Print Page | Close Window

5.3.3 Unrecognized command message

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=812
Printed Date: 26 December 2024 at 6:09pm


Topic: 5.3.3 Unrecognized command message
Posted By: Guests
Subject: 5.3.3 Unrecognized command message
Date Posted: 05 June 2003 at 12:17pm
Below are pieces of our logs (with email addresses changed). Most mail goes through fine. A few, like these, give a 5.3.3 unrecognized command error but appear to be delivered anyway. I do no know if a NDR is being sent to the sender. We are running SpamFilter v1.1.2.124 on Win2K behind a Cisco Pix506E hardware firewall with SMTP fixup enabled on the PIX. Should I be worried about these logged errors? Are there common SMTP commands that are not implemented by SpamFilter?

06/05/03 09:17:41:656 -- (1496) Connection from: 138.162.0.41 - Originating country : United States 06/05/03 09:17:41:875 -- (1496) Resolving 138.162.0.41 - gate2-norfolk.nmci.navy.mil 06/05/03 09:17:41:875 -- (1496) Mail from: abc.defghij@navy.mil 06/05/03 09:17:47:390 -- (1496) - MAPS search done... . 06/05/03 09:17:47:390 -- (1496) RCPT TO: abcd@abcd.org accepted 06/05/03 09:17:47:609 -- (1496) EMail from abc.defghij@navy.mil to abcd@abcd.org was queued. Size: 25 KB 06/05/03 09:17:47:609 -- (432) Sending email from abc.defghij@navy.mil to abcd@abcd.org 06/05/03 09:17:47:625 -- (1496) Disconnect 06/05/03 09:17:47:953 -- (432) EMail from: abc.defghij@navy.mil to: abcd@abcd.org was returned to sender - server error - 5.3.3 Unrecognized command 06/05/03 09:17:48:109 -- (432) Error-email from abc.defghij@navy.mil to abcd@abcd.org was forwarded to mail.abcd.org

--------and--------

06/05/03 07:45:20:921 -- (1448) Connection from: 129.33.230.138 - Originating country : United States 06/05/03 07:45:21:031 -- (1448) Resolving 129.33.230.138 - cmn1lsm4.beliefnet.com 06/05/03 07:45:21:031 -- (1448) Mail from: owner-nolist-6503*abcd**abcd*-ORG@LISTSERV.BELIEFNET.COM 06/05/03 07:45:21:609 -- (1448) - MAPS search done... . 06/05/03 07:45:21:609 -- (1448) RCPT TO: abcd@abcd.ORG accepted 06/05/03 07:45:21:812 -- (1448) EMail from owner-nolist-6503*abcd**abcd*-ORG@LISTSERV.BELIEFNET.COM to abcd@ASYMCA.ORG was queued. Size: 24 KB 06/05/03 07:45:21:812 -- (1340) Sending email from BeliefnetDailyInspiration@partner.beliefnet.com to abcd@abcd.ORG 06/05/03 07:45:22:171 -- (1340) EMail from: BeliefnetDailyInspiration@partner.beliefnet.com to: abcd@abcd.ORG was returned to sender - server error - 5.3.3 Unrecognized command 06/05/03 07:45:22:328 -- (1340) Error-email from BeliefnetDailyInspiration@partner.beliefnet.com to abcd@abcd.ORG was forwarded to mail.abcd.org 06/05/03 07:45:22:515 -- (1448) Disconnect


Replies:
Posted By: LogSat
Date Posted: 05 June 2003 at 1:03pm

Michael,

The following log entries:

06/05/03 09:17:47:953 -- (432) EMail from: mailto:abc.defghij@navy.mil" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - abc.defghij@navy.mil to: mailto:abcd@abcd.org" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - abcd@abcd.org   was returned to sender - server error - 5.3.3 Unrecognized command

actually mean the following. SpamFilter received an emai from navy.mil to abcd.org. It then forwarded it to your destination SMTP server. While talking to your destination smtp server, SpamFilter received a 5.3.3 Unrecognized command. What follow the -server error -  is the error message returned by the destination smtp server.

"Mailbox not found" or "Mailbox is full" or "User does not exist" are the common errors the destination SMTP server usually returns. The "unrecognized command" is unusual.

Keeping in mind that it's not SpamFilter not recognizing a command, but rather the dest. server, are there any logs on your destination smtp that can give an idea of what kind of command it received? When forwarding email to the dest server, SpamFilter will 1st try to send an EHLO command, if it's not supported, it reverts down to a HELO command. After that is accepted it issues a RSET command, then the MAIL FROM and then the RCPT TO. Nothing out of the ordinary...

Roberto Franceschetti
LogSat Software

 

Posted By: Guests
Date Posted: 05 June 2003 at 3:03pm
Plenty of email goes to those addresses as well as others on that server without a problem. Here is the layout between the two servers:

SpamFilter <-> Pix506E(w/SMTP fixup) <-> Internet Internet <-> MS ISA Server (using SMTP application filter) <-> Exchange 2000

It seems like the most likely problem would be on the ISA server, do you agree? That is the error returned by ISA server's SMTP filter if you use a command it does not specify. Here are the commands it is allowing: AUTH BDAT DATA EHLO EXPN HELO HELP MAIL FROM: NOOP QUIT RCPT TO: RSET SAML FROM: SEND FROM: SOML FROM: TURN VRFY

The only change we made to this list was to add the AUTH command, otherwise it is the default list. Is there something you recognize as missing?

Does it make sense that the email was delivered despite the log saying it was returned to sender?

Posted By: LogSat
Date Posted: 05 June 2003 at 3:18pm

Yes, it would appear that ISA is where the problem could be since that is where the error is coming from. I do not want to exclude an issue with SpamFilter yet though, it's too easy to blame others...

If you can modify the spamfilter.ini file by adding the following line right under the [Server Settings] section:

EnableBadMailDir=1

and restart SpamFilter, this will cause a copy of the email that triggeres any kind of remote "server error" to be placed into a "badmail" directory.

This way we'll be able to see the actual email and its recipients that SpamFilter is forwarding to ISA. Once the error reoccurs, if you can forward it to us we can take a look.

I did not see anything wrong with the list of ISA-supported commands. What I find very strange is that most emails go thru fine...

Roberto Franceschetti
LogSat Software

Posted By: Guests
Date Posted: 05 June 2003 at 5:39pm
I have done that and will let you know what I find.  Thank you for the quick response!

Posted By: Guests
Date Posted: 10 June 2003 at 9:37am
Over the past 5 days the badmail folder no has 7 emails (14 files). Let me know what files you would like to see from that folder.

Posted By: LogSat
Date Posted: 10 June 2003 at 11:30am

If you check the activity log for when the 5.3.3 Unrecognized command  occurs, we'll need the files in tha badmail directory which have the same timestamp as the log entry (plus or minus a few minutes I guess).

Or since there are only 14, you could zip them (so that the timestamp is maintained) and email them to us, including the SpamFilter logs that show the entries with the 5.3.3 error.

Roberto Franceschetti
LogSat Software

Posted By: Guests
Date Posted: 10 June 2003 at 11:57am
What email addres should I send it to?

Posted By: LogSat
Date Posted: 10 June 2003 at 12:01pm

mailto:support@logsat.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - support@logsat.com

Roberto F.
LogSat Software


Print Page | Close Window