You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Henry Leparskas <hl...@uwo.ca> on 2004/04/29 15:54:58 UTC
Newbie sendmail question
The other day I added some of the real time blocking database support to my
sendmail (uld.dnsl.sorbs, spamhaus, list.dsbl, spamcop).
I was checked the 'syslog' file today for the 'refusals', and it seems to be
working fine.
However, I noticed that sendmail seems to be sending back messages to these spam
sites and these are being refused, thereby adding to unwanted traffic.
Can anyone tell me what setting I have that is causing this? Here is some of the
sample log. The first item is a regular refusal via these 'bl services.
The second is the kind that I'd like to get rid of.
Apr 29 03:12:10 phobos sm-mta[2191]: [ID 702911 mail.notice]
ruleset=check_relay, arg1=1Cust93.tnt2.mel1.da.uu.net, arg2=203.61.89.93,
relay=1Cust93.tnt2.mel1.da.uu.net [203.61.89.93], reject=550 5.7.1 Mail From
203.61.89.93 refused - see http://www.dul.dnsbl.sorbs.net/
Apr 29 03:16:30 phobos sm-mta[1576]: [ID 801593 mail.info] i3Q0CnD1010067:
to=<Ne...@morethanwhatihave.com>, delay=3+07:03:41, xdelay=00:00:00,
mailer=esmtp, pri=25594018, relay=morethanwhatihave.com., dsn=4.0.0,
stat=Deferred: Connection refused by morethanwhatihave.com.
----------
Thanks for any help you can give me.
Henry
Re: [OT] Newbie sendmail question
Posted by Henry Leparskas <hl...@astro.uwo.ca>.
Thanks Sylvain. I didn't know of the sendmail forum.
Yeah, I thought it straddled the line, but turned out to be neither.
Cheers,
Henry
>
> This is off-topic for this list (the comp.mail.sendmail newsgroup would
> certainly be more appropriate), but on the other hand, it's in the
> interest of reducing incoming spam, so we can pretend, right? ;-)
>
> On Thu, 29 Apr 2004, Henry Leparskas wrote:
>
> > I noticed that sendmail seems to be sending back messages to these spam
> > sites and these are being refused, thereby adding to unwanted traffic.
> > Can anyone tell me what setting I have that is causing this? Here is
> > some of the sample log. The first item is a regular refusal via these
> > 'bl services. The second is the kind that I'd like to get rid of.
>
> I don't think the two are related. In the first line, your mail server
> responded to the sender with a 550 (permanent failure), and most
> certainly would not have accepted the message. Therefore, there's
> nothing for it to try and send back.
>
> In the second message, your mail server appears to have accepted a
> message, only to discover it was unable to deliver it, and is now trying
> to bounce the original, and finding that it can't do that either
> (postmaster will eventually receive a bounce of the bounce). Grep your
> mail log file for the queue-id of the second log line, to find the
> queue-id of the incoming message which this bounce message was created
> for. You'll then be able to grep for that queue-id to see the message
> arrive.
>
> You'll find one log line that looks like this:
>
> Apr 29 00:16:08 clyde sm-mta[397568]: i3T4Fv1a396961: i3T4G81a397568:
> DSN: User unknown
>
> The first queue-id in that log line (i3T4Fv1a396961) is the incoming
> message, and the second is the queue-id of the bounce that was generated
> for it. If I want to see the log lines for the message arriving, I grep
> for i3T4Fv1a396961 ...
>
> Strange thing, though: Your system doesn't appear to be logging the
> queue-id for rejected messages, and the "[ID 702911 mail.notice]" bit is
> something I've never seen before ... (presumably this is added by
> syslogd?)
>
> > Apr 29 03:12:10 phobos sm-mta[2191]: [ID 702911 mail.notice]
> > ruleset=check_relay, arg1=1Cust93.tnt2.mel1.da.uu.net, arg2=203.61.89.93,
> > relay=1Cust93.tnt2.mel1.da.uu.net [203.61.89.93], reject=550 5.7.1 Mail From
> > 203.61.89.93 refused - see http://www.dul.dnsbl.sorbs.net/
> >
> > Apr 29 03:16:30 phobos sm-mta[1576]: [ID 801593 mail.info] i3Q0CnD1010067:
> > to=<Ne...@morethanwhatihave.com>, delay=3+07:03:41, xdelay=00:00:00,
> > mailer=esmtp, pri=25594018, relay=morethanwhatihave.com., dsn=4.0.0,
> > stat=Deferred: Connection refused by morethanwhatihave.com.
>
> I hope that helps ...
>
> --
> ----------------------------------------------------------------------
> Sylvain Robitaille syl@alcor.concordia.ca
>
> Systems analyst / Postmaster Concordia University
> Instructional & Information Technology Montreal, Quebec, Canada
> ----------------------------------------------------------------------
>
Re: [OT] Newbie sendmail question
Posted by Sylvain Robitaille <sy...@alcor.concordia.ca>.
This is off-topic for this list (the comp.mail.sendmail newsgroup would
certainly be more appropriate), but on the other hand, it's in the
interest of reducing incoming spam, so we can pretend, right? ;-)
On Thu, 29 Apr 2004, Henry Leparskas wrote:
> I noticed that sendmail seems to be sending back messages to these spam
> sites and these are being refused, thereby adding to unwanted traffic.
> Can anyone tell me what setting I have that is causing this? Here is
> some of the sample log. The first item is a regular refusal via these
> 'bl services. The second is the kind that I'd like to get rid of.
I don't think the two are related. In the first line, your mail server
responded to the sender with a 550 (permanent failure), and most
certainly would not have accepted the message. Therefore, there's
nothing for it to try and send back.
In the second message, your mail server appears to have accepted a
message, only to discover it was unable to deliver it, and is now trying
to bounce the original, and finding that it can't do that either
(postmaster will eventually receive a bounce of the bounce). Grep your
mail log file for the queue-id of the second log line, to find the
queue-id of the incoming message which this bounce message was created
for. You'll then be able to grep for that queue-id to see the message
arrive.
You'll find one log line that looks like this:
Apr 29 00:16:08 clyde sm-mta[397568]: i3T4Fv1a396961: i3T4G81a397568:
DSN: User unknown
The first queue-id in that log line (i3T4Fv1a396961) is the incoming
message, and the second is the queue-id of the bounce that was generated
for it. If I want to see the log lines for the message arriving, I grep
for i3T4Fv1a396961 ...
Strange thing, though: Your system doesn't appear to be logging the
queue-id for rejected messages, and the "[ID 702911 mail.notice]" bit is
something I've never seen before ... (presumably this is added by
syslogd?)
> Apr 29 03:12:10 phobos sm-mta[2191]: [ID 702911 mail.notice]
> ruleset=check_relay, arg1=1Cust93.tnt2.mel1.da.uu.net, arg2=203.61.89.93,
> relay=1Cust93.tnt2.mel1.da.uu.net [203.61.89.93], reject=550 5.7.1 Mail From
> 203.61.89.93 refused - see http://www.dul.dnsbl.sorbs.net/
>
> Apr 29 03:16:30 phobos sm-mta[1576]: [ID 801593 mail.info] i3Q0CnD1010067:
> to=<Ne...@morethanwhatihave.com>, delay=3+07:03:41, xdelay=00:00:00,
> mailer=esmtp, pri=25594018, relay=morethanwhatihave.com., dsn=4.0.0,
> stat=Deferred: Connection refused by morethanwhatihave.com.
I hope that helps ...
--
----------------------------------------------------------------------
Sylvain Robitaille syl@alcor.concordia.ca
Systems analyst / Postmaster Concordia University
Instructional & Information Technology Montreal, Quebec, Canada
----------------------------------------------------------------------