A MAPS search on a legitimate message resulted in this error:

- MAPS search done... relay tested -- 1058401211 .

So I went to abuse.net and tested the IP address which generates that error and all tests came back negative for relaying. Any ideas why a MAPS search would come up with that error?

Ashley,

The "Relay tested" error usually is reported by dnsbl.njabl.org and usually looks more like:

07/25/03 01:08:27:335 -- (2848) - MAPS search done... 521 5.1 The IP you are mailing from, (211.118.135.213) is Blacklisted by dnsbl.njabl.org.relay tested -- 1008051397 .

Are you using that list?  If so, going to abuse.org to look up the IP may not give any results.  You need to got to http://www.njabl.org/lookup.html" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.njabl.org/lookup.html" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.njabl.org/lookup.html  and type in the IP there and see what results you get. The results for my example above look like this:

211.118.135.213 is listed as an open relay.

The following comment is associated with this record: relay tested
It was added to the list: Tue Dec 11 01:16:37 2001 EST

'relay tested' means the system was tested by our automated system and found to be an open relay.

The following link to http://www.mail-abuse.org/tsi/ar-fix.html" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - mail-abuse.org's pointers on how to secure various types of mail servers may be helpful.

The X-RT-From and X-RT-To header fields, if present in our relay test message, indicate the SMTP envelope addresses for which your server was willing to relay.

click http://www.njabl.org/remove.html" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - here to request removal and retesting of this IP.
click http://www.openrbl.org/lookup.php?i=211.118.135.213" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - here to see if 211.118.135.213 is in other dnsbls.

I hope this helps.

Regards,

Dan S.

Ashley,

Each MAPS RBL server entry outputs it's own message. They often include their own name in the output making it easier to recognize. It does look like they did so in this case. To find out which entry in your list of MAPS servers caused that output you will have to go thru each one separately until you find the one that matches. Abuse.net will not necessarily show an IP listed by other lists. Please note that some MAPS lists can be very, very strict. There is one for example that lists IPs as positive just because they are not in the US...

Roberto Franceschetti
LogSat Software