How to add an IPv6-only domain to the mail server?

hilord

I just installed the Mail Server (ie. dovecot + postfix) from the aaPanel's store, then I'm trying to add a first domain, but I'm blocked at the very first step since this domain only resolve on IPv6 (IPv4 being under CGNAT at my ISP level); so, I don't have any A record to provide, but just an AAAA one.

How to work around this blocking point (preferably from within aaPanel), please?

aaPanel_Kern

Hello, currently does not support ipv6 add

hilord

Is it in your roadmap? And, if yes, do you have a deadline?

aaPanel_Kern

There are currently no related plans

hilord

It's a pity! I guess you are aware that the IPv6 adoption is bigger and bigger from year to year (less than 10% in 2015 and more than 40% in 2022): Statistics fromGoogle about IPv6. And considering the IPv4 saturation and the use of CG-NAT by a lot of ISP, the cases where there's IPv6 only increases drastically too...

hilord

Just as a return of experience (I don't recommend it), I tried to bypass the blocking point to see what happens. So, I just commented out the lines of code requiring IPv4 during the addition of a domain to Mail Server.

Then, I was able to add a domain successfully and create a user afterward. About subsequent testing, here is the summary:

About SSL: I had to copy/paste my existing wildcard LE certificate (my mail server being a subdomain). Maybe it could be cool to have a button to do it automatically 🙂 Of course, I didn't try to generate a new one since I already have one (wildcard one).
Outgoing mails are all OK (my machine has an IPv6 and there's a public IPv4 downstream, so it doesn't hurt anyone), but I had to go through an SMTP relay (Mailgun) because of banned residential IP (e.g. SPAMHAUS). At the end, all my emails have been received by my recipients on different providers.
Incoming mails never arrive! I guess it's because there are a lot of SMTP servers without IPv6 connectivity. After sometimes (when there's a server error returned), it complains that my MX record relies on a domain without A record. I guess it should work occasionally (SMTP servers are supposed to check IPv6 after IPv4, but they don't IRL). And of course, I tested sending an email directly to the final server from telnet and openssl: it's all OK. So, the issue is really when it's a mail coming from other servers.

Well, so it's a partial success, but an interesting testing 😉

klaus

hilord https://labs.ripe.net/author/mirjam/sending-and-receiving-emails-over-ipv6/

You should check this out.

hilord

klaus Thanks! Very instructive... Aside from the subject of security on receiving (with verification of the origin of the sender), I notice that the expected behavior of any SMTP server should be to try IPv6 first when the MX record is matching a dual-stacked (IPv4 & IPv6) target, but it doesn't say anything when it's an IPv6-only case (with AAAA record only).

klaus

hilord IPv6 Email is still not possible without a IPv4 because is still not clear how will be implemented.

https://serverfault.com/questions/770968/is-an-ipv6-only-mta-possible-yet

Some extra data about it.

hilord

klaus Even if I'm more a stackoverflow regular (being dev), I suprisingly already read this serverfault thread 🙂 Well, I agree, but this discussion was started in 2016. IPv6 was supposed to be implemented everywhere, worldwide in 2004 (according to what was said in the tech area in my country; France) and as stated by the last post at bottom of the serverfault thread, I quote @erebus:

So the short answer is: Unless your MTA is limited to a special use case where IPv6-only is an option, you can't make your MTA ipv6 only in 2023.

Well, I'll see how to manage IPv4 through VPN tunnel or equivalent (even if incoming mails are the only broken point in my case; outgoing ones being OK through SMTP relay)... Thanks for your hints anyway.

klaus

hilord Some web hosting providers don't allow smtp over IPv6, you should check that out as well.

I never bother to make a smtp server, i use Mailgun or Amazon SES, i just don't accept those projects on freelancer anymore, and some clients wanted to host their website on shared web hosting and mostly all the providers close the ports for smtp so you have only the http and https ports open and you can use the api, is so much easier and cheaper that way.

hilord

klaus Yes, of course, everything is easier using hosting companies for whatever, shared hosting, VPS or dedicated service... But, as dev, I need to have a local/home server for a bunch of topics: sometimes because of privacy, other times because of testing, staging, early stage of dev, experimentations, etc. In the past (say ten years ago), I already had this kind of config with some PC behind Smoothwall, then IPcop, but "I gave in to the call of the sirens" and I switched using some cheap VPS here and there... Until the point I checked that it was less comfortable than my previous home-based architecture in terms of organization (for example, I could have aborted project that could easily stay parked locally for a long time, while on a VPS it would mean "paying for nothing" ; another example, I could have very long compile to proceed with -- I'm C/C++/Perl/Python dev on both desktop and full-stack web -- and it's far easier to stay local, to master the environment, to assign RAM and CPU cores without any brain limit because of the cost ; another again, I have old websites for which it would be a non-sense to keep paying hosting account but that I want to keep public for reference, archive ; etc.)... Then, I'm back to the old-school way; and I have to deal with the modern obstacles (like CGNAT), of course °O° My attempt with IPv6-only was not a lost of time, because experience is always superior to theoretical knowledge in my point of view ^.^ At this stage, I have two options: delegate the mail topic or add Ipv4 by a way or another (I have some solutions to test -- the good side is that I never get bored LOL).