmmr8E+FwbkhrHT4R
    SDq4KJhJWxuL+V2OIa7B6W1HLzE9e2UNR3SSPN+xeiQaAjzHMS/6grb8/w/1l6PD
    ufaSIiUpxGBmfhpBbNT+R2cycCuQ8tmBmdjy7D9OfKjBo4G/YpPrf6AqRO2M2E99
    jRGB/FOabjf99P30RE1jtGPCd0ofv21cyAMT4kvXPMmu4WTxk+jd/Dp4JT2b3LhE
    y+SiH+HgpCsjR+I5A6/hQpDzk7qYLAgdddZ5D2Wp63KTEU/Bg7dIsUZMc/29Dg==

THE DKIM HEADER LITERALLY REPEATS ANOTHER HUNDRED PLUS TIMES!!!!!

From: User 1 <user1@exchange.server>
To: User 2 <user2@postfix.server>
Subject: Testing
Thread-Topic: Testing
Thread-Index: Adje/u27vW3crZkQQ2uS5r2t3CnN1Q==
Date: Thu, 13 Oct 2022 12:24:57 +0000
Message-ID: <581fbabaa2fe47b29cc735aaaede5e4a@srvex2013.exchange.server>
Accept-Language: en-US, it-IT
Content-Language: it-IT
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [192.168.2.4]
Content-Type: text/plain
MIME-Version: 1.0
 

Attachments

  • Cattura.PNG
    Cattura.PNG
    148.9 KB · Views: 11
Last edited:
looks a bit like a mail-loop?
where is 'exchange.server' and 'postfix.server' listed in both PMG instances?
(especially check relay-domains)

also please share the complete log of such a mail

I hope this helps!

EDIT: do you have 'Hide internal hosts' enabled on any of the 2 systems?