Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - DNS report, connecting to mail servers
  FAQ FAQ  Forum Search   Register Register  Login Login

DNS report, connecting to mail servers

 Post Reply Post Reply
Author
Ronny View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Ronny Quote  Post ReplyReply Direct Link To This Post Topic: DNS report, connecting to mail servers
    Posted: 15 June 2004 at 8:11am
I am getting some phonecalls from some external users that have problems sending us email.
When I check DNS and MX records I get the following error msg:
(I am running spamfilter ver 2.9.1.357)
 
 
----------------------
ERROR: I could not complete a connection to any of your mailservers!

xxx.xxx.xxx.xx: Connection closed before I received all my data (state 8). Your mailserver disconnected before it was done! This may be the result of a non-RFC-compliant mailserver or anti-spam program.
notesmta.nera.no: Connection closed before I received all my data (state 8). Your mailserver disconnected before it was done! This may be the result of a non-RFC-compliant mailserver or anti-spam program.

If this is a timeout problem, note that the DNS report only waits about 30 seconds for responses, so your mail may work fine in this case but you will need to use testing tools specifically designed for such situations.
-------------------------
 
Can their not beeing able to send me mail be related to the spamfilter at all?
(they are not beeing caught by the filter...)
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4106
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 16 June 2004 at 10:27pm

Ronny,

If you check SpamFilter's activity log while dnsreport performs its test, you'll see something like the following:

06/16/04 22:16:13:274 -- (988) Connection from: 69.2.200.182  -  Originating country : United States
06/16/04 22:16:13:855 -- (988) Resolving 69.2.200.182 - test.dnsstuff.com
06/16/04 22:16:13:855 -- (988) Mail from:
06/16/04 22:16:13:855 -- (988) - MAPS search done...
06/16/04 22:16:13:865 -- (988) RCPT TO:
postmaster@netwide.net accepted
06/16/04 22:16:14:055 -- (988) Mail from:
06/16/04 22:16:14:055 -- (988) RCPT TO:
abuse@netwide.net accepted
06/16/04 22:16:14:255 -- (988) Mail from:  To:
postmaster@[209.26.140.4] - rejected - no relay allowed or % found in FROM address
06/16/04 22:16:14:255 -- (988) 69.2.200.182 - Mail from:  To:
postmaster@[209.26.140.4] will be disconnected
06/16/04 22:16:14:255 -- (988) Disconnect

The bolded entry is most likely what's causing their test to fail. They're trying to send an email not to our domain, but to our IP address in the form postmaster@[209.26.140.4]. While that is "legal", several SMTP servers (ex Post.Office) have bugs in that they allow addresses in that format to bypass all security settings and become open relays. Many spammers use the above trick on such servers and use them as open relays to spam.

SpamFilter has a list of "allowed domains". 209.26.140.4 is not in that list, so that recipient is rejected. SpamFilter will not allow the IP to be used instead of the domain name by default to prevnt spammers abuse your server in case it's vulnerable as above described. You may enter the entry [aa.bb.cc.dd] in your local domains if you wish to receive emails in that format, even though we believe that no legitimate emails will usually have that format.

Roberto F.
LogSat Software

 

Back to Top
Ronny View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Ronny Quote  Post ReplyReply Direct Link To This Post Posted: 17 June 2004 at 4:00am
Thank you, I am happy with that :)
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.423 seconds.