Print Page | Close Window

Mail gets lost and fallback

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6576
Printed Date: 27 December 2024 at 12:57pm


Topic: Mail gets lost and fallback
Posted By: Bart
Subject: Mail gets lost and fallback
Date Posted: 04 November 2008 at 4:25pm

i've got a problem with some attachements.

 

When someone mails me i can see the mail ariving at the server running spamfilterISP but it never gets into my mailbox.

mails without an attachement are delivered without a problem.

 

I tried the debug option but i can't see something wrong.

 

>>EHLO mx2.elka.nl

<<250-8BITMIME

<<250 HELP

>>MAIL FROM:<tns@elka.nl>

<<250 Address Okay

>>RCPT TO:<bart@tns-online.nl>

<<250 bart@tns-online.nl Address Okay

>>DATA

<<354 Start mail input; end with <CRLF>.<CRLF>

>>Received: from 10.200.0.11 ([10.200.0.11]) by iis1dmz.elka.local ([10.0.0.20]) with Microsoft Exchange Server HTTP-DAV ;

>>-face

>>yle=3D=

>>ramE>de</SPAN> register informaticus de heer=

>>7yC0acsDUMAQD/2PU0LN4OAMEuWX

>>90o0Wt2rHncSq50mYPiVdwcl0WcQtcLRgMpveuye47l+JWjf3ZL3TzceoQ

>>dsofV4hNLHRk+f0+7nDb0XeNNdEWa5rNPM

>>KnyedkNnvbfI2EKXNzHhq+2OMPji+i5+BrFU9jotxbK190CtpczMd31M2ZUpbIg871nt4FnaO9JX

>>4deY4WIHxwinNukGKxur/e/OQdqr

>>0bCS8Fxhf6DSFCD5tmGnTAWXSZ/kUCuNoElr3kUBMwXt1x5Te9zFu8xKu3

>>Y5aWkMjehn

>>dyeb

 
I cut a lot of lines

>>16wD63PrDfWw9Abf9+y77QYfF3l82J4ZhY

>>7i8EnBhzShRjdJcY7enwTcBLsHNu9Wr7PJ+SMz1urKoTW/XqDsLLOIvNqEux5dKY

>>gGmbYYVYFTsx4vyenGjrRSVvlbbX

>>2TpWFW9bOstCrcI2ND3uaEh/ES8t5sLstakQCOoBhEBSiODEbHaKMmeq1U

>>YoK8UApRJt

>>Yx8V7KvUMGxlb9BtVACXNbdcr0PL3YqTeivsZoud

>>Jib3V3aW5nX2dlZHJhZ19Wb3MtV2l0bWVyXzI0MTAyMDA4IF80Xy5wZGZQSwECFAAUAAIA

<<250 Ok

>>QUIT

<<221 Signing Off
Looks to me that mails is deliverd normaly but i don't recieve it.
This is the third time this problem came up, once with about 10 documents attached to the message, once with a zip archive of 3 MB and thistime it only was 2 MB
The zip archive contains only .doc, .xls and .pdf files without virus or macro
How can i determine where the mail had gone ????
 
 
 
Question 2
We have a registered enterprise version of spamfilterISP
the server is running fine but there is a lot of spam comming in thru our fallback server. Whats the best way to solve this ? i only have 1 license but need 2 servers in case my primary server fails.
 
Tnx


Replies:
Posted By: LogSat
Date Posted: 04 November 2008 at 4:37pm
Bart,

If you can please zip and email us at support at logsat.com your SpamFilter's activity file for the day the above email was received, we'll try to see what's going on. The "250 OK" at the end usually indicates the email was received successfully by SpamFilter and should be forwarded to your mail server, however the "send to NULL" or "NO NDR" options that can be enabled (they are always off by default) do cause spam emails to be received and then dropped immediately, without providing indication to the sender that they were not delivered (that behavior is discouraged, which is why the options to do so are disabled by default).
If the file is over 5MB I will send you a PM with our FTP upload login info.

In regards to the backup server question, please see our reply to a similar forum question earlier today:
http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6575#12466
%20 - %20 - %20 -

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Bart
Date Posted: 06 November 2008 at 6:49am
i can send you the file if you want, no problem.
 
11-04-08 20:30:22:671 -- (384) Received MAIL FROM: <XXX mailto:XXX@exxxa.nl - @exxxa.nl >
11-04-08 20:30:22:703 -- (384) Received RCPT TO: xxx mailto:xxx@tnxxxxxxxxx.nl - @tnxxxxxxxxx.nl
11-04-08 20:30:23:125 -- (384) - SPF analysis for elka.nl done: - none
11-04-08 20:30:23:125 -- (384) Mail from: xxx mailto:xxx@exxxxa.nl - @exxxxa.nl
11-04-08 20:30:23:125 -- (384) - MAPS search done...
11-04-08 20:30:23:125 -- (384) RCPT TO: mailto:xxxx@tnxxxxxx.nl - xxxx@tnxxxxxx.nl accepted
11-04-08 20:30:29:375 -- (384) Bypassed all rules for: xxx mailto:xxx@tnxxxxxxx.nl - @tnxxxxxxx.nl from xxx mailto:XXX@exxxa.nl - @exxxa.nl (Whitelisted - Email size exceeded MaxMsgSizeForSpamFiltering)
11-04-08 20:30:29:875 -- (384) Start virus scan
11-04-08 20:30:30:156 -- (384) Starting queueing procedures
11-04-08 20:30:30:187 -- (384) EMail from xxx mailto:xxx@exxxxxxa.nl - @exxxxxxa.nl to mailto:xxxx@tnxxxxxx.nl - xxxx@tnxxxxxx.nl was queued. Size: 2866 KB, 2934784 bytes
11-04-08 20:30:30:218 -- (2568) Sending email from xxx mailto:xxx@exxxx.nl - @exxxx.nl to xxxxxx mailto:xxxxxx@tnxxxxxxxx.nl - @tnxxxxxxxx.nl --
 
These are the lines in the timeframe i retried to send the message, now i see there is a max size for Filtering and my guess is thats why the mail is dropped.
 
Where can i set the max Size ?? i'll setup  a bigger size and after that i'll try again, if the problem then is stil the same i'll send you that logfile.
 
Can you tell me where to setup the vualue for max size ? In the Interface the max email size is set to 0 (Disbled)
 
If you need information, please notify me.

Posted By: LogSat
Date Posted: 06 November 2008 at 5:29pm
Actually the email was not stopped at all, the message you see, "Whitelisted - Email size exceeded MaxMsgSizeForSpamFiltering", simply means that, since the email is over a certain minimum threshold size, most likely it is *not* spam, and thus it is being whitelisted for content and delivered.

The email is received successfully, and then SpamFilter asttempts to deliver it to your mail server. This is seen in the line:

1-04-08 20:30:30:218 -- (2568) Sending email from xxx@exxxx.nl to xxxxxx@tnxxxxxxxx.nl --

If you are not receiving it, it's possible that your mail server rejected it for some reason. You can verify by continuing looking at log entries below the above one, the relevant ones will have the ID (2568) in them, and will show if the forwarding attempt to your mail server was successful or resulted in an error.

In regards to the FTP, please note that the site is protected in that it allows you to upload files, but not download them. If you try to upload using Internet Explorer for example, rather than an real FTp client, your IE may cause an error as it will not be able to read the directory listing. If you can try to upload the file again using a regular FTp client (or command line) it should work.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Bart
Date Posted: 06 November 2008 at 6:48pm
i'm verry sorry to inform you that the problem wasn't spamfilterISP
 
sorry for your time, good thing is that i now know the 2568 Code so next time i search better myself and won't open a topic.
 
 

Posted By: 2CNL
Date Posted: 07 November 2008 at 2:50am
Bart, just out of interest. What caused the problem and what was the solution.
It always nice to follow up on a story. We can all learn ;)

Posted By: Bart
Date Posted: 07 November 2008 at 7:20am
while moving the server running spamfilterISP to another datacenter mail was rerouted thru another server, this server was configured to drop mail over 2MB and therefor mail never arived at my exchange server.
 
In the time we tested spamfilterISP mail was deliverd directly and there where no problems at all.
 
I removed the temporarly rerouting and everything works just fine.
 
I don't know how i could be so stupid to not think about that but i can't turn back time :)
 
 


Print Page | Close Window