Print Page | Close Window

DNS report, connecting to mail servers

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=3778
Printed Date: 30 November 2025 at 1:35am


Topic: DNS report, connecting to mail servers
Posted By: Guests
Subject: DNS report, connecting to mail servers
Date Posted: 15 June 2004 at 8:11am
I am getting some phonecalls from some external users that have problems sending us email.
When I check DNS and MX records I get the following error msg:
(I am running spamfilter ver 2.9.1.357)
 
This is from http://www.dnsreport.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.dnsreport.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.dnsreport.com
 
----------------------
ERROR: I could not complete a connection to any of your mailservers!

xxx.xxx.xxx.xx: Connection closed before I received all my data (state 8). Your mailserver disconnected before it was done! This may be the result of a non-RFC-compliant mailserver or anti-spam program.
notesmta.nera.no: Connection closed before I received all my data (state 8). Your mailserver disconnected before it was done! This may be the result of a non-RFC-compliant mailserver or anti-spam program.

If this is a timeout problem, note that the DNS report only waits about 30 seconds for responses, so your mail may work fine in this case but you will need to use testing tools specifically designed for such situations.
-------------------------
 
Can their not beeing able to send me mail be related to the spamfilter at all?
(they are not beeing caught by the filter...)


Replies:
Posted By: LogSat
Date Posted: 16 June 2004 at 10:27pm

Ronny,

If you check SpamFilter's activity log while dnsreport performs its test, you'll see something like the following:

06/16/04 22:16:13:274 -- (988) Connection from: 69.2.200.182  -  Originating country : United States
06/16/04 22:16:13:855 -- (988) Resolving 69.2.200.182 - test.dnsstuff.com
06/16/04 22:16:13:855 -- (988) Mail from:
06/16/04 22:16:13:855 -- (988) - MAPS search done...
06/16/04 22:16:13:865 -- (988) RCPT TO: mailto:postmaster@netwide.net" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - postmaster@netwide.net accepted
06/16/04 22:16:14:055 -- (988) Mail from:
06/16/04 22:16:14:055 -- (988) RCPT TO: mailto:abuse@netwide.net" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - abuse@netwide.net accepted
06/16/04 22:16:14:255 -- (988) Mail from:  To: mailto:postmaster@[209.26.140.4" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - postmaster@[209.26.140.4 ] - rejected - no relay allowed or % found in FROM address
06/16/04 22:16:14:255 -- (988) 69.2.200.182 - Mail from:  To: mailto:postmaster@[209.26.140.4" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - postmaster@[209.26.140.4 ] will be disconnected
06/16/04 22:16:14:255 -- (988) Disconnect

The bolded entry is most likely what's causing their test to fail. They're trying to send an email not to our domain, but to our IP address in the form mailto:postmaster@[209.26.140.4" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - postmaster@[209.26.140.4 ]. While that is "legal", several SMTP servers (ex Post.Office) have bugs in that they allow addresses in that format to bypass all security settings and become open relays. Many spammers use the above trick on such servers and use them as open relays to spam.

SpamFilter has a list of "allowed domains". 209.26.140.4 is not in that list, so that recipient is rejected. SpamFilter will not allow the IP to be used instead of the domain name by default to prevnt spammers abuse your server in case it's vulnerable as above described. You may enter the entry [aa.bb.cc.dd] in your local domains if you wish to receive emails in that format, even though we believe that no legitimate emails will usually have that format.

Roberto F.
LogSat Software

 

Posted By: Guests
Date Posted: 17 June 2004 at 4:00am
Thank you, I am happy with that :)


Print Page | Close Window