Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - When does SF detect that recipients are u
  FAQ FAQ  Forum Search   Register Register  Login Login

When does SF detect that recipients are u

 Post Reply Post Reply
Author
pcmatt View Drop Down
Senior Member
Senior Member
Avatar

Joined: 15 February 2005
Location: United States
Status: Offline
Points: 116
Post Options Post Options   Thanks (0) Thanks(0)   Quote pcmatt Quote  Post ReplyReply Direct Link To This Post Topic: When does SF detect that recipients are u
    Posted: 22 August 2005 at 3:55pm

I only see two or three entries in a day for

"... was returned to sender - The following recipients are unknown: ..."

Meanwhile hundreds of emails to bogus email addresses appear to get sent to my servers each day.  When and does SpamFilter validate the recipient email address and are my results normal?   Is there something special needed to support this on my receiving email servers?

Thanks.



Edited by pcmatt
-Matt R
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4065
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 26 August 2005 at 11:13am
Matt,

Sorry for the delay, this post slipped thru the cracks..

SpamFilter will log that message (and send an NDR bounce to the sender) when it accepts an email for delivery (thus passes all filters) and tries to forward it to your SMTP server. If during this process, when SpamFilter sends the RCPT TO command to your server, and your server rejects the command/recipient with an error code, then SpamFilter will "flag" the failed recipient and is forced to send an NDR bounce to them to let them know that the email was not delivered.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
pcmatt View Drop Down
Senior Member
Senior Member
Avatar

Joined: 15 February 2005
Location: United States
Status: Offline
Points: 116
Post Options Post Options   Thanks (0) Thanks(0)   Quote pcmatt Quote  Post ReplyReply Direct Link To This Post Posted: 26 August 2005 at 12:26pm

Thanks. The symptom I'm having is that SpamFilter is not logging this unless the receiving SMTP server returns a 550 SMTP error.  

If the receiver issues a "550" or "unknown user" error SpamFilter correctly writes two log entries (there are two):

...Some recipients do not exist, sending NDR bounce to sender

and

EMail from: whateversender@domain.com to: invalidrecipient @otherdomain.com was returned to sender - The following recipients are unknown: invalidrecipient@otherdomain.com 

If the receiving SMTP server responds with anything else the NDR is sent correctly but nothing is logged by SpamFilter.  For example, when my server rejects the rcpt to: command with a 501 5.5.4 Invalid Address the NDR is sent, but nothing logged by SpamFilter

It appears that SpamFilter only logs this event properly when a SPECIFIC error code is given to it from the receiver.  SpamFilter SHOULD log this when ANY 500 series or permanent error is given on the rcpt to: SMTP command by the receiver.

This is important so that we know which recipients were not delivered by reviewing the logs.

Thanks again.

-Matt R
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4065
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 26 August 2005 at 1:00pm
Matt,

Is there any way we can access (telnet to the SMTP port) your receiving SMTP server? From our tests all the 500 errors do cause SpamFilter to both send an NDR and log the entries.

If we can actually replicate this by seing what your SMTP server replies back with (and if it disconnects us right away or not) we can then troubleshoot it.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
pcmatt View Drop Down
Senior Member
Senior Member
Avatar

Joined: 15 February 2005
Location: United States
Status: Offline
Points: 116
Post Options Post Options   Thanks (0) Thanks(0)   Quote pcmatt Quote  Post ReplyReply Direct Link To This Post Posted: 26 August 2005 at 1:09pm

Email me your Public IP so I can add to our list of allowed IP connections.

-Matt R
Back to Top
pcmatt View Drop Down
Senior Member
Senior Member
Avatar

Joined: 15 February 2005
Location: United States
Status: Offline
Points: 116
Post Options Post Options   Thanks (0) Thanks(0)   Quote pcmatt Quote  Post ReplyReply Direct Link To This Post Posted: 01 September 2005 at 10:11pm

Wondering how you did on those tests while we had opened IP?

You've probably been busy detecting and blocking worm infected networks like the rest of us

-Matt R
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.078 seconds.