You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Ernie Dunbar <er...@lightspeed.ca> on 2007/05/11 22:34:06 UTC
So you wanted to firewall your mail server...
We just put our mailserver (with SpamAssassin of course) behind a firewall,
and now we get many many interesting error messages from spamd telling me
that there's no route to some host or other. I tweaked the DnsResolver.pm
module to show what host it was trying to route to, and I got this output:
May 11 12:00:09 pop spamd[47940]: dns: sendto() failed: No route to host
Host: clickboothlnk.com at
/usr/local/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/DnsResolver.pm line
340, <GEN1444> line 137.
May 11 12:00:09 pop spamd[47940]: dns: sendto() failed: No route to host
Host: mktexpertise.net.multi.uribl.com. at
/usr/local/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/DnsResolver.pm line
340, <GEN1444> line 137.
May 11 12:00:09 pop spamd[47940]: dns: sendto() failed: No route to host
Host: 190.57.78.66.combined.njabl.org. at
/usr/local/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/DnsResolver.pm line
340, <GEN1444> line 137.
May 11 12:00:09 pop spamd[47940]: dns: sendto() failed: No route to host
Host: 190.57.78.66.bl.spamcop.net. at
/usr/local/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/DnsResolver.pm line
340, <GEN1444> line 137.
Of course, hosts like 190.57.78.66.bl.spamcop.net are DNSBL blacklist
members, and they resolve to nothing at all, which is why there is no route
to host. But why is spamd suddenly spewing these errors now? It didn't do
this before the firewall was in place.
--
View this message in context: http://www.nabble.com/So-you-wanted-to-firewall-your-mail-server...-tf3729493.html#a10439015
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: So you wanted to firewall your mail server...
Posted by Ernie Dunbar <er...@lightspeed.ca>.
Theo Van Dinter-2 wrote:
>
> On Fri, May 11, 2007 at 01:34:06PM -0700, Ernie Dunbar wrote:
>> Of course, hosts like 190.57.78.66.bl.spamcop.net are DNSBL blacklist
>> members, and they resolve to nothing at all, which is why there is no
>> route
>> to host. But why is spamd suddenly spewing these errors now? It didn't do
>> this before the firewall was in place.
>
> You weren't blocking the requests before?
>
> --
> Randomly Selected Tagline:
> "J: Do YOU know who the Spin Doctors are?
> P: Maybe your mother does..." - John West and a Pizza
> Delivery Guy
>
>
>
Heh. Well, when one tries to request anything of an IP address of "",
generally I'd expect you'd go nowhere fast. :) I'm wondering why it's
generating an error at all, rather than failing silently due to the fact
that no IP address exists, thus the DNSBL.
--
View this message in context: http://www.nabble.com/So-you-wanted-to-firewall-your-mail-server...-tf3729493.html#a10439456
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: So you wanted to firewall your mail server...
Posted by Theo Van Dinter <fe...@apache.org>.
On Fri, May 11, 2007 at 01:34:06PM -0700, Ernie Dunbar wrote:
> Of course, hosts like 190.57.78.66.bl.spamcop.net are DNSBL blacklist
> members, and they resolve to nothing at all, which is why there is no route
> to host. But why is spamd suddenly spewing these errors now? It didn't do
> this before the firewall was in place.
You weren't blocking the requests before?
--
Randomly Selected Tagline:
"J: Do YOU know who the Spin Doctors are?
P: Maybe your mother does..." - John West and a Pizza Delivery Guy
Re: So you wanted to firewall your mail server...
Posted by Ernie Dunbar <er...@lightspeed.ca>.
Daryl C. W. O wrote:
>
> Ernie Dunbar wrote:
>>
>>
>> Ken A wrote:
>>>> May 11 12:00:09 pop spamd[47940]: dns: sendto() failed: No route to
>>>> host
>>>> Host: 190.57.78.66.bl.spamcop.net. at
>>>> /usr/local/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/DnsResolver.pm
>>>> line
>>>> 340, <GEN1444> line 137.
>
>> It might be a good idea to change DnsResolver.pm to make this error
>> message
>> clearer. I've googled this error message and other people are similarly
>> confused. "DNS lookup failed" would be a good one.
>
> You want the reason why it failed, "No route to host", to be replaced
> with a generic "it didn't work" message. You sure about that?
>
>
I actually meant replace the generic "DNS: sendto() failed:" with "DNS
lookup failed:", or "DNS server request failed:". Saying "sendto() failed"
is only useful to people who have been working with the code a while. Also,
saying "no route to host $thehostItried" would have been immensely helpful
since it would actually come out and *tell* the sysadmin which host there is
no route to, but I expect that's an entirely different bit of code or even
another program entirely that's coming up with that error.
--
View this message in context: http://www.nabble.com/So-you-wanted-to-firewall-your-mail-server...-tf3729493.html#a10440500
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: So you wanted to firewall your mail server...
Posted by "Daryl C. W. O'Shea" <sp...@dostech.ca>.
Ernie Dunbar wrote:
>
>
> Ken A wrote:
>>> May 11 12:00:09 pop spamd[47940]: dns: sendto() failed: No route to host
>>> Host: 190.57.78.66.bl.spamcop.net. at
>>> /usr/local/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/DnsResolver.pm
>>> line
>>> 340, <GEN1444> line 137.
> It might be a good idea to change DnsResolver.pm to make this error message
> clearer. I've googled this error message and other people are similarly
> confused. "DNS lookup failed" would be a good one.
You want the reason why it failed, "No route to host", to be replaced
with a generic "it didn't work" message. You sure about that?
Daryl
Re: So you wanted to firewall your mail server...
Posted by Ernie Dunbar <er...@lightspeed.ca>.
Ken A wrote:
>
>> May 11 12:00:09 pop spamd[47940]: dns: sendto() failed: No route to host
>> Host: 190.57.78.66.bl.spamcop.net. at
>> /usr/local/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/DnsResolver.pm
>> line
>> 340, <GEN1444> line 137.
>>
>> Of course, hosts like 190.57.78.66.bl.spamcop.net are DNSBL blacklist
>> members, and they resolve to nothing at all, which is why there is no
>> route
>> to host. But why is spamd suddenly spewing these errors now? It didn't do
>> this before the firewall was in place.
>
> They don't resolve to nothing at all. The response from the DNS server
> is usually NXDOMAIN, not 'no route to host'; you get _that_ when you
> block the connection to the dns server you are using.
>
> --
> Ken Anderson
> Pacific.Net
>
>
Ah. So it meant that there was no route to host when it tried to connect to
our primary nameserver. And that the firewall must have been blocking said
connections. Like firewalls tend to do when an internal IP address tries to
access another internal host by its public IP address.
I updated /etc/resolv.conf and all is well again. Your post was most
enlightening. :)
It might be a good idea to change DnsResolver.pm to make this error message
clearer. I've googled this error message and other people are similarly
confused. "DNS lookup failed" would be a good one.
--
View this message in context: http://www.nabble.com/So-you-wanted-to-firewall-your-mail-server...-tf3729493.html#a10439995
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: So you wanted to firewall your mail server...
Posted by Ken A <ka...@pacific.net>.
Ernie Dunbar wrote:
> We just put our mailserver (with SpamAssassin of course) behind a firewall,
> and now we get many many interesting error messages from spamd telling me
> that there's no route to some host or other. I tweaked the DnsResolver.pm
> module to show what host it was trying to route to, and I got this output:
>
> May 11 12:00:09 pop spamd[47940]: dns: sendto() failed: No route to host
> Host: clickboothlnk.com at
> /usr/local/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/DnsResolver.pm line
> 340, <GEN1444> line 137.
> May 11 12:00:09 pop spamd[47940]: dns: sendto() failed: No route to host
> Host: mktexpertise.net.multi.uribl.com. at
> /usr/local/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/DnsResolver.pm line
> 340, <GEN1444> line 137.
> May 11 12:00:09 pop spamd[47940]: dns: sendto() failed: No route to host
> Host: 190.57.78.66.combined.njabl.org. at
> /usr/local/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/DnsResolver.pm line
> 340, <GEN1444> line 137.
> May 11 12:00:09 pop spamd[47940]: dns: sendto() failed: No route to host
> Host: 190.57.78.66.bl.spamcop.net. at
> /usr/local/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/DnsResolver.pm line
> 340, <GEN1444> line 137.
>
> Of course, hosts like 190.57.78.66.bl.spamcop.net are DNSBL blacklist
> members, and they resolve to nothing at all, which is why there is no route
> to host. But why is spamd suddenly spewing these errors now? It didn't do
> this before the firewall was in place.
They don't resolve to nothing at all. The response from the DNS server
is usually NXDOMAIN, not 'no route to host'; you get _that_ when you
block the connection to the dns server you are using.
--
Ken Anderson
Pacific.Net