Print Page | Close Window

Whitelist issue

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111
Printed Date: 14 March 2025 at 3:59am


Topic: Whitelist issue
Posted By: corymckee
Subject: Whitelist issue
Date Posted: 18 June 2007 at 7:19pm

We have 5 domains whitelisted. While reviewing the logs (as email to these domains are not getting through), I found the following.

06/18/07 15:49:57:336 -- (7412) Bypassed all rules for: mailto:email@ourdomain.com - email@ourdomain.com from mailto:email@trusteddomain.com - email@trusteddomain.com ( Whitelisted Email From Domain)
06/18/07 15:49:57:806 -- (7412) Disconnect

I am assuming that (7412) is the messge id.

For now we have removed them from the white list.

Please advise.


Replies:
Posted By: LogSat
Date Posted: 18 June 2007 at 8:21pm
corymckee,

Are you sure those connections are not some kind of "probe" by the "trusteddomain.com" mail server that is checking to see if the user "email@ourdomain.com" is valid?
The entry:
Bypassed all rules for: mailto:email@ourdomain.com - email@ourdomain.com from mailto:email@trusteddomain.com - email@trusteddomain.com ( Whitelisted Email From Domain)

should indicate that SpamFilter has accepted both the MAIL FROM and the RCPT TO addresses. I say "should" as without seing the previous log entries we can't be 100%. The log entries related to this SMTP transaction will all have the same "thread ID", which is (7412).

From the log we see that the remote server simply disconnected after sending the RCPT TO command, which is indicative of a test of some sort from them.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: corymckee
Date Posted: 18 June 2007 at 10:24pm

I have confirmed that the messages that are not being sent are legitimate emails. The sending domain cannot send any email to us. I have to remove them from the whitelist to get email through.

Posted By: LogSat
Date Posted: 18 June 2007 at 11:26pm
This is very strange indeed. Probably the best way to find out what is happening is to perform a trace of the SMTP session with the remote host, if possible, under the two conditions (whitelisted / not whitelisted).

SpamFilter can do that by going to the "Settings - Debug View" tab. In there, if you enter the IP of the remote host and check the "Enable Debug Monitor" box, SpamFilter will show a trace of the SMTP traffic on the next connections.

If you could either post or email us those results we can try to figure ourt what is happening.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: corymckee
Date Posted: 19 June 2007 at 12:54pm

I will try to do this, but it is a major vendor and I do not know if we can work with anyone on thier team to get it resolved. I can not seem to reporduce the problem with other whitelisted domains after some tests last night.

I will let you know if I am able to work directly with the vendor on this.

Posted By: corymckee
Date Posted: 20 June 2007 at 12:53pm

It turns out that this is still a problem. It has nothing to do with the vendor being whitelisted. It continues to happen regardless.

I ran a debug and I will email you the results. I am trying to collect more as well.

Posted By: LogSat
Date Posted: 21 June 2007 at 4:32pm
The issue was caused by Cisco's MailGuard on the firewall. Disabling MailGuard solved the problem.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: BigTex71
Date Posted: 25 June 2007 at 5:07pm
Was the mailguard located on the senders side or the recipients side? 

I have a very similar situation where mail from one domain disconnects before finishing the message.  The senders get a delivery failure report stating that the server lost connection while sending end of data.  In troubleshooting the issue, I have found that the senders have recently added a Tumbleweed MailGate to their environment. 

I'm running the current version of spamfilter and have tested it with the last 2.x version, as well as moving the spamfilter to an alternate machine.  Debug shows this:

>>EHLO plamg01.senderdomain.com
<<250-8BITMIME
<<250-SIZE 12800000
<<250 HELP
>>MAIL FROM:<Bill_Miller@senderdomain.Com> SIZE=4424
<<250  Address Okay
>>RCPT TO:<cdaunis@ourdomain.com>
<<250 cdaunis@ourdomain.com Address Okay
>>DATA
<<354 Start mail input; end with <CRLF>.<CRLF>
>>EHLO plamg01.senderdomain.com
<<250-8BITMIME
<<250-SIZE 12800000
<<250 HELP
>>MAIL FROM:<Bill_Miller@senderdomain.Com> SIZE=4424
<<250  Address Okay
>>RCPT TO:<cdaunis@ourdomain.com>
<<250 cdaunis@ourdomain.com Address Okay
>>DATA
<<354 Start mail input; end with <CRLF>.<CRLF>

Any help would be appreciated.
Richard

Posted By: LogSat
Date Posted: 26 June 2007 at 8:19am
Richard,

MailGuard was on the recipient side (the customer running SpamFilter). Please also note that SpamFilter has a built-in timeout that will disconnect remote clients if they remain connected for too long. This *could* cause a problem for connections with very slow links. You will see this happening in the logs however, as the disconnect will occur several minutes (20 by default) after the connection is established.

This timeout can be changed by editing the following line in the SpamFilter.ini file (no restart of SpamFilter is necessary):

;Force disconnect of sessions after they have remained connected for this long
IdleDisconnectMinutesTimeout=20




-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: BigTex71
Date Posted: 27 June 2007 at 11:58am
Thank you Roberto, but it doesn't appear to be a timeout issue.  I'm seeing this in the activity log and it shows disconnect about a second after the last command.

06/26/07 12:24:16:960 -- (1816) Connection from: 12.13.14.15  -  Originating country : United States
06/26/07 12:24:17:195 -- (1816) Mail from: Lonnie_Leger@senderdomain.Com
06/26/07 12:24:17:867 -- (1816) - MAPS search done...
06/26/07 12:24:17:867 -- (1816) RCPT TO: cdaunis@ourdomain.com accepted
06/26/07 12:24:18:914 -- (1816) Disconnect

I just tried editing the .ini file to disable EHLO extensions, but ended up with the same disconnect result. 

I'm not 100% sure, but I think I was able to receive the whole message properly once when I accidentally had their mail going to quarantine.  I'll manually blacklist them again and see if the messages actually do get completed and sent to quarantine.

Posted By: corymckee
Date Posted: 27 June 2007 at 12:56pm
Exact same problem we had. Do you have mailguard (or similar) enabled on your firewall?

Posted By: BigTex71
Date Posted: 27 June 2007 at 1:11pm
No, I have a Sonicwall in front of my spamfilter box.  Its port forwarding SMTP traffic through to the NAT IP address of spamfilter.  No other sending domains have this issue and mail works flawlessly otherwise. I'll take another look through the sonicwall, but I know there isn't any mail filtering enabled directly on it.

Thanks for the reply.

Posted By: LogSat
Date Posted: 27 June 2007 at 4:23pm
It is an odd coincidence. The symptoms are very similar to the ones corymckee was having with MailGuard. There is an SMTP session established, and right when the remote server is about or has just started to send the email body itself, the connection is being dropped.

Any chance you can place a network sniffer on the network, or install either Ethereal or Microsoft's network Monitor on the SpamFilter server to capture traffic to/from the remote server so we can better see what is happening?


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Print Page | Close Window