rspamd fails to resolve domains about nixos-mailserver HOT 7 CLOSED

This is indeed a problem with rspamd on nixos. It seems though as it does not jeopardize the functionality of it. rspamd website suggests hosting a DNS resolver, maybe that would solve the problem?

Btw, what rspamd version do you run? (I.e. are you on stable or unstable)

from nixos-mailserver.

Running a local DNS resolver fixed the problem for me:

services.kresd.enable = true;
networking.nameservers = [ "127.0.0.1" ];

from nixos-mailserver.

Thanks for verifying this. I'll add this to the next version!

from nixos-mailserver.

@r-raymond I am on 17.09-small so yes: stable.

from nixos-mailserver.

I was writing a PR for this, adding the solution by @erosennin but when I put both lines in my configuration, the name resolution broke:

kresd failed to start because of this:

fetch of "https://data.iana.org/root-anchors/root-anchors.xml" failed: host or service not provided, or not known

I then removed this line:

networking.nameservers = [ "127.0.0.1" ];

after which kresd was able to start. Then I added the line back into my config and this time it worked.

I am afraid NixOS applies the networking.nameservers before kresd has performed its initial setup therefore switing to a name resolution service which can't work. Then in turn the entire system is unable to perform any name resolution. How do we solve this?

We could use networking.networkmanager.insertNameservers to prepend the list of nameservers with our own. If I understand this correctly NixOS then falls back to the nameservers set via DHCP if kresd fails. Thoughts? Edit: Nevermind that. This (of course) only affects networkmanager and I don't think we want to use that.

from nixos-mailserver.

@phdoerfler this is fixed in master, kresd now uses DNSSEC root trust anchors from nixpkgs. The fix is already in the nixos-unstable-small channel (but not in nixos-unstable yet).

from nixos-mailserver.

@erosennin Interesting! Also I use insertNameservers and I still get these errors logged.
Edit: Using networking.nameservers does not fix this for me.
Edit 2: Turns out I had to manually systemctl restart rspamd. Now everything is shiny.

from nixos-mailserver.