Mailinabox: DigitalOcean blocks mail over IPv6

[vernsix]

I'm not entirely sure this would be a MIAB issue, but thought I would mention it just in case.

I have three servers. The MIAB server uses IPV6. Server A uses IPV6. Server B uses only IPV4.

Using this command: telnet my_example_miab.com 587

I can connect from Server B to MIAB, no problem.

I cannot connect from Server A to MIAB ever. However, if I use the IP number instead of a fqdn then it connects just fine. ie: telnet 123.123.12.12 587

I have checked firewall issues, etc. and I am lost as to why this would be occurring. Any suggestions?

Thanks!
V

[vernsix]

Well... thankfully it turns out to be a DigitalOcean problem. Here is their reply...

Thank you for patience in this matter and I apologize for any confusion/inconvenience this issue may have caused you.

The main reason behind why we have chosen to block these ports by default is due to how blacklists handle IPv6 addresses, in the event of a spam report. Rather than listing only one address, blacklists will list the full /64 subnet of address that the spam report came from which impacts a whole range of customers and droplets unaffiliated with incriminating droplet/user. When a whole range is affected, even newly created droplets can be affected if they are assigned an IP for a blacklisted subnet.

We do not allow SMTP over IPv6 because when IPV6 addresses are blacklisted providers will blacklist the entire /64. Due to this it is not very useful to allow DigitalOcean users to run mail servers on IPV6.

You can also see our public response on the UserVoice here: https://digitalocean.uservoice.com/forums/136585-digitalocean/suggestions/7190053-allow-smtp-over-ipv6

[anoma]

I would reopen or create a new ticket with this crucial piece of information because at a guess i would DigitalOcean is the go to provider of VPS choice for most MIAB installs and this may change that.

[vernsix]

To be clear, this issue only effects OUTBOUND smtp originating on a DigitalOcean IPv6 Droplet. If you have MIAB running on a Droplet you can still connect to that MIAB from a non-DigitalOcean machine presumably. Hope this helps others. I spent the longest time investigating firewalls and such.

[JoshData]

It sounds to me like we should not let users use IPv6 on DO's network?

[CarletonStuberg]

Just talked to Digital Ocean. I got the same response as vernsix. They are blaming it on the spam list providers saying

"At this time, we cannot unblock SMTP over IPv6 until email abuse lists update their behaviors."

This has "solved" the problem for me.

add the following or uncomment the below line in /etc/gai.conf which defaults IPv4 lookups over IPv6:

precedence ::ffff:0:0/96  100

Not sure if you want to automate this @JoshData

[haraldkoch]

Please do not bake this knowledge into MIAB, or when DO changes their mind you'll be fielding support issues for a decade.

[CarletonStuberg]

Wow you're on top of it @haraldkoch. I doubt he'll actually put that into MIAB and it's probably not a good idea to depending on the percentage of boxes that use DO but it would be nice for him to know because MIAB recommends DO for hosting (or the video I watched awhile ago by Josh did).

[jacebenson]

Can this issue be closed?

[vernsix]

I believe so.