Spam Filter ISP Forums : invalid MX record anomoly https://www.logsat.com/spamfilter/forums/ Sat, 11 Jul 2026 08:08:10 +0000 Sat, 30 Apr 2005 17:43:39 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=5139 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[invalid MX record anomoly : Build 2.5.1.448 is available in...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5697&title=invalid-mx-record-anomoly#5697 Author: LogSat
Subject: 5139
Posted: 30 April 2005 at 5:43pm

Build 2.5.1.448 is available in the registered user area. It displays the additional logging mentioned above.]]> Sat, 30 Apr 2005 17:43:39 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5697&title=invalid-mx-record-anomoly#5697 <![CDATA[invalid MX record anomoly : Dan, The tchesc.org domain...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5674&title=invalid-mx-record-anomoly#5674 Author: LogSat
Subject: 5139
Posted: 27 April 2005 at 4:30pm

Dan,

The tchesc.orgdomain looks good to us as well as far as the MX is concerned, andright now do not see a reason for it to fail the test as it did before(unless the MX record was invalid on the 25th and has been fixed since).

We're preparing a new private build that hopefully should provide moredetails on what is wrong with the MX record when the test fails, we'llbe making it available to you within 6/24 hours if you wish, after itpasses some additional QA testing.
]]> Wed, 27 Apr 2005 16:30:33 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5674&title=invalid-mx-record-anomoly#5674 <![CDATA[invalid MX record anomoly : I do have another issue with this...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5671&title=invalid-mx-record-anomoly#5671 Author: Dan B
Subject: 5139
Posted: 27 April 2005 at 3:23pm

I do have another issue with this topic of thread.

I'm seeing the rejection of Invalid MX DNS record for the following domain

tchesc.org  when in fact they do have a valid mx record.  Here is a nslookup on the domain

Non-authoritative answer:
tchesc.org      MX preference = 10, mail exchanger = tchesc.org
tchesc.org      internet address = 66.144.201.129

Here is the logs for this issue.
04/25/05 15:03:27:062 -- (780) Connection from: 66.144.201.129  -  Originating country : United States
04/25/05 15:03:27:593 -- (780) Resolving 66.144.201.129 - tchesc.k12.oh.us
04/25/05 15:03:29:140 -- (780) - Invalid MX record -
04/25/05 15:03:29:140 -- (780) 66.144.201.129 - Mail from: emailaddress@tchesc.org To: email@mydomain.com will be rejected
04/25/05 15:03:29:390 -- (780) EMail from emailaddress@tchesc.org to email@mydomain.com was received and quarantined. Size: 1 KB, 1024 bytes
04/25/05 15:03:29:390 -- (780) Disconnect

Is this the way it's suppose to work?  I was thinking it was looking at the from email address and seeing if there was a valid MX record for that domain or is it a bug?

Thanks,
Dan B

]]> Wed, 27 Apr 2005 15:23:09 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5671&title=invalid-mx-record-anomoly#5671 <![CDATA[invalid MX record anomoly : Update from above.. I looked...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5669&title=invalid-mx-record-anomoly#5669 Author: Dan B
Subject: 5139
Posted: 27 April 2005 at 12:35pm

Update from above..

I looked at todays logs and I'm now seeing the bypass going into effect.  Even tho they were added Monday morning and both were in the SF dialog boxes.  It took 48 hours to start working..  Something is very strange is going on.

Thanks

Dan B

]]> Wed, 27 Apr 2005 12:35:11 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5669&title=invalid-mx-record-anomoly#5669 <![CDATA[invalid MX record anomoly : Sorry about the above... Here...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5667&title=invalid-mx-record-anomoly#5667 Author: Dan B
Subject: 5139
Posted: 27 April 2005 at 11:51am

Sorry about the above...   Here is the correct email from address:
sentto-342201-58373-1114508181-username=mydomainname.com@ret urns.groups.yahoo.com  I was removing the valid email address and I must of hit the space bar. But anyhow, it is still blocking them due to the ip address is being blacklisted.

And the RegEx is correct in the email from whitelist:
((?i)((\w)+@returns\.groups\.yahoo\.com))

And here is an example that is being caught from the domain whitelist.

We have Ebay customers geting SPF rejects when people email inquiring info about item using Ebay's web forms.
So I have this regex to whitelisted Ebay's mailserver's qualified domains:  (((\w+.)|(\w+\.)+)ebay.com)  This too also works in the RegEx Testing.   Here are the logs for the above.


04/26/05 14:47:51:520 -- (1264) Connection from: 66.135.197.28  -  Originating country : United States
04/26/05 14:47:51:851 -- (1264) Resolving 66.135.197.28 - mxpool22.ebay.com
04/26/05 14:47:51:931 -- (1264) failed SPF test (softfail) - Disconnecting 66.135.197.28
04/26/05 14:47:51:931 -- (1264) 66.135.197.28 - Mail from: email@otherdomain.com To: email@mydomain.com will be rejected
04/26/05 14:47:52:572 -- (1264) EMail from email@otherdomain.com to email@mydomain.com was received and quarantined. Size: 14 KB, 14336 bytes
04/26/05 14:47:52:572 -- (1264) Disconnect

Thanks,

Dan B

]]> Wed, 27 Apr 2005 11:51:30 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5667&title=invalid-mx-record-anomoly#5667 <![CDATA[invalid MX record anomoly : Dan B wrote:04/26/05 05:36:31:153...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5665&title=invalid-mx-record-anomoly#5665 Author: LogSat
Subject: 5139
Posted: 26 April 2005 at 10:37pm

Originally posted by Dan B Dan B wrote:

04/26/05 05:36:31:153 -- (1052) Mail from: sentto-342201-58373-1114508181-username@mydomain.com@returns .groups.yahoo.com



Dan B,

As Dan S. correctly pointed out, there appears to be a (invalid) spacein the email address after returns. Furthermore, there's two @ signs inthere... Don't know if these are all typos or not, but if they are not,they would indeed cause the whitelisted entry to fail.
]]> Tue, 26 Apr 2005 22:37:08 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5665&title=invalid-mx-record-anomoly#5665 <![CDATA[invalid MX record anomoly : Fred Dickey wrote: 04/24/05...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5664&title=invalid-mx-record-anomoly#5664 Author: LogSat
Subject: 5139
Posted: 26 April 2005 at 10:34pm

Originally posted by Fred Dickey Fred Dickey wrote:



04/24/05 12:40:58:193 -- (4092) RCPT TO: dhaslam@rivr.com accepted

04/24/05 12:40:58:243 -- (4092) Bypassed all rules for: dschwartz@rivr.com from danielschwartz@comcast.net

04/24/05 12:40:58:343 -- (4092) 204.127.202.56 - Mail from:danielschwartz@comcast.net To: rlundgren@rivr.com will be spam-tagged

04/24/05 12:40:58:513 -- (4092) EMail from danielschwartz@comcast.netto dhaslam@rivr.com, dschwartz@rivr.com, rlundgren@rivr.com was queued.Size: 24 KB, 24576 bytes



Fred,

This email was unusual in that it had three recipients, one of whichwas whitelisted, and it had, as you noticed, a failure of the MX recordwhen performing a check for one of the recipients. The failure is alsounusual, as DNS timeouts are not treated as errors, while in thisinstance the DNS server returned "something" that caused the MX recordto mismatch. Without further information unfortunately it is goint tobe hard to troubleshoot the situation.
]]> Tue, 26 Apr 2005 22:34:47 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5664&title=invalid-mx-record-anomoly#5664 <![CDATA[invalid MX record anomoly : Dan, What is that space in the...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5663&title=invalid-mx-record-anomoly#5663 Author: Desperado
Subject: 5139
Posted: 26 April 2005 at 7:26pm

Dan,

What is that space in the returns .groups.yahoo.com ?

Is that just a typo or is it real?

Regards,



Edited by Desperado]]> Tue, 26 Apr 2005 19:26:35 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5663&title=invalid-mx-record-anomoly#5663 <![CDATA[invalid MX record anomoly : R, I&#039;m also seeing this...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5662&title=invalid-mx-record-anomoly#5662 Author: Dan B
Subject: 5139
Posted: 26 April 2005 at 3:24pm

R,

I'm also seeing this happen when we have entries in the domains & email from in the whitelist.

Here is an example.

04/26/05 05:36:30:452 -- (1052) Connection from: 66.94.237.43  -  Originating country : United States
04/26/05 05:36:30:963 -- (1052) Resolving 66.94.237.43 - n9a.bulk.scd.yahoo.com
04/26/05 05:36:31:153 -- (1052) Mail from: sentto-342201-58373-1114508181-username@mydomain.com@returns .groups.yahoo.com
04/26/05 05:36:31:233 -- (1052) - MAPS search done... 521 -1 The IP 66.94.237.43 is Blacklisted by bl.spamcop.net. Blocked - see http://www.spamcop.net/bl.shtml?66.94.237.43
04/26/05 05:36:31:263 -- (1052) 66.94.237.43 - Mail from: sentto-342201-58373-1114508181-username@mydomain.com@returns .groups.yahoo.com To: username@mydomain.com will be rejected
04/26/05 05:36:32:365 -- (1052) EMail from sentto-342201-58373-1114508181-username@mydomain.com@returns .groups.yahoo.com to username@mydomain.com was received and quarantined. Size: 9 KB, 9216 bytes
04/26/05 05:36:32:365 -- (1052) Disconnect


Here is what I have listed in my entry in email from whitelist.
((?i)((\w)+@returns\.groups\.yahoo\.com))

When I test it in the RegEx Test it works correctly with a "Found"
Registerd Ver 2.5.1.441


Thanks,
Dan B

]]> Tue, 26 Apr 2005 15:24:51 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5662&title=invalid-mx-record-anomoly#5662 <![CDATA[invalid MX record anomoly : LogSat wrote:Fred, What...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5661&title=invalid-mx-record-anomoly#5661 Author: Guests
Subject: 5139
Posted: 25 April 2005 at 11:20pm

Originally posted by LogSat LogSat wrote:

Fred,

What build of SpamFilter are you using? Usually if a sender iswhitelisted, they should not be "spam-tagged". Have you tried using thelatest 2.5 version to see if it solves the problem?



Yes, I'm using 2.5.1.441

]]> Mon, 25 Apr 2005 23:20:10 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139&PID=5661&title=invalid-mx-record-anomoly#5661