5.3.3 Unrecognized command message |
Post Reply 
|
| Author | |
Michael Magill 
Guest Group 
|
 Post Options
 Thanks(0)
 Quote Reply
 Topic: 5.3.3 Unrecognized command messagePosted: 05 June 2003 at 12:17pm |
|
Below are pieces of our logs (with email addresses changed). Most mail goes through fine. A few, like these, give a 5.3.3 unrecognized command error but appear to be delivered anyway. I do no know if a NDR is being sent to the sender. We are running SpamFilter v1.1.2.124 on Win2K behind a Cisco Pix506E hardware firewall with SMTP fixup enabled on the PIX. Should I be worried about these logged errors? Are there common SMTP commands that are not implemented by SpamFilter? 06/05/03 09:17:41:656 -- (1496) Connection from: 138.162.0.41 - Originating country : United States
06/05/03 09:17:41:875 -- (1496) Resolving 138.162.0.41 - gate2-norfolk.nmci.navy.mil
06/05/03 09:17:41:875 -- (1496) Mail from: abc.defghij@navy.mil
06/05/03 09:17:47:390 -- (1496) - MAPS search done... .
06/05/03 09:17:47:390 -- (1496) RCPT TO: abcd@abcd.org accepted
06/05/03 09:17:47:609 -- (1496) EMail from abc.defghij@navy.mil to abcd@abcd.org was queued. Size: 25 KB
06/05/03 09:17:47:609 -- (432) Sending email from abc.defghij@navy.mil to abcd@abcd.org
06/05/03 09:17:47:625 -- (1496) Disconnect
06/05/03 09:17:47:953 -- (432) EMail from: abc.defghij@navy.mil to: abcd@abcd.org was returned to sender - server error - 5.3.3 Unrecognized command
06/05/03 09:17:48:109 -- (432) Error-email from abc.defghij@navy.mil to abcd@abcd.org was forwarded to mail.abcd.org
--------and--------
06/05/03 07:45:20:921 -- (1448) Connection from: 129.33.230.138 - Originating country : United States
06/05/03 07:45:21:031 -- (1448) Resolving 129.33.230.138 - cmn1lsm4.beliefnet.com
06/05/03 07:45:21:031 -- (1448) Mail from: owner-nolist-6503*abcd**abcd*-ORG@LISTSERV.BELIEFNET.COM
06/05/03 07:45:21:609 -- (1448) - MAPS search done... .
06/05/03 07:45:21:609 -- (1448) RCPT TO: abcd@abcd.ORG accepted
06/05/03 07:45:21:812 -- (1448) EMail from owner-nolist-6503*abcd**abcd*-ORG@LISTSERV.BELIEFNET.COM to abcd@ASYMCA.ORG was queued. Size: 24 KB
06/05/03 07:45:21:812 -- (1340) Sending email from BeliefnetDailyInspiration@partner.beliefnet.com to abcd@abcd.ORG
06/05/03 07:45:22:171 -- (1340) EMail from: BeliefnetDailyInspiration@partner.beliefnet.com to: abcd@abcd.ORG was returned to sender - server error - 5.3.3 Unrecognized command
06/05/03 07:45:22:328 -- (1340) Error-email from BeliefnetDailyInspiration@partner.beliefnet.com to abcd@abcd.ORG was forwarded to mail.abcd.org
06/05/03 07:45:22:515 -- (1448) Disconnect
|
|
 |
|
|
LogSat
Admin Group 
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 05 June 2003 at 1:03pm |
|
Michael, The following log entries: 06/05/03 09:17:47:953 -- (432) EMail from: abc.defghij@navy.mil to: abcd@abcd.org was returned to sender - server error - 5.3.3 Unrecognized command actually mean the following. SpamFilter received an emai from navy.mil to abcd.org. It then forwarded it to your destination SMTP server. While talking to your destination smtp server, SpamFilter received a 5.3.3 Unrecognized command. What follow the -server error - is the error message returned by the destination smtp server. "Mailbox not found" or "Mailbox is full" or "User does not exist" are the common errors the destination SMTP server usually returns. The "unrecognized command" is unusual. Keeping in mind that it's not SpamFilter not recognizing a command, but rather the dest. server, are there any logs on your destination smtp that can give an idea of what kind of command it received? When forwarding email to the dest server, SpamFilter will 1st try to send an EHLO command, if it's not supported, it reverts down to a HELO command. After that is accepted it issues a RSET command, then the MAIL FROM and then the RCPT TO. Nothing out of the ordinary... Roberto Franceschetti
|
|
|
|
|
Michael Magill
Guest Group
|
Post Options
Thanks(0)
Quote Reply
Posted: 05 June 2003 at 3:03pm |
|
Plenty of email goes to those addresses as well as others on that server without a problem. Here is the layout between the two servers:SpamFilter <-> Pix506E(w/SMTP fixup) <-> Internet
Internet <-> MS ISA Server (using SMTP application filter) <-> Exchange 2000It seems like the most likely problem would be on the ISA server, do you agree? That is the error returned by ISA server's SMTP filter if you use a command it does not specify. Here are the commands it is allowing:
AUTH
BDAT
DATA
EHLO
EXPN
HELO
HELP
MAIL FROM:
NOOP
QUIT
RCPT TO:
RSET
SAML FROM:
SEND FROM:
SOML FROM:
TURN
VRFYThe only change we made to this list was to add the AUTH command, otherwise it is the default list. Is there something you recognize as missing?Does it make sense that the email was delivered despite the log saying it was returned to sender?
|
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 05 June 2003 at 3:18pm |
|
Yes, it would appear that ISA is where the problem could be since that is where the error is coming from. I do not want to exclude an issue with SpamFilter yet though, it's too easy to blame others... If you can modify the spamfilter.ini file by adding the following line right under the [Server Settings] section: EnableBadMailDir=1 and restart SpamFilter, this will cause a copy of the email that triggeres any kind of remote "server error" to be placed into a "badmail" directory. This way we'll be able to see the actual email and its recipients that SpamFilter is forwarding to ISA. Once the error reoccurs, if you can forward it to us we can take a look. I did not see anything wrong with the list of ISA-supported commands. What I find very strange is that most emails go thru fine... Roberto Franceschetti |
|
|
|
|
Michael Magill
Guest Group
|
Post Options
Thanks(0)
Quote Reply
Posted: 05 June 2003 at 5:39pm |
|
I have done that and will let you know what I find. Thank you for the quick response!
|
|
|
|
|
Michael Magill
Guest Group
|
Post Options
Thanks(0)
Quote Reply
Posted: 10 June 2003 at 9:37am |
|
Over the past 5 days the badmail folder no has 7 emails (14 files). Let me know what files you would like to see from that folder.
|
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 10 June 2003 at 11:30am |
|
If you check the activity log for when the 5.3.3 Unrecognized command occurs, we'll need the files in tha badmail directory which have the same timestamp as the log entry (plus or minus a few minutes I guess). Or since there are only 14, you could zip them (so that the timestamp is maintained) and email them to us, including the SpamFilter logs that show the entries with the 5.3.3 error. Roberto Franceschetti |
|
|
|
|
Michael Magill
Guest Group
|
Post Options
Thanks(0)
Quote Reply
Posted: 10 June 2003 at 11:57am |
|
What email addres should I send it to?
|
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 10 June 2003 at 12:01pm |
|
Roberto F. |
|
|
|
Topic Options|
Post Reply
|
|
Tweet
|
| Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |
This page was generated in 0.094 seconds.