Let me start this by just saying that I love music. I listen to a lot of it, a lot of the time. Don’t believe me? Check out my last.fm profile.
As the title suggests, I will be retiring my self-hosted mail server (mx1.staticsafe.ca) soon, most likely by next month.
It has been a lot of fun and an excellent learning experience but I simply cannot devote the time and/or effort into active maintenance of the server.
I am moving all of the mailing lists that I used this server for to the extremely competent folks over at Fastmail.
The retirement will be done in a few stages as follows:
- Stage 1 – Personal mailing list subscription move (completed)
- Stage 2 – Change of MX, SPF records for staticsafe.ca to Fastmail’s servers and add a wildcard alias there.
- Stage 3 – Discontinuation of relay/non-personal services on mx1.staticsafe.ca. One person is using this server as a submission relay for their server. I will be asking them to move to my new MSA only server. Services for caffeine-linux.org will also have to be discontinued.
- Stage 4 – Stop all relevant daemons. Postfix, Dovecot, amavisd-new.
A lot of people and/or companies have provided direct and/or indirect support for this learning experience.
- Linode Library for providing initial inspiration for the current configuration of the server
- The folks in the Postfix and Dovecot communities. (#postfix, postfix-users, #dovecot, Wietse for the wonderful software)
- purrdeta for telling me mail servers are a lot of fun
I have put my server configuration files on Github if anyone is interested, you can see them here.
So, as we all know Ubuntu 14.04 was released today. I downloaded the server ISO to test in VirtualBox.
Let us see what we have here:
ss@trusty-testing:~$ cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=14.04 DISTRIB_CODENAME=trusty DISTRIB_DESCRIPTION="Ubuntu 14.04 LTS" ss@trusty-testing:~$ ip -6 addr show dev eth0 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000 inet6 2001:470:1d:96b:70bb:7393:2071:faa2/64 scope global temporary dynamic valid_lft 597675sec preferred_lft 78675sec
Wait what? Am I going blind or is that an IPv6 temporary address  on a supposedly server image?
ss@trusty-testing:~$ sudo sysctl -a | grep tempaddr net.ipv6.conf.all.use_tempaddr = 2 net.ipv6.conf.default.use_tempaddr = 2 net.ipv6.conf.eth0.use_tempaddr = 2 net.ipv6.conf.lo.use_tempaddr = 2
What the hell? Not only did they leave temporary addresses turned on, they set the sysctl value at 2 which means that the system will prefer temporary addresses over standard ones for making connections. 
I asked around and apparently this is the case on Ubuntu 12.04 server as well.
ss@ubuntu-testing:~$ cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=12.04 DISTRIB_CODENAME=precise DISTRIB_DESCRIPTION="Ubuntu 12.04.4 LTS" ss@ubuntu-testing:~$ sudo sysctl -a | grep tempaddr net.ipv6.conf.all.use_tempaddr = 2 net.ipv6.conf.default.use_tempaddr = 2 net.ipv6.conf.eth0.use_tempaddr = 2 net.ipv6.conf.lo.use_tempaddr = 2
So that is two LTS server releases with IPv6 temporary addresses turned on and set to 2.
Why are temporary addresses bad on a server?
Unpredictability – anything depending on source address validation. Even SLAAC addresses are more predictable because they can be calculated given the MAC address of the NIC.
Ideally, you should be configuring your server’s addresses statically. Leaving temporary addresses turned on on a server image is just a bad default.
 – https://tools.ietf.org/html/rfc4941
 – http://ipv6int.net/systems/linux-ipv6.html#privacy
To quote from Wikipedia:
An authoritative name server is a name server that gives answers that have been configured by an original source, for example, the domain administrator or by dynamic DNS methods, in contrast to answers that were obtained via a regular DNS query to another name server. An authoritative-only name server only returns answers to queries about domain names that have been specifically configured by the administrator.
Continuing on from my theme of DNS independence, I’d like to explore the advantages and disadvantages of hosting your own authoritative name servers.
Let us take a look at my own setup for authoritative name servers.
In this post I would like to explore the concept of DNS independence by looking at two types of DNS usage that are common in our daily highly connected lives.
The two types of DNS usage:
- Recursive/Iterative DNS (first part)
- Authoritative DNS (second part)