Click and Open Tracking Not Working

[vulnfind]

My postal server is on "mail.example1.com" and I have added another domain inside the postal server "example2.com". I have created a subdomain "click.example2.com" and pointed its CNAME record to "mail.example1.com" and added the header in the Caddyfile as follows

# Update this to match the hostname you wish to use for accessing the
# Postal web interface.
mail.example1.com {
  reverse_proxy 127.0.0.1:5000
}

# If you use open/click tracking you may need to add additional hosts
# to this file using the format below.
#
click.example2.com {
  reverse_proxy 127.0.0.1:5000 {
    header_up X-Postal-Track-Host "1"
  }
}

What else should I do??

[vulnfind]

and when I visit click.example2.com, the error shows

[willpower232]

I would presume that caddy has not had a chance to generate the certificate yet (or has failed to do so) so it would be worth double checking the IP address of click2.example.com according to your computer to make sure it is going to the right server and then checking any logs on that server for caddy.

[vulnfind]

1. The certificates are created

2. The click.example2.com is redirecting perfectly to localhost

[vulnfind]

Do we have to add the caddy certificates elsewhere???? or is it in the correct place??? cuz my main postal server is working fine with https and ssl enabled

[sinnbeck]

It is pointing to localhost when pinging it from the outside as well? Or only when pinging it from inside the server? You should be able to ping it from the outside, and it should resolve to the server IP

[vulnfind]

It is resolving to the main postal server when pinging from my local computer

[sinnbeck]

Did you restart the caddy container?

[vulnfind]

I restarted the whole postal server.

[willpower232]

Do you have any logs on that server for caddy? if its in docker, you can probably do something like docker logs caddy or docker compose logs caddy depending on how you're doing it.

[vulnfind]

{"level":"error","ts":1681891000.686023,"logger":"http.log.error","msg":"dial tcp 127.0.0.1:5000: connect: connection refused","request":
{"remote_ip":"103.76.xxx.xx","remote_port":"63509","proto":"HTTP/2.0","method":"GET","host":"send.xxxx.xxx","uri":"/","headers":
{"Sec-Fetch-User":["?1"],"Accept-Language":["en-US,en;q=0.9"],"Cache-Control":["max-age=0"],"Sec-Ch-Ua":["\"Chromium\";
v=\"112\", \"Microsoft Edge\";v=\"112\", \"Not:A-Brand\";v=\"99\""],"Sec-Ch-Ua-Platform":["\"Windows\""],"Upgrade-Insecure-
Requests":["1"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) 
Chrome/112.0.0.0 Safari/537.36 Edg/112.0.1722.48"],"Sec-Fetch-Mode":["navigate"],"Sec-Ch-Ua-Mobile":["?0"],"Accept":["text
/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;
q=0.7"],"Sec-Fetch-Site":["cross-site"],"Sec-Fetch-Dest":["document"],"Accept-Encoding":["gzip, deflate, br"]},"tls":
{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"send.xxxx.xxx"}},"duration":0.000623889,"status":502
,"err_id":"3yrt8engr","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}

[vulnfind]

I dont know how, but when i added "https://" in caddyfile, the tracking seems to work.

[meduguos]

I need help, I have tried all I can but the Tracking Domain DNS will still not work. I see Hello. when I visit tracking.mydomain.com
Below is the content of my caddy file

mail.mydomain.com {
reverse_proxy 127.0.0.1:5000
}

tracking.mydomain.com {
reverse_proxy 127.0.0.1:5000 {
header_up X-Postal-Track-Host "1"
}
}

[meduguos]

@vulnfind and @willpower232 please can you assist?

[willpower232]

I see Hello. when I visit tracking.mydomain.com

That is the correct behaviour.

[meduguos]

I understand but when I check the DNS of the Tracking domain in Postal UI, it says my CNAME has issue. I have checked the DNS of the tracking domain and it is pointing to the postal server correctly.

[meduguos]

I have resolved the issue. It was caused by a missing part of my CNAME Record.
I pointed tracking to mail.mydomain.com instead of pointing it to tracking.mail.mydomain.com

Note that my Postal Installation is on mail.mydomain.com

[willpower232]

Ah that would do it, originally Postal needed multiple IP addresses to separate click tracking so this didn't happen. Probably should be a smarter way of Postal verifying this but I guess that is for another day.