Spam Filter ISP Support - EHLO or Exchange Server problems?

EHLO or Exchange Server problems?

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5033
Printed Date: 15 January 2025 at 9:44am

Topic: EHLO or Exchange Server problems?

Posted By: Guests
Subject: EHLO or Exchange Server problems?
Date Posted: 28 January 2005 at 6:27am

We have a problem with one site trying to mail us.

We can mail them, they can mail yahoo but they can't mail us through our external mail servers running Spamfilter.

in the logs, the two servers connect but then wait for a minute and timeout with no message sent.

I notice their server starts with an EHLO which maybe causing the problem, so we tried setting the EHLO options off in Spamfilter's ini file... this made no difference.

we happily receive mail from all other servers (touch wood), so wondered if this was a config problem at the other server's end... perhaps authentication/ EHLO related on their Exchange Server.

We also run Exchange but have never seen these problems going to other sites.

01/27/05 00:07:35:016 -- (748) Resolving 193.195.87.117 - evosexch.evos.net
01/27/05 00:07:35:016 -- (748) evos.net is a domain, searching for SPF record
01/27/05 00:07:35:032 -- (748) - SPF analysis for evos.net done: - none
01/27/05 00:07:35:032 -- (748) Mail from: xxx@evos.net
01/27/05 00:07:35:641 -- (748) - MAPS search done...
01/27/05 00:07:35:641 -- (748) RCPT TO: xxx@livjm.ac.uk accepted
t
01/27/05 00:08:35:673 -- (748) Disconnect

Replies:

Posted By: LogSat
Date Posted: 28 January 2005 at 10:13pm

Martin,

The disconnect most likely happens because SpamFilter has a 60 second timeout where, if not a single byte of data has been received for 60 seconds, the session is disconnected.

The good news is that this value can be changed (by modifying the ReadTimeout value in SpamFilter.ini file), the bad is that there may be a deeper problem.

We've run into the following scenario with some users:

The company had an antivirus/firewall in front of SpamFilter that intercepted emails before they reached SpamFilter. If a remote user either sent an email with a large attachment or had a slow connection, the firewall would hold/scan the email for a long time (> 60 seconds) before passing it onto SpamFilter. SpamFilter would thus disconnect the firewall before receiving the email. This issue was easily fixed by increasing the timout value.

Another issue I've seen was with the Internet Mail Connector in Exchange 5.5. We saw an install of Exchange 5.5 that had a bug in that it would not send the correct end-of-email sequence. All emails are terminated with the sequence (a dot on a standalone line):

in Hex characters this is $0D $0A $2E $0D $0A.

Exchange server would occasionally corrupt that sequence by replacing a 0D with a 00:

$0D $0A $2E $00 $0A

Since the end of email sequence was incorrect, SpamFilter (and other applications...) kept on waiting for the correct sequence, which Exchange never provided, and thus all sorts of problems were occurring. Unfortunately we do not know if the bug was ever fixed, as Exchange was upgraded to 2000 and the problem disappeared.

Please let me know if any of these thoughts are of any help.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP