invalid MX record anomoly
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5139
Printed Date: 13 March 2025 at 5:34pm
Topic: invalid MX record anomoly
Posted By: Guests
Subject: invalid MX record anomoly
Date Posted: 25 April 2005 at 4:17pm
|
I had a user forward an email to me today and was curious as to why it
was flagged as spam. It was sent from their personal account to
themselves and serveral of their colleagues at their workplace which is
the domain we host. Their personal email address is listed in our exclude from white list and all other emails that they sent bypassed all rules according to the logs, however this one didn't: 04/24/05 12:40:56:040 -- (4092) Connection from: 204.127.202.56 - Originating country : United States 04/24/05 12:40:56:370 -- (4092) Resolving 204.127.202.56 - sccrmhc12.comcast.net 04/24/05 12:40:56:681 -- (4092) Mail from: danielschwartz@comcast.net 04/24/05 12:40:58:193 -- (4092) - MAPS search done... 04/24/05 12:40:58:193 -- (4092) RCPT TO: dhaslam@rivr.com accepted 04/24/05 12:40:58:243 -- (4092) Bypassed all rules for: dschwartz@rivr.com from danielschwartz@comcast.net 04/24/05 12:40:58:343 -- (4092) - Invalid MX record - 04/24/05 12:40:58:343 -- (4092) 204.127.202.56 - Mail from: danielschwartz@comcast.net To: rlundgren@rivr.com will be spam-tagged 04/24/05 12:40:58:513 -- (4092) EMail from danielschwartz@comcast.net to dhaslam@rivr.com, dschwartz@rivr.com, rlundgren@rivr.com was queued. Size: 24 KB, 24576 bytes I'm assuming this may be because the invalid mx record may override any whitelisting....is that correct? I did some testing on dnsstuff.com to see if comcast may be having some issues with their dns records, because it's hard to believe they would have an invalid mx record...that's sort of like AOL coming back with an invalid mx record. Upon investigating, I discovered that dns01.jdc01.pa.comcast.net. [68.87.96.3] intermittently times out up to three times during the query before finally reporting back with forwarding the query to gateway-r.comcast.net. |
Replies:
Posted By: LogSat
Date Posted: 25 April 2005 at 10:50pm
|
Fred, What build of SpamFilter are you using? Usually if a sender is whitelisted, they should not be "spam-tagged". Have you tried using the latest 2.5 version to see if it solves the problem? ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: Guests
Date Posted: 25 April 2005 at 11:20pm
Yes, I'm using 2.5.1.441 |
LogSat wrote:Posted By: Dan B
Date Posted: 26 April 2005 at 3:24pm
|
R, I'm also seeing this happen when we have entries in the domains & email from in the whitelist. Here is an example. 04/26/05 05:36:30:452 -- (1052) Connection from: 66.94.237.43 - Originating country : United States
When I test it in the RegEx Test it works correctly with a "Found"
|
Posted By: Desperado
Date Posted: 26 April 2005 at 7:26pm
|
Dan, What is that space in the returns .groups.yahoo.com ? Is that just a typo or is it real? Regards, ------------- The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
Posted By: LogSat
Date Posted: 26 April 2005 at 10:34pm
Fred, This email was unusual in that it had three recipients, one of which was whitelisted, and it had, as you noticed, a failure of the MX record when performing a check for one of the recipients. The failure is also unusual, as DNS timeouts are not treated as errors, while in this instance the DNS server returned "something" that caused the MX record to mismatch. Without further information unfortunately it is goint to be hard to troubleshoot the situation. ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: LogSat
Date Posted: 26 April 2005 at 10:37pm
Dan B, As Dan S. correctly pointed out, there appears to be a (invalid) space in the email address after returns. Furthermore, there's two @ signs in there... Don't know if these are all typos or not, but if they are not, they would indeed cause the whitelisted entry to fail. ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: Dan B
Date Posted: 27 April 2005 at 11:51am
|
Sorry about the above... Here is the correct email from address: And here is an example that is being caught from the domain whitelist. Dan B |
Posted By: Dan B
Date Posted: 27 April 2005 at 12:35pm
|
Update from above.. I looked at todays logs and I'm now seeing the bypass going into effect. Even tho they were added Monday morning and both were in the SF dialog boxes. It took 48 hours to start working.. Something is very strange is going on. Dan B |
Posted By: Dan B
Date Posted: 27 April 2005 at 3:23pm
|
I do have another issue with this topic of thread. I'm seeing the rejection of Invalid MX DNS record for the following domain tchesc.org when in fact they do have a valid mx record. Here is a nslookup on the domain Non-authoritative answer: Thanks, |
Posted By: LogSat
Date Posted: 27 April 2005 at 4:30pm
|
Dan, The mailto:emailaddress@tchesc.org - tchesc.org domain looks good to us as well as far as the MX is concerned, and right now do not see a reason for it to fail the test as it did before (unless the MX record was invalid on the 25th and has been fixed since). We're preparing a new private build that hopefully should provide more details on what is wrong with the MX record when the test fails, we'll be making it available to you within 6/24 hours if you wish, after it passes some additional QA testing. ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: LogSat
Date Posted: 30 April 2005 at 5:43pm
|
Build 2.5.1.448 is available in the registered user area. It displays the additional logging mentioned above.
------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |