Print Page | Close Window

Open relay testing

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=233
Printed Date: 27 December 2024 at 4:29am


Topic: Open relay testing
Posted By: Guests
Subject: Open relay testing
Date Posted: 10 April 2003 at 2:25pm

I am performing open relay testing on my server. I am using a telnet session to port 25 on my server and entering commands manually. I have found that entering a non-local RCPT TO does not generate a "550 Relaying is prohibited" message -- it responds with an OK. Also, here is what the log shows:

04/10/03 12:13:03:078 -- (565) Bypassed all rules for: mailto:somebody@somewhere.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - somebody@somewhere.com from mailto:whoever@whoever.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - whoever@whoever.com
04/10/03 12:13:16:796 -- (565) EMail from  to mailto:somebody@somewhere.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - somebody@somewhere.com was queued. Size: 1 KB
04/10/03 12:13:16:812 -- (177) Sending email from  to mailto:somebody@somewhere.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - somebody@somewhere.com
04/10/03 12:13:16:968 -- (177) server error - Relaying is prohibited
04/10/03 12:13:31:265 -- (565) Disconnect

I am wondering about the "Bypassed all rules for" message for a non-local address, and why SpamFilter doesn't immediately generate a relay error after a non-local RCPT TO.


Replies:
Posted By: LogSat
Date Posted: 10 April 2003 at 6:52pm

Bill,

The log entry shows a "Bypassed all rules for: ". This usually means one of four things:

  • The IP address you are testing from is listed in the "Excluded Domains/IPs" white list.
  • The "From" domain is listed in the above white list
  • The "From" email address is listed in the "Excluded FROM EMails" white list
  • The RCPT TO address you are testing with is listed in the "Unfiltered Emails" white list.

If neither of these four are true, if you can then email us the full copy of the log containing the reject (with IPs and emails) along with your SpamFilter.ini file we'll take a look

Roberto Franceschetti
LogSat Software

Posted By: Guests
Date Posted: 11 April 2003 at 11:04am

In my case, none of the four conditions appears to be true.

I sent you an e-mail containing a zipped copy of the log file and the .ini file.

Thanks for checking into this for me.

Posted By: LogSat
Date Posted: 12 April 2003 at 10:01am

Bill,

I think the mistery is solved...

From your log we saw that the IP starting the connection is is the IP SpamFilter is listening on! That one is trusted by default, so it's able to send anything it wants... You'll need to run your anti-relay tests from a box other than the one SpamFilter is installed on :-)

Roberto F.
LogSat Software


Print Page | Close Window