Basic Mail and DNS help

Question

I'm sorry to ask something that I'm sure has been dealt with many times. I've searched all around and found many threads that seem very close, but I guess there's some little difference that always ends up confusing me. I also get confused by what seems to me to be ambiguous terminology. Anyway, I'm pulling my hair out, so I've finally decided to ask for help.
I'm sorry that this post is so long -- I just don't know what bit of info might be important. I'm trying to give a detailed description of my setup so experienced people can give me better advice.
Here's my situation.
EXTERNAL DNS
(1) I've purchased a domain name through my ISP. Let's call it mydomain.tld
(2) This comes with a very rudimentary control panel that allows me to define 10 A records, 10 CNAME records and 10 MX records.
(3) I have defined an A record pointing to my static WAN IP.
(4) I have deifined an MX record pointing to the same static WAN IP.
(5) This seems to be OK, because if I "dig mydomain.com" or "dig MX mydomain.com" I get my static WAN IP.
MY LITTLE NETWORK
(6) The Internet comes into a 4-port router/modem. (192.168.0.x) This is my "Outer LAN"
(7) One port goes to a Mini with SLS -- Say it's on 192.168.0.99
(8) Another port goes to another router (192.168.1.x) This is my "Inner LAN"
(9) I have forwarded port 80 through the outer router to the SLS. That seems to work fine.
(10) I have also forwarded port 25 through the outer router to the SLS. That does not work yet.
The SLS
(11) When I did the initial install, I gave the SLS the name mydomain.private (I some places, Server Admin gives the name mydomain.local ... I don't know why.)
(12) I set up the INTERNAL DNS on the SLS to handle all initial DNS queries from my LANs, with my ISP's DNS as a forwarder.
(13) I set up the DHCP on my routers to assign the internal DNS server on the SLS as the primary DNS, and my ISP's DNS server as the secondary -- so clients on my LANS are looking at the right DNS servers.
(14) DNS seems to work fine on both my LANs.
BEFORE GOING ANY FURTHER:
If anyone sees any problems with what I have done so far -- Please say so.
... and now THE MAIL
(15) I created a few network user accounts on SLS.
(16) Using squirrelmail, they were able to send and receive messages to each other -- using a browser on the SLS machine or a browser on any other computer on the LANs. But this is all resolved through the internal DNS, using mydomain.private
(17) Mail clients (Mail.app) on the LAN can also retrieve these messages. But I can't send mail using a regular mail client ... and squirrelmail only works internally with mydomain.private
Now, I want to get my mail server working normally for sending and receiving mail both within my LAN and over the Internet. And here is where I get confused. There's the EXTERNAL DNS server that clients on the Internet will use to find my server -- and there's the INTERNAL DNS server that clients on my LAN (?and possibly some services on the server itself?) will use. Then there are terms like HOSTNAME and DOMAIN NAME ... and I'm not really very clear as to the disnction (despite, or because of, reading so many articles). I don't know where I should be using mydomain.com and where I should be using mydomain.private)
in the Mail Service Configuration Assistant:
(18) I use mydomain.com for both the Domain Name (Enter the local Internet domain name) and for the Host name (enter the Internet host name of this mail system). These match the A and MX records of my EXTERNAL DNS (ie. what I see on my ISP's control panel).
(19) To try to make things easier to start with, I enabled all options for both secure and non-secure authentication.
(20) I added a host alias mydomain.private
(21) Setup appeared to go fine.
(22) Back on the LAN, "dig MX mydomain.com" gives my static WAN IP
(23) In the outer router, port 25 is forwarded to the SLS
(24) In SLS, in Server Assistant, In DNS, Mail Exchanger is set to mydomain.private -- this works for sending mail within the LAN only.
(25) I tried changing this to mydomain.com, and then nothing worked.
(26) The Nameserver for my primary zone is set to:
Zone: mydomain.private.
Hostname: mydomain.private
When I try to send a message FROM an account on the Internet TO an account on the SLS, I get an error: "Couldn't find a Mail Exchanger or IP address."
When I try to send a message FROM an account on the SLS TO an account on the Internet, the Mail Delivery System returns it to the sender.
Well, that's where I stand now.
I hope people reading will give me some ideas of some other paths to run down, and tests or experiments to try. I'm not afraid of the command line -- but I'm not very experienced with it either -- so maybe there are some useful diagnostic commands that I should know about.
My ISP is not blocking port 80.
Is there some way that I can tell if my ISP is blocking port 25? (Their customer support doesn't know anything.)
Thanks a lot for your attention and patience.
(Intentionally Blank)

Answer 1

Oops. Sorry for the delay getting back to you.
Thanks David_x. That was really helpful information. It opened up more questions, but it gave me some good ideas of things to try.
I reinstalled SLS. This time I used my FQDN and accepted the installer's
David_x wrote:
Firstly, remove the secondary from DHCP. Otherwise clients will 'randomly' use info from either inside or outside DNS. You want them to use the internal DNS so use that alone.
I see. So "secondary" doesn't mean "in case the primary fails" -- it means something more like "another one in the pool of possible DNS servers". Doesn't that present a problem in the event that my server is down? Why is this preferred as opposed to clearly defined prioritized list? (Then there is another issue of some services using mDNSResponder in some cases and resolv.conf -- at least that's fairly well documented.)
DNS & Hostname, etc...
If you want to be able to access services from inside and outside your LAN, using the server's hostname (same one inside and out), then set up your internal DNS using your .com domain, same as is used externally.
Okay. Got it. I did that with the reinstall.
DNS is only an "IP lookup" system so you want the hostname inside to resolve to your LAN IP and the hostname outside to resolve to your WAN IP. Forget about the .private stuff - it just confuses things.
Okay. Thanks.
Public MX Record…
(3) I have defined an A record pointing to my static WAN IP.
(4) I have deifined an MX record pointing to the same static WAN IP.
The above may not be what you meant to say but just to check… Your public MX record should resolve to your A record hostname. Then the hostname resolves to an IP address. Your MX record should not be pointing directly to an IP address.
Yes. You are right. That's very good of you to point that out. I did have it pointing to an IP address. (My ISPs simplistic DNS control panel is in Spanish, and I was confused about whether "nombre" referred to a name or number.) I had discovered this through brute force trial and error. This sort of thing was very difficult to test, since I don't have control over many of the DNS parameters (like TTL). That was probably my main problem. Now I can send and receive mail from my server to outside accounts, and from outside accounts to my server.
At the moment, I can't retrieve mail on my server from a computer outside of my network. I suppose that's an authentication problem, or a hostname alias or something. I'll continue trying different things.
Testing Port 25...
To see if port 25 is blocked, get an outside computer and "telnet your-wan-ip 25". If you can switch on logging at the firewall for your port-forwarding rule, all the better as this will be only sure way to see that it is reaching the WAN firewall.
By "logging at the firewall", I suppose you mean at the router? Alright. I still have to try this. From my point of view, this kind of suggestion is great advice.
Instead of using an outside computer, would it be possible to do this sort of checking using an anonymizing proxy? I suppose they usually don't allow telnet.
...any chance this could be tested from my "inner" LAN? (My guess is that it needs to be from a computer that is "upstream" relative to the "outer" router. I'm under the impression that routers handle upstream connections differently than downstream connections, this wouldn't work.)
After that, test at server... open Terminal and enter: "tcpdump -v tcp port 25"
Tcpdump will listen on port 25. When the telnet session gets port-forwarded, you will see a listing of information about the packet received. If you get nothing then the port-forwarding is not working.
So, to make sure I've got this straight:
Turn on logging on port 25 in my outer router.
Go to Terminal on my server.
Start tcpdump listening on port 25.
Take my netbook out to some WiFi hotspot (for example).
Telnet into my server.
Come home and check my logs.
(Maybe I should check out this VPN stuff.)
I'm looking to see that the router forwarded the port correctly.
That's great trouble shooting advice.
Now you'll see how slow I am. I'm reading along, running through all of this in my head, imagining all of my steps ... And only now do I realize that if (as of my latest experiments) my server has been able to receive mail from outer accounts -- then the router must be forwarding things and the mail server is, to some extent, working fine. Okay. I'm still going to go through these steps anyway to see what it should look like.
Server Admin: Domain Name & Hostname...
The Domain Name is just your domain name... e.g., mydomain.com
The Hostname is ideally the same as your external MX hostname... e.g., mail.mydomain.com
The main thing about the Hostname is that this is what your server will report as it's HELO name to other connecting mail servers. Some will check this against the public MX record and use any discrepancy to increase likelihood of spam filtering.
Is there really any reason that a small setup like mine should use "mail.mydomain.com" instead of just "mydomain.com". Since I don't have a separate machine dedicated to mail, maybe it's just an unnecessary complication. I was just copying what I've seen around (configuration for mail and articles I've read).
Under Advanced-> Hosting, tick the "Include server's domain as local host alias".
Okay. What exactly does this do? I understand the words, but not the sense of the phrase. (I find this happening a lot.)
Checking Server Settings…
Use a terminal session to debug any basic configuration issues on the server. The error responses are much more informative than just using a mail client. Open Terminal in a local computer… "telnet server-lan-ip 25" and carry out following…
I could connect with telnet to port 25 on the server:
(1) From a remote computer.
(2) From a local client.
(3) From the server
As we step through the experiment, you will see that we have a few problems.
Server Response:
Trying...
Connected to fqdn.or.ip.
Escape character is '^]'.
220 fqdn.or.ip ESMTP Postfix
#1. Declare where you are sending the email from:
HELO something.name
You can use a real hostname but the mail server has no choice but to accept whatever you type.
Response: 250 servers.hostname
So far, so good.
On remote computers, I couldn't get any further than this.
I'll try again tonight.
#2. Give senders address:
MAIL FROM:<mail@senderdomain>
Response: 250 Ok
I could get this to work for either a local email account or a remote email account, from telnet sessions initiated either on the server itself or on a local client.
#3. Give recipients address:
RCPT TO:<mail@otherdomain>
Response: 250 Ok
Here, I did not get consistent results.
From a local account to a remote account, I could get "Relay access denied".
From a local account to a local account, I could get "Recipient address rejected. Service is unavailable. But this was not consistent. I used three different local accounts, and all could send or receive at one time or another.
#4. Start composing the message:
DATA
Response: 354 End data with <CR><LF>.<CR><LF>
#5. Type a message. Finish with a single "." on a line on it's own.
Response: 250 Ok: queued as dah,de,da
#6. Close the connection by typing: QUIT
Response:221 Bye... Connection closed by foreign host.
suggestion for hostname.
Were you going to add something else here?
Well, any comments or insights that you might add will be very much appreciated. I'm going to continue sending and receiving and making little tweaks. It's really pretty confusing for a newbie. I thank you a lot for all the time you spent reading and helping me.
(Intentionally Blank)