Spam Filter ISP Forums : 5.3.3 Unrecognized command message https://www.logsat.com/spamfilter/forums/ Thu, 11 Jun 2026 03:27:36 +0000 Tue, 10 Jun 2003 12:01:00 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=812 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[5.3.3 Unrecognized command message : support@logsat.com Roberto F.LogSat...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=871&title=533-unrecognized-command-message#871 Author: LogSat
Subject: 812
Posted: 10 June 2003 at 12:01pm

support@logsat.com

Roberto F.
LogSat Software

]]> Tue, 10 Jun 2003 12:01:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=871&title=533-unrecognized-command-message#871 <![CDATA[5.3.3 Unrecognized command message : What email addres should I send...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=870&title=533-unrecognized-command-message#870 Author: Guests
Subject: 812
Posted: 10 June 2003 at 11:57am

What email addres should I send it to?]]> Tue, 10 Jun 2003 11:57:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=870&title=533-unrecognized-command-message#870 <![CDATA[5.3.3 Unrecognized command message : If you check the activity log...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=869&title=533-unrecognized-command-message#869 Author: LogSat
Subject: 812
Posted: 10 June 2003 at 11:30am

If you check the activity log for when the 5.3.3 Unrecognized command  occurs, we'll need the files in tha badmail directory which have the same timestamp as the log entry (plus or minus a few minutes I guess).

Or since there are only 14, you could zip them (so that the timestamp is maintained) and email them to us, including the SpamFilter logs that show the entries with the 5.3.3 error.

Roberto Franceschetti
LogSat Software

]]> Tue, 10 Jun 2003 11:30:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=869&title=533-unrecognized-command-message#869 <![CDATA[5.3.3 Unrecognized command message : Over the past 5 days the badmail...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=868&title=533-unrecognized-command-message#868 Author: Guests
Subject: 812
Posted: 10 June 2003 at 9:37am

Over the past 5 days the badmail folder no has 7 emails (14 files). Let me know what files you would like to see from that folder.]]> Tue, 10 Jun 2003 09:37:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=868&title=533-unrecognized-command-message#868 <![CDATA[5.3.3 Unrecognized command message : I have done that and will let...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=818&title=533-unrecognized-command-message#818 Author: Guests
Subject: 812
Posted: 05 June 2003 at 5:39pm

I have done that and will let you know what I find.  Thank you for the quick response!]]> Thu, 05 Jun 2003 17:39:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=818&title=533-unrecognized-command-message#818 <![CDATA[5.3.3 Unrecognized command message : Yes, it would appear that ISA...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=817&title=533-unrecognized-command-message#817 Author: LogSat
Subject: 812
Posted: 05 June 2003 at 3:18pm

Yes, it would appear that ISA is where the problem could be since that is where the error is coming from. I do not want to exclude an issue with SpamFilter yet though, it's too easy to blame others...

If you can modify the spamfilter.ini file by adding the following line right under the [Server Settings] section:

EnableBadMailDir=1

and restart SpamFilter, this will cause a copy of the email that triggeres any kind of remote "server error" to be placed into a "badmail" directory.

This way we'll be able to see the actual email and its recipients that SpamFilter is forwarding to ISA. Once the error reoccurs, if you can forward it to us we can take a look.

I did not see anything wrong with the list of ISA-supported commands. What I find very strange is that most emails go thru fine...

Roberto Franceschetti
LogSat Software

]]> Thu, 05 Jun 2003 15:18:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=817&title=533-unrecognized-command-message#817 <![CDATA[5.3.3 Unrecognized command message : Plenty of email goes to those...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=816&title=533-unrecognized-command-message#816 Author: Guests
Subject: 812
Posted: 05 June 2003 at 3:03pm

Plenty of email goes to those addresses as well as others on that server without a problem. Here is the layout between the two servers:

SpamFilter <-> Pix506E(w/SMTP fixup) <-> InternetInternet <-> MS ISA Server (using SMTP application filter) <-> Exchange 2000

It seems like the most likely problem would be on the ISA server, do you agree? That is the error returned by ISA server's SMTP filter if you use a command it does not specify. Here are the commands it is allowing:AUTHBDATDATAEHLOEXPNHELOHELPMAIL FROM:NOOPQUITRCPT TO:RSETSAML FROM:SEND FROM:SOML FROM:TURNVRFY

The only change we made to this list was to add the AUTH command, otherwise it is the default list. Is there something you recognize as missing?

Does it make sense that the email was delivered despite the log saying it was returned to sender?]]> Thu, 05 Jun 2003 15:03:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=816&title=533-unrecognized-command-message#816 <![CDATA[5.3.3 Unrecognized command message : Michael, The following log entries: 06/05/03...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=814&title=533-unrecognized-command-message#814 Author: LogSat
Subject: 812
Posted: 05 June 2003 at 1:03pm

Michael,

The following log entries:

06/05/03 09:17:47:953 -- (432) EMail from: abc.defghij@navy.mil to: abcd@abcd.org  was returned to sender - server error - 5.3.3 Unrecognized command

actually mean the following. SpamFilter received an emai from navy.mil to abcd.org. It then forwarded it to your destination SMTP server. While talking to your destination smtp server, SpamFilter received a 5.3.3 Unrecognized command. What follow the -server error -  is the error message returned by the destination smtp server.

"Mailbox not found" or "Mailbox is full" or "User does not exist" are the common errors the destination SMTP server usually returns. The "unrecognized command" is unusual.

Keeping in mind that it's not SpamFilter not recognizing a command, but rather the dest. server, are there any logs on your destination smtp that can give an idea of what kind of command it received? When forwarding email to the dest server, SpamFilter will 1st try to send an EHLO command, if it's not supported, it reverts down to a HELO command. After that is accepted it issues a RSET command, then the MAIL FROM and then the RCPT TO. Nothing out of the ordinary...

Roberto Franceschetti
LogSat Software

 

]]> Thu, 05 Jun 2003 13:03:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=814&title=533-unrecognized-command-message#814 <![CDATA[5.3.3 Unrecognized command message : Below are pieces of our logs (with...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=812&title=533-unrecognized-command-message#812 Author: Guests
Subject: 812
Posted: 05 June 2003 at 12:17pm

Below are pieces of our logs (with email addresses changed). Most mail goes through fine. A few, like these, give a 5.3.3 unrecognized command error but appear to be delivered anyway. I do no know if a NDR is being sent to the sender. We are running SpamFilter v1.1.2.124 on Win2K behind a Cisco Pix506E hardware firewall with SMTP fixup enabled on the PIX. Should I be worried about these logged errors? Are there common SMTP commands that are not implemented by SpamFilter?

06/05/03 09:17:41:656 -- (1496) Connection from: 138.162.0.41 - Originating country : United States06/05/03 09:17:41:875 -- (1496) Resolving 138.162.0.41 - gate2-norfolk.nmci.navy.mil06/05/03 09:17:41:875 -- (1496) Mail from: abc.defghij@navy.mil06/05/03 09:17:47:390 -- (1496) - MAPS search done... .06/05/03 09:17:47:390 -- (1496) RCPT TO: abcd@abcd.org accepted06/05/03 09:17:47:609 -- (1496) EMail from abc.defghij@navy.mil to abcd@abcd.org was queued. Size: 25 KB06/05/03 09:17:47:609 -- (432) Sending email from abc.defghij@navy.mil to abcd@abcd.org 06/05/03 09:17:47:625 -- (1496) Disconnect06/05/03 09:17:47:953 -- (432) EMail from: abc.defghij@navy.mil to: abcd@abcd.org was returned to sender - server error - 5.3.3 Unrecognized command 06/05/03 09:17:48:109 -- (432) Error-email from abc.defghij@navy.mil to abcd@abcd.org was forwarded to mail.abcd.org

--------and--------

06/05/03 07:45:20:921 -- (1448) Connection from: 129.33.230.138 - Originating country : United States06/05/03 07:45:21:031 -- (1448) Resolving 129.33.230.138 - cmn1lsm4.beliefnet.com06/05/03 07:45:21:031 -- (1448) Mail from: owner-nolist-6503*abcd**abcd*-ORG@LISTSERV.BELIEFNET.COM06/05/03 07:45:21:609 -- (1448) - MAPS search done... .06/05/03 07:45:21:609 -- (1448) RCPT TO: abcd@abcd.ORG accepted06/05/03 07:45:21:812 -- (1448) EMail from owner-nolist-6503*abcd**abcd*-ORG@LISTSERV.BELIEFNET.COM to abcd@ASYMCA.ORG was queued. Size: 24 KB06/05/03 07:45:21:812 -- (1340) Sending email from BeliefnetDailyInspiration@partner.beliefnet.com to abcd@abcd.ORG 06/05/03 07:45:22:171 -- (1340) EMail from: BeliefnetDailyInspiration@partner.beliefnet.com to: abcd@abcd.ORG was returned to sender - server error - 5.3.3 Unrecognized command 06/05/03 07:45:22:328 -- (1340) Error-email from BeliefnetDailyInspiration@partner.beliefnet.com to abcd@abcd.ORG was forwarded to mail.abcd.org06/05/03 07:45:22:515 -- (1448) Disconnect]]> Thu, 05 Jun 2003 12:17:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812&PID=812&title=533-unrecognized-command-message#812