Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Mail not sent from Spamfilter to my Imal Server
  FAQ FAQ  Forum Search   Register Register  Login Login

Mail not sent from Spamfilter to my Imal Server

 Post Reply Post Reply
Author
morten44 View Drop Down
Groupie
Groupie


Joined: 07 March 2008
Status: Offline
Points: 74
Post Options Post Options   Thanks (0) Thanks(0)   Quote morten44 Quote  Post ReplyReply Direct Link To This Post Topic: Mail not sent from Spamfilter to my Imal Server
    Posted: 16 September 2010 at 1:57pm
Hi
I have some users complaining about not getting the mails sent to their Inbox.

I have gone through the spamfilter log files, and I can see something like:
09/15/10 16:50:03:046 -- (2024) Detected TCP Connection: 195.41.32.96
09/15/10 16:50:03:046 -- (2024) Connection from: 195.41.32.96  -  Originating country : Denmark
09/15/10 16:50:03:250 -- (2024) Received MAIL FROM: <donna@prngo.dk>
09/15/10 16:50:05:093 -- (2024) Received RCPT TO: lise@uff.dk
09/15/10 16:50:05:109 -- (2024) Mail from: donna@prngo.dk
09/15/10 16:50:05:421 -- (2024) RCPT TO: lise@uff.dk accepted
09/15/10 16:52:02:515 -- (2024) Disconnect
 
 
I cant see that the mail acutally was forwarded or any message saying that it was rejected
I am missing a line like:
EMail from donna@prngo.dk to lise@uff.org --  was forwarded to 172.18.0.16:2225
 

Can anyone explain what may have happened here
This user has sent about 6 mails this day and its the same with all of them
Kind Regards Morten
Back to Top
yapadu View Drop Down
Senior Member
Senior Member


Joined: 12 May 2005
Status: Offline
Points: 272
Post Options Post Options   Thanks (0) Thanks(0)   Quote yapadu Quote  Post ReplyReply Direct Link To This Post Posted: 16 September 2010 at 6:17pm
I have had the the same, every time I have noticed it was from a sender hosted by Google (postini or gmail).  The sender receives a bounce back from Google indicating error 550, user undefined.

In your case, does donna@prngo.dk receive an undeliverable notice?
--------------------------------------------------------------
I am a user of SF, not an employee. Use any advice offered at your own risk.
Back to Top
morten44 View Drop Down
Groupie
Groupie


Joined: 07 March 2008
Status: Offline
Points: 74
Post Options Post Options   Thanks (0) Thanks(0)   Quote morten44 Quote  Post ReplyReply Direct Link To This Post Posted: 24 September 2010 at 10:34am
Hi
Sorry for late reply. Was away for some days
I have not been able to establish if the sender actually get a message that its not sent succsesfully.
 
The think is that I do not understand why it does not say that message has been forwarded
 
Regards
Morten
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 24 September 2010 at 7:32pm
Morten,

The email was not delivered as, just like you noticed, the line indicating a delivery attempt is not present:

EMail from donna@prngo.dk to lise@uff.org --  was forwarded to 172.18.0.16:2225

Are you certain there are no other log entries relative to that threadID (2024) after 16:50:05:421, and before 16:52:02:515? Sometimes there may be an indication of why the disconnect occurred. Without any other entries, the most likely cause is that the remote server simply disconnected the SMTP session after almost two minutes of sending the RCPT command.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
morten44 View Drop Down
Groupie
Groupie


Joined: 07 March 2008
Status: Offline
Points: 74
Post Options Post Options   Thanks (0) Thanks(0)   Quote morten44 Quote  Post ReplyReply Direct Link To This Post Posted: 25 September 2010 at 12:30pm

Hi

No I can not see any record further down telling me why it was disconnected.
IT seems like fault is with mails with attached  pdf files
 
I have done 3 tests myself sending from hotmail to this users. All 3 mails has a PDF file attached

nr1: arrived ok
nr2: did not arrive. got return message on hotmail. sent with no text in body
nr 3: did not arrive. did not get return message on hotmail. Write text in body. as a sender, i would think the mail arrived ok
 
here are the 3:
 
09-24-10 16:36:28:906 -- (4864) Received MAIL FROM: <abrahamsen_morten@hotmail.com>
09-24-10 16:36:29:093 -- (4864) Received RCPT TO: lise@uff.dk
09-24-10 16:36:29:093 -- (4864) found SPF record for hotmail.com: v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all
09-24-10 16:36:29:109 -- (4864) found SPF record for spf-a.hotmail.com: v=spf1 ip4:209.240.192.0/19 ip4:65.52.0.0/14 ip4:131.107.0.0/16 ip4:157.54.0.0/15 ip4:157.56.0.0/14 ip4:157.60.0.0/16 ip4:167.220.0.0/16 ip4:204.79.135.0/24 ip4:204.79.188.0/24 ip4:204.79.252.0/24 ip4:207.46.0.0/16 ip4:199.2.137.0/24 ~all
09-24-10 16:36:29:109 -- (4864) SPF query result: pass
09-24-10 16:36:29:109 -- (4864) - SPF analysis for spf-a.hotmail.com done: - pass
09-24-10 16:36:29:109 -- (4864) SPF query result: pass
09-24-10 16:36:29:109 -- (4864) - SPF analysis for hotmail.com done: - pass
09-24-10 16:36:29:109 -- (4864) Mail from: abrahamsen_morten@hotmail.com
09-24-10 16:36:29:531 -- (4864) - MAPS search done...
09-24-10 16:36:29:531 -- (4864) RCPT TO: lise@uff.dk accepted
09-24-10 16:36:30:453 -- (4864) Checking SURBL
09-24-10 16:36:30:453 -- (4864) Checking URLs in emails against MAPS
09-24-10 16:36:30:453 -- (4864) - URLs In MAPS search done...
09-24-10 16:36:30:453 -- (4864) Starting queueing procedures
09-24-10 16:36:30:453 -- (4864) EMail from abrahamsen_morten@hotmail.com to lise@uff.dk was queued. Size: 21 KB, 21504 bytes
09-24-10 16:36:30:468 -- (3992) Sending email from abrahamsen_morten@hotmail.com to lise@uff.dk --
09-24-10 16:36:30:593 -- (3992) EMail from abrahamsen_morten@hotmail.com to lise@uff.dk --  was forwarded to 172.18.0.16:2225
 
 
 
09-24-10 16:39:15:546 -- (4256) Received MAIL FROM: <abrahamsen_morten@hotmail.com>
09-24-10 16:39:15:718 -- (4256) Received RCPT TO: lise@uff.dk
09-24-10 16:39:15:734 -- (4256) found SPF record for hotmail.com: v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all
09-24-10 16:39:15:734 -- (4256) found SPF record for spf-a.hotmail.com: v=spf1 ip4:209.240.192.0/19 ip4:65.52.0.0/14 ip4:131.107.0.0/16 ip4:157.54.0.0/15 ip4:157.56.0.0/14 ip4:157.60.0.0/16 ip4:167.220.0.0/16 ip4:204.79.135.0/24 ip4:204.79.188.0/24 ip4:204.79.252.0/24 ip4:207.46.0.0/16 ip4:199.2.137.0/24 ~all
09-24-10 16:39:15:734 -- (4256) SPF query result: pass
09-24-10 16:39:15:734 -- (4256) - SPF analysis for spf-a.hotmail.com done: - pass
09-24-10 16:39:15:734 -- (4256) SPF query result: pass
09-24-10 16:39:15:734 -- (4256) - SPF analysis for hotmail.com done: - pass
09-24-10 16:39:15:734 -- (4256) Mail from: abrahamsen_morten@hotmail.com
09-24-10 16:39:16:281 -- (4256) - MAPS search done...
09-24-10 16:39:16:281 -- (4256) RCPT TO: lise@uff.dk accepted
09-24-10 16:39:17:296 -- (4256) Detected blank HTML email with specified attachment
09-24-10 16:39:17:296 -- (4256) Starting bayesian procedures
09-24-10 16:39:17:468 -- (4256) Blacklist cache - Added 65.54.190.16 to limbo
09-24-10 16:39:17:468 -- (4256) Disconnect
 
 
 
09-24-10 16:41:51:625 -- (3896) Received MAIL FROM: <abrahamsen_morten@hotmail.com>
09-24-10 16:41:51:796 -- (3896) Received RCPT TO: lise@uff.dk
09-24-10 16:41:51:812 -- (3896) found SPF record for hotmail.com: v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all
09-24-10 16:41:51:812 -- (3896) found SPF record for spf-a.hotmail.com: v=spf1 ip4:209.240.192.0/19 ip4:65.52.0.0/14 ip4:131.107.0.0/16 ip4:157.54.0.0/15 ip4:157.56.0.0/14 ip4:157.60.0.0/16 ip4:167.220.0.0/16 ip4:204.79.135.0/24 ip4:204.79.188.0/24 ip4:204.79.252.0/24 ip4:207.46.0.0/16 ip4:199.2.137.0/24 ~all
09-24-10 16:41:51:812 -- (3896) SPF query result: pass
09-24-10 16:41:51:812 -- (3896) - SPF analysis for spf-a.hotmail.com done: - pass
09-24-10 16:41:51:812 -- (3896) SPF query result: pass
09-24-10 16:41:51:812 -- (3896) - SPF analysis for hotmail.com done: - pass
09-24-10 16:41:51:812 -- (3896) Mail from: abrahamsen_morten@hotmail.com
09-24-10 16:41:52:437 -- (3896) - MAPS search done...
09-24-10 16:41:52:437 -- (3896) RCPT TO: lise@uff.dk accepted
09-24-10 16:41:55:359 -- (3896) Checking SURBL
09-24-10 16:41:55:359 -- (3896) Checking URLs in emails against MAPS
09-24-10 16:41:55:359 -- (3896) - URLs In MAPS search done...
09-24-10 16:41:55:359 -- (3896) Starting queueing procedures
09-24-10 16:41:55:625 -- (3896) EMail from abrahamsen_morten@hotmail.com to lise@uff.dk was queued. Size: 103 KB, 105472 bytes
09-24-10 16:41:56:328 -- (3996) Sending email from abrahamsen_morten@hotmail.com to lise@uff.dk --
09-24-10 16:41:56:734 -- (3896) Disconnect
 
Does this give you some idea whats going on?
Clearly on mail 3 it tried to deliver but did not.
Checked logfile and spamfilter are delivering to mail server right before and after this
 
 
Kind regards
Morten
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 25 September 2010 at 10:28pm
Originally posted by morten44 morten44 wrote:

nr1: arrived ok

09-24-10 16:36:30:468 -- (3992) Sending email from abrahamsen_morten@hotmail.com to lise@uff.dk --
09-24-10 16:36:30:593 -- (3992) EMail from abrahamsen_morten@hotmail.com to lise@uff.dk --  was forwarded to 172.18.0.16:2225
 
 
Correct, this email was forwarded to the destination SMTP server at 172.18.0.16




Originally posted by morten44 morten44 wrote:

nr2: did not arrive. got return message on hotmail. sent with no text in body
 
09-24-10 16:39:17:296 -- (4256) Detected blank HTML email with specified attachment
 
 
This email was rejected due to the above reason. There should actually be another log entry that I did not see which specifically states that the remote server will be disconnected or that the email is rejected.




Originally posted by morten44 morten44 wrote:

nr 3: did not arrive. did not get return message on hotmail. Write text in body. as a sender, i would think the mail arrived ok

09-24-10 16:41:56:328 -- (3996) Sending email from abrahamsen_morten@hotmail.com to lise@uff.dk -- 
Are you absolutely certain there is not another log entry for threadID (3996) in SpamFilter's logfile after 16:41:56:328...? Please note that you may have to look several minutes past 16:41:56 if the PDF attachment is large and/or the connection to the destination server is slow. There should be either another entry in the log saying the delivery was successful, or one that states there was an issue delivering it. In either case, unless something went majorly wrong in SpamFilter, the fate of that email should have been logged.

If you'd like to zip and email us the log for the 24th, I'd be happy to look over it.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
morten44 View Drop Down
Groupie
Groupie


Joined: 07 March 2008
Status: Offline
Points: 74
Post Options Post Options   Thanks (0) Thanks(0)   Quote morten44 Quote  Post ReplyReply Direct Link To This Post Posted: 26 September 2010 at 6:54pm
Hi Roberto
I have sent a mail to your support address.
Thanks for taking time to look through the lof file
 
Looking forward to hear from you
Regards
Morten
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 26 September 2010 at 8:09pm
Morten,

I checked your logs, and that email was indeed delivered successfully to the destination SMTP server at 172.18.0.16 on port 2225 - please see the entries below:

09-24-10 16:41:56:328 -- (3996) Sending email from abrahamsen_morten@hotmail.com to lise@uff.dk -- 
09-24-10 16:41:58:109 -- (3996) EMail from abrahamsen_morten@hotmail.com to lise@uff.dk --  was forwarded to 172.18.0.16:2225

To see why the user did not receive it, you will need to check the SMTP logs on that server at 172.18.0.16, since the line in green above will only be logged if the destination server accepts the email with a 200 (meaning success) code.

Regards,

Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.344 seconds.