Spam Filter ISP Forums : Alternate NDR server setup https://www.logsat.com/spamfilter/forums/ Wed, 11 Mar 2026 09:15:55 +0000 Fri, 18 May 2007 18:07:04 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6074 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Alternate NDR server setup : Gotcha, thanks!I appreciate your...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10188&title=alternate-ndr-server-setup#10188 Author: sgeorge
Subject: 6074
Posted: 18 May 2007 at 6:07pm

Gotcha, thanks!

I appreciate your help, again!  Have a great weekend!

Stephen
]]> Fri, 18 May 2007 18:07:04 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10188&title=alternate-ndr-server-setup#10188 <![CDATA[Alternate NDR server setup : Ok, now that&#039;s a bit too...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10187&title=alternate-ndr-server-setup#10187 Author: LogSat
Subject: 6074
Posted: 18 May 2007 at 5:43pm

Ok, now that's a bit too much even for SpamFilter 
This one can't be done...
]]> Fri, 18 May 2007 17:43:12 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10187&title=alternate-ndr-server-setup#10187 <![CDATA[Alternate NDR server setup : Thanks Roberto. Is there anyway...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10186&title=alternate-ndr-server-setup#10186 Author: sgeorge
Subject: 6074
Posted: 18 May 2007 at 5:14pm

Thanks Roberto.  Is there anyway to save the badmail when an NDR cannot be forwarded, but not save badmail when the NDR is successfully forwarded?

Stephen
]]> Fri, 18 May 2007 17:14:22 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10186&title=alternate-ndr-server-setup#10186 <![CDATA[Alternate NDR server setup : Actually this one is pretty easy.From...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10184&title=alternate-ndr-server-setup#10184 Author: LogSat
Subject: 6074
Posted: 18 May 2007 at 4:32pm

Actually this one is pretty easy .

From the settings you posted earlier, I see you enabled at some point the following option in the SpamFilter.ini file:

;if EnableBadMailDir is set to 1, this will cause allemails that generate a "server error" when forwarded to yourdestination SMTP server will be saved in a "BadMailDir" fortroubleshooting
EnableBadMailDir=1

Just changing that to 0 should prevent the emails to be saved in the badmail folder. There "should" be no need to restart SpamFilter.
]]> Fri, 18 May 2007 16:32:37 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10184&title=alternate-ndr-server-setup#10184 <![CDATA[Alternate NDR server setup : Goodness... would you mind if...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10182&title=alternate-ndr-server-setup#10182 Author: sgeorge
Subject: 6074
Posted: 18 May 2007 at 12:23pm

Goodness... would you mind if I asked you yet another question?

For some reason, even now that SpamFilter's NDRs are sent to Exchange and successfully sent out, SpamFilter is still saving a copy of the original message in the badmail folder.  But sure enough, I am successfully getting the NDR sent to my external mail account for sending a message that Exchange's IMF blocked - so I know that it's working ok.

Does SpamFilter still think that the NDR was not successfully forwarded?  Or is it normal to save the badmail regardless of whether the NDR was forwarded?

Just in case anything funny is going on, I'll include some SpamFilter and Exchange logs of a blocked message that successfully sent out an NDR, but saved the original message in SpamFilter's badmail.

SpamFilter:
05/18/07 11:46:24:391 -- (3148) Connection from: 64.233.162.230  -  Originating country : United States
...
05/18/07 11:46:26:407 -- (3148) EMail from some-guy-out-there@gmail.com to some-guy-in-here@mydomain.com was queued. Size: 1 KB, 1024 bytes
05/18/07 11:46:26:423 -- (1312) Sending email from some-guy-out-there@gmail.com to some-guy-in-here@mydomain.com --
05/18/07 11:46:26:673 -- (1312) EMail from: some-guy-out-there@gmail.com to: some-guy-in-here@mydomain.com --  was returned to sender - server error - 10.10.10.4 said: 5.7.1 Message refused due to content restrictions. --
05/18/07 11:46:26:970 -- (1312) Error-email from some-guy-out-there@gmail.com to some-guy-in-here@mydomain.com --  was forwarded to 10.10.10.4
05/18/07 11:46:26:970 -- (1312) server error - 10.10.10.4 said: 5.7.1 Message refused due to content restrictions. --
05/18/07 11:46:56:517 -- (3148) Disconnect

Exchange (the time zone here is GMT, don't ask me why :] )
-- SpamFilter is attempting to send the message on port 26, which IMF will block --
2007-05-18 15:46:26 10.10.10.4 hobbes SMTPSVC1 HOBBES 10.10.10.4 0 EHLO - +hobbes 250 0 306 11 0 SMTP - - - -
2007-05-18 15:46:26 10.10.10.4 hobbes SMTPSVC1 HOBBES 10.10.10.4 0 MAIL - +FROM:<some-guy-out-there@gmail.com> 250 0 43 30 0 SMTP - - - -
2007-05-18 15:46:26 10.10.10.4 hobbes SMTPSVC1 HOBBES 10.10.10.4 0 RCPT - +TO:<some-guy-in-here@mydomain.com> 250 0 33 30 0 SMTP - - - -
-- For some reason the DATA portion is not logged here, but Exchange returns "550 5.7.1 Message refused due to content restrictions." --
2007-05-18 15:46:26 10.10.10.4 hobbes SMTPSVC1 HOBBES 10.10.10.4 0 QUIT - hobbes 240 250 102 2007 125 SMTP - - - -
-- SpamFilter is attempting to send the NDR on port 27, which Exchange will accept and forward --
2007-05-18 15:46:26 10.10.10.4 hobbes SMTPSVC1 HOBBES 10.10.10.4 0 EHLO - +hobbes 250 0 306 11 0 SMTP - - - -
2007-05-18 15:46:26 10.10.10.4 hobbes SMTPSVC1 HOBBES 10.10.10.4 0 MAIL - +FROM:<> 250 0 27 12 0 SMTP - - - -
2007-05-18 15:46:26 10.10.10.4 hobbes SMTPSVC1 HOBBES 10.10.10.4 0 RCPT - +TO:<some-guy-out-there@gmail.com> 250 0 31 28 0 SMTP - - - -
2007-05-18 15:46:26 10.10.10.4 hobbes SMTPSVC1 HOBBES 10.10.10.4 0 DATA - <HOBBESJfG8REzzIfLiz00000024@hobbes.mss.local> 250 0 129 2538 141 SMTP - - - -
2007-05-18 15:46:26 10.10.10.4 hobbes SMTPSVC1 HOBBES 10.10.10.4 0 QUIT - hobbes 240 281 65 4 15 SMTP - - - -
-- Exchange is forwarding the NDR --
2007-05-18 15:46:26 64.233.167.114 OutboundConnectionResponse SMTPSVC1 HOBBES - 25 - - 220+mx.google.com+ESMTP+z52si6745795pyg 0 0 39 0 93 SMTP - - - -
2007-05-18 15:46:26 64.233.167.114 OutboundConnectionCommand SMTPSVC1 HOBBES - 25 EHLO - hobbes.mss.local 0 0 4 0 93 SMTP - - - -
2007-05-18 15:46:26 64.233.167.114 OutboundConnectionResponse SMTPSVC1 HOBBES - 25 - - 250-mx.google.com+at+your+service,+[123.123.123.123] 0 0 48 0 140 SMTP - - - -
2007-05-18 15:46:26 64.233.167.114 OutboundConnectionCommand SMTPSVC1 HOBBES - 25 MAIL - FROM:<>+SIZE=2828 0 0 4 0 140 SMTP - - - -
2007-05-18 15:46:26 64.233.167.114 OutboundConnectionResponse SMTPSVC1 HOBBES - 25 - - 250+2.1.0+OK 0 0 12 0 187 SMTP - - - -
2007-05-18 15:46:26 64.233.167.114 OutboundConnectionCommand SMTPSVC1 HOBBES - 25 RCPT - TO:<some-guy-out-there@gmail.com> 0 0 4 0 187 SMTP - - - -
2007-05-18 15:46:26 64.233.167.114 OutboundConnectionResponse SMTPSVC1 HOBBES - 25 - - 250+2.1.5+OK 0 0 12 0 406 SMTP - - - -
2007-05-18 15:46:26 64.233.167.114 OutboundConnectionCommand SMTPSVC1 HOBBES - 25 DATA - - 0 0 4 0 406 SMTP - - - -
2007-05-18 15:46:26 64.233.167.114 OutboundConnectionResponse SMTPSVC1 HOBBES - 25 - - 354+Go+ahead 0 0 12 0 437 SMTP - - - -
2007-05-18 15:46:27 64.233.167.114 OutboundConnectionResponse SMTPSVC1 HOBBES - 25 - - 250+2.0.0+OK+1179503166+z52si6745795pyg 0 0 39 0 625 SMTP - - - -
2007-05-18 15:46:27 64.233.167.114 OutboundConnectionCommand SMTPSVC1 HOBBES - 25 QUIT - - 0 0 4 0 625 SMTP - - - -
2007-05-18 15:46:27 64.233.167.114 OutboundConnectionResponse SMTPSVC1 HOBBES - 25 - - 221+2.0.0+mx.google.com+closing+connection+z52si6745795pyg 0 0 58 0 734 SMTP - - - -

Thank you Roberto!  I'm sorry to bug you again, but this really is not urgent, seeing as how my NDRs are going out just fine.

Have a good weekend!

Stephen
]]> Fri, 18 May 2007 12:23:47 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10182&title=alternate-ndr-server-setup#10182 <![CDATA[Alternate NDR server setup : Thank you Roberto! Making sense...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10181&title=alternate-ndr-server-setup#10181 Author: sgeorge
Subject: 6074
Posted: 18 May 2007 at 11:09am

Thank you Roberto!  Making sense of the logs helped me to focus on what I was REALLY doing wrong...

I had not made an exception in Exchange to allow SpamFilter to "relay" NDRs out to the world.  Exchange would disregard all of SpamFilter's outbound NDRs.  I simply had to make an exception to add the server's own i.p. address as an allowed relayer, and things are working like a charm.

I'm sorry to waste your time with such an obvious goof....  what complicated the situation was that Exchange was not logging that it was blocking the outgoing NDRs because of relaying restrictions, which led me to think that SpamFilter was not connecting to Exchange at all.

Thanks for your help.   Having NDRs properly go out means I can spend less time worrying about "badmail", getting me one step closer to email nirvana.

Thanks!

Stephen
]]> Fri, 18 May 2007 11:09:15 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10181&title=alternate-ndr-server-setup#10181 <![CDATA[Alternate NDR server setup : Stephen, I’m very sorry....]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10180&title=alternate-ndr-server-setup#10180 Author: LogSat
Subject: 6074
Posted: 17 May 2007 at 6:52pm

Stephen,

 I’m very sorry. What I said above is not correct, the logs aremisleading, and got me as well. The confusing piece is the entry highlighted inred below. That entry should be written to the log sooner, and I’ve duplicated inlight red to show where it should havebeen inserted to make the log more readable.

 
The email is received from the internet and queued
05/16/07 21:39:52:314 -- (5252) EMail from some-guy-out-there@gmail.comto some-guy-in-here@domain.com was queued. Size: 1 KB, 1024 bytes

Here SpamFilter is forwarding theoriginal message to your server on port 26:
05/16/0721:39:52:329 -- (1708) Sending email from some-guy-out-there@gmail.com tosome-guy-in-here@domain.com --

 While forwardingthe email, your server rejected it with "5.7.1 Message refused due tocontent restrictions". SpamFilter logs this and says that an NDR is beinggenerated (indicated by the "was returned to sender"):
05/16/07 21:39:53:033 -- (1708) server error - 10.10.10.4 said: 5.7.1Message refused due to content restrictions. --

 
Here SpamFilter generated an NDR and isforwarding it to your server on port 27. The highlighted sentence is again reportingthe above error that was encountered:
05/16/07 21:39:52:767 -- (1708) EMail from: some-guy-out-there@gmail.com to: some-guy-in-here@domain.com--  was returned to sender - server error - 10.10.10.4 said: 5.7.1 Message refused due to contentrestrictions. --

The above NDR has been sent. If there was a deliveryerror on this attempt it would have been logged right after this. In your othersample, you do see a socket error being logged, and that indicates a deliveryerror during the NDR delivery:
05/16/07 21:39:53:017 -- (1708) Error-email fromsome-guy-out-there@gmail.com to some-guy-in-here@domain.com --  wasforwarded to 10.10.10.4

The following log entry is in reality for theoriginal delivery to your SMTP server on port 26. It get logged at the end,confusing you (and I!!)

Whileforwarding the email, your server rejected it with "5.7.1 Message refuseddue to content restrictions". SpamFilter logs this and says that an NDR isbeing generated (indicated by the "was returned to sender"):
05/16/07 21:39:53:033 -- (1708) server error - 10.10.10.4said: 5.7.1 Message refused due to content restrictions. --

 

]]> Thu, 17 May 2007 18:52:58 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10180&title=alternate-ndr-server-setup#10180 <![CDATA[Alternate NDR server setup : Yeah, I know it looks pretty...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10179&title=alternate-ndr-server-setup#10179 Author: sgeorge
Subject: 6074
Posted: 17 May 2007 at 4:41pm

Yeah, I know it looks pretty funky.  I'm using Exchange IMF's "Custom Weight List" feature to test the presence/absence of filtering.  I have a watch-word ("imfspamme"), and IMF will block any message that contains that keyword.

When I send telnet emails with that watch-word to port 26, Exchange blocks the message.  When I send the same messages through telnet on port 27, the message arrives in my inbox.  Also, I temporarily reconfigured SpamFilter's destination server port to 27, and that also had success in delivering messages with the watch-word to my inbox.

Just fyi, that "Message refused due to content restrictions." is one that I customized just for Exchange's IMF rejection errors. i.e., that error does cannot occur for any other Exchange errors such as "mailbox full", "relaying denied", "bad address", etc.

Even if I set NotificationSMTPServerPort to a port that is not being listened to by Exchange (e.g., 28), that error still appears twice.  Here's an example:

Settings in SpamFilter.ini:

ListenIP=10.10.10.4
ListenPort=25
DestinationServer=10.10.10.4
DestinationPort=26
NotificationSMTPServer=10.10.10.4
NotificationSMTPServerPort=28

05/17/07 11:09:59:928 -- (1532) Connection from: 64.233.184.235  -  Originating country : United States
...
05/17/07 11:10:02:209 -- (1532) EMail from some-guy-out-there@gmail.com to some-guy-in-here@domain.com was queued. Size: 1 KB, 1024 bytes
05/17/07 11:10:02:225 -- (1756) Sending email from some-guy-out-there@gmail.com to some-guy-in-here@domain.com --
05/17/07 11:10:02:803 -- (1756) EMail from: some-guy-out-there@gmail.com to: some-guy-in-here@domain.com --  was returned to sender - server error - 10.10.10.4 said: 5.7.1 Message refused due to content restrictions. --
05/17/07 11:10:03:819 -- (1756) Error-email from some-guy-out-there@gmail.com to some-guy-in-here@domain.com --  was forwarded to 10.10.10.4
05/17/07 11:10:03:819 -- (1756) Exception occurred during TSendMailThread.SendErrMsg: Socket Error # 10061 -- Connection refused.
05/17/07 11:10:03:819 -- (1756) server error - 10.10.10.4 said: 5.7.1 Message refused due to content restrictions. --
05/17/07 11:10:32:335 -- (1532) Disconnect



Is SpamFilter echoing the original response from the destionation server after the attempt to connect to the notification/ndr server?

Thanks for your help Roberto!

Stephen

Edited by sgeorge]]> Thu, 17 May 2007 16:41:59 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10179&title=alternate-ndr-server-setup#10179 <![CDATA[Alternate NDR server setup : stephen,We cannot get to reproduce...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10178&title=alternate-ndr-server-setup#10178 Author: LogSat
Subject: 6074
Posted: 17 May 2007 at 4:06pm

stephen,

We cannot get to reproduce the problem. The 2nd error in your log:

5/16/07 21:39:53:017 -- (1708) Error-email fromsome-guy-out-there@gmail.com to some-guy-in-here@domain.com --  wasforwarded to 10.10.10.4
05/16/07 21:39:53:033 -- (1708) server error - 10.10.10.4 said: 5.7.1 Message refused due to content restrictions. --

indicates that the second time as well your Exchange server rejected the email. The connection on port 27 is indeed made, as what you see is SpamFilter reporting the error it received from Exchange when forwarding the email to port 27. It's an actual error that was delivered via SMTP... Are you 100% sure that your Exchange server is not rejecting these emails for some reason...? Everything seems to indicate that there's some rules on Exchange that is causing the email to be rejected (twice).
]]> Thu, 17 May 2007 16:06:11 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10178&title=alternate-ndr-server-setup#10178 <![CDATA[Alternate NDR server setup : Howdy Dan. I&#039;m running v3.1.3.615......]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10177&title=alternate-ndr-server-setup#10177 Author: sgeorge
Subject: 6074
Posted: 17 May 2007 at 3:03pm

Howdy Dan.  I'm running v3.1.3.615... I haven't made the jump to SFE just yet.]]> Thu, 17 May 2007 15:03:30 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6074&PID=10177&title=alternate-ndr-server-setup#10177