Mail not sent from Spamfilter to my Imal Server
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6874
Printed Date: 28 December 2024 at 6:58pm
Topic: Mail not sent from Spamfilter to my Imal Server
Posted By: morten44
Subject: Mail not sent from Spamfilter to my Imal Server
Date Posted: 16 September 2010 at 1:57pm
|
Hi
I have some users complaining about not getting the mails sent to their Inbox.
I have gone through the spamfilter log files, and I can see something like: 09/15/10 16:50:03:046 -- (2024) Detected TCP Connection: 195.41.32.96
09/15/10 16:50:03:046 -- (2024) Connection from: 195.41.32.96 - Originating country : Denmark 09/15/10 16:50:03:250 -- (2024) Received MAIL FROM: < mailto:donna@prngo.dk - donna@prngo.dk > 09/15/10 16:50:05:093 -- (2024) Received RCPT TO: mailto:lise@uff.dk - lise@uff.dk 09/15/10 16:50:05:109 -- (2024) Mail from: mailto:donna@prngo.dk - donna@prngo.dk 09/15/10 16:50:05:421 -- (2024) RCPT TO: mailto:lise@uff.dk - lise@uff.dk accepted 09/15/10 16:52:02:515 -- (2024) Disconnect I cant see that the mail acutally was forwarded or any message saying that it was rejected
I am missing a line like:
EMail from mailto:donna@prngo.dk - donna@prngo.dk to mailto:lise@uff.org - lise@uff.org -- was forwarded to 172.18.0.16:2225 Can anyone explain what may have happened here This user has sent about 6 mails this day and its the same with all of them
Kind Regards Morten
|
Replies:
Posted By: yapadu
Date Posted: 16 September 2010 at 6:17pm
|
I have had the the same, every time I have noticed it was from a sender hosted by Google (postini or gmail). The sender receives a bounce back from Google indicating error 550, user undefined. In your case, does donna@prngo.dk receive an undeliverable notice? ------------- -------------------------------------------------------------- I am a user of SF, not an employee. Use any advice offered at your own risk. |
Posted By: morten44
Date Posted: 24 September 2010 at 10:34am
|
Hi
Sorry for late reply. Was away for some days
I have not been able to establish if the sender actually get a message that its not sent succsesfully. The think is that I do not understand why it does not say that message has been forwarded
Regards
Morten
|
Posted By: LogSat
Date Posted: 24 September 2010 at 7:32pm
|
Morten, The email was not delivered as, just like you noticed, the line indicating a delivery attempt is not present: EMail from mailto:donna@prngo.dk - donna@prngo.dk to mailto:lise@uff.org - lise@uff.org -- was forwarded to 172.18.0.16:2225 Are you certain there are no other log entries relative to that threadID (2024) after 16:50:05:421, and before 16:52:02:515? Sometimes there may be an indication of why the disconnect occurred. Without any other entries, the most likely cause is that the remote server simply disconnected the SMTP session after almost two minutes of sending the RCPT command. ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: morten44
Date Posted: 25 September 2010 at 12:30pm
|
Hi No I can not see any record further down telling me why it was disconnected.
IT seems like fault is with mails with attached pdf files I have done 3 tests myself sending from hotmail to this users. All 3 mails has a PDF file attached
nr1: arrived ok nr2: did not arrive. got return message on hotmail. sent with no text in body
nr 3: did not arrive. did not get return message on hotmail. Write text in body. as a sender, i would think the mail arrived ok
here are the 3:
09-24-10 16:36:28:906 -- (4864) Received MAIL FROM: < mailto:abrahamsen_morten@hotmail.com - abrahamsen_morten@hotmail.com >
09-24-10 16:36:29:093 -- (4864) Received RCPT TO: mailto:lise@uff.dk - lise@uff.dk 09-24-10 16:36:29:093 -- (4864) found SPF record for hotmail.com: v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all 09-24-10 16:36:29:109 -- (4864) found SPF record for spf-a.hotmail.com: v=spf1 ip4:209.240.192.0/19 ip4:65.52.0.0/14 ip4:131.107.0.0/16 ip4:157.54.0.0/15 ip4:157.56.0.0/14 ip4:157.60.0.0/16 ip4:167.220.0.0/16 ip4:204.79.135.0/24 ip4:204.79.188.0/24 ip4:204.79.252.0/24 ip4:207.46.0.0/16 ip4:199.2.137.0/24 ~all 09-24-10 16:36:29:109 -- (4864) SPF query result: pass 09-24-10 16:36:29:109 -- (4864) - SPF analysis for spf-a.hotmail.com done: - pass 09-24-10 16:36:29:109 -- (4864) SPF query result: pass 09-24-10 16:36:29:109 -- (4864) - SPF analysis for hotmail.com done: - pass 09-24-10 16:36:29:109 -- (4864) Mail from: mailto:abrahamsen_morten@hotmail.com - abrahamsen_morten@hotmail.com 09-24-10 16:36:29:531 -- (4864) - MAPS search done... 09-24-10 16:36:29:531 -- (4864) RCPT TO: mailto:lise@uff.dk - lise@uff.dk accepted 09-24-10 16:36:30:453 -- (4864) Checking SURBL 09-24-10 16:36:30:453 -- (4864) Checking URLs in emails against MAPS 09-24-10 16:36:30:453 -- (4864) - URLs In MAPS search done... 09-24-10 16:36:30:453 -- (4864) Starting queueing procedures 09-24-10 16:36:30:453 -- (4864) EMail from mailto:abrahamsen_morten@hotmail.com - abrahamsen_morten@hotmail.com to mailto:lise@uff.dk - lise@uff.dk was queued. Size: 21 KB, 21504 bytes 09-24-10 16:36:30:468 -- (3992) Sending email from mailto:abrahamsen_morten@hotmail.com - abrahamsen_morten@hotmail.com to mailto:lise@uff.dk - lise@uff.dk -- 09-24-10 16:36:30:593 -- (3992) EMail from mailto:abrahamsen_morten@hotmail.com - abrahamsen_morten@hotmail.com to mailto:lise@uff.dk - lise@uff.dk -- was forwarded to 172.18.0.16:2225 09-24-10 16:39:15:546 -- (4256) Received MAIL FROM: < mailto:abrahamsen_morten@hotmail.com - abrahamsen_morten@hotmail.com >
09-24-10 16:39:15:718 -- (4256) Received RCPT TO: mailto:lise@uff.dk - lise@uff.dk 09-24-10 16:39:15:734 -- (4256) found SPF record for hotmail.com: v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all 09-24-10 16:39:15:734 -- (4256) found SPF record for spf-a.hotmail.com: v=spf1 ip4:209.240.192.0/19 ip4:65.52.0.0/14 ip4:131.107.0.0/16 ip4:157.54.0.0/15 ip4:157.56.0.0/14 ip4:157.60.0.0/16 ip4:167.220.0.0/16 ip4:204.79.135.0/24 ip4:204.79.188.0/24 ip4:204.79.252.0/24 ip4:207.46.0.0/16 ip4:199.2.137.0/24 ~all 09-24-10 16:39:15:734 -- (4256) SPF query result: pass 09-24-10 16:39:15:734 -- (4256) - SPF analysis for spf-a.hotmail.com done: - pass 09-24-10 16:39:15:734 -- (4256) SPF query result: pass 09-24-10 16:39:15:734 -- (4256) - SPF analysis for hotmail.com done: - pass 09-24-10 16:39:15:734 -- (4256) Mail from: mailto:abrahamsen_morten@hotmail.com - abrahamsen_morten@hotmail.com 09-24-10 16:39:16:281 -- (4256) - MAPS search done... 09-24-10 16:39:16:281 -- (4256) RCPT TO: mailto:lise@uff.dk - lise@uff.dk accepted 09-24-10 16:39:17:296 -- (4256) Detected blank HTML email with specified attachment 09-24-10 16:39:17:296 -- (4256) Starting bayesian procedures 09-24-10 16:39:17:468 -- (4256) Blacklist cache - Added 65.54.190.16 to limbo 09-24-10 16:39:17:468 -- (4256) Disconnect 09-24-10 16:41:51:625 -- (3896) Received MAIL FROM: < mailto:abrahamsen_morten@hotmail.com - abrahamsen_morten@hotmail.com >
09-24-10 16:41:51:796 -- (3896) Received RCPT TO: mailto:lise@uff.dk - lise@uff.dk 09-24-10 16:41:51:812 -- (3896) found SPF record for hotmail.com: v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all 09-24-10 16:41:51:812 -- (3896) found SPF record for spf-a.hotmail.com: v=spf1 ip4:209.240.192.0/19 ip4:65.52.0.0/14 ip4:131.107.0.0/16 ip4:157.54.0.0/15 ip4:157.56.0.0/14 ip4:157.60.0.0/16 ip4:167.220.0.0/16 ip4:204.79.135.0/24 ip4:204.79.188.0/24 ip4:204.79.252.0/24 ip4:207.46.0.0/16 ip4:199.2.137.0/24 ~all 09-24-10 16:41:51:812 -- (3896) SPF query result: pass 09-24-10 16:41:51:812 -- (3896) - SPF analysis for spf-a.hotmail.com done: - pass 09-24-10 16:41:51:812 -- (3896) SPF query result: pass 09-24-10 16:41:51:812 -- (3896) - SPF analysis for hotmail.com done: - pass 09-24-10 16:41:51:812 -- (3896) Mail from: mailto:abrahamsen_morten@hotmail.com - abrahamsen_morten@hotmail.com 09-24-10 16:41:52:437 -- (3896) - MAPS search done... 09-24-10 16:41:52:437 -- (3896) RCPT TO: mailto:lise@uff.dk - lise@uff.dk accepted 09-24-10 16:41:55:359 -- (3896) Checking SURBL 09-24-10 16:41:55:359 -- (3896) Checking URLs in emails against MAPS 09-24-10 16:41:55:359 -- (3896) - URLs In MAPS search done... 09-24-10 16:41:55:359 -- (3896) Starting queueing procedures 09-24-10 16:41:55:625 -- (3896) EMail from mailto:abrahamsen_morten@hotmail.com - abrahamsen_morten@hotmail.com to mailto:lise@uff.dk - lise@uff.dk was queued. Size: 103 KB, 105472 bytes 09-24-10 16:41:56:328 -- (3996) Sending email from mailto:abrahamsen_morten@hotmail.com - abrahamsen_morten@hotmail.com to mailto:lise@uff.dk - lise@uff.dk -- 09-24-10 16:41:56:734 -- (3896) Disconnect Does this give you some idea whats going on?
Clearly on mail 3 it tried to deliver but did not. Checked logfile and spamfilter are delivering to mail server right before and after this Kind regards
Morten |
Posted By: LogSat
Date Posted: 25 September 2010 at 10:28pm
Correct, this email was forwarded to the destination SMTP server at 172.18.0.16
This email was rejected due to the above reason. There should actually be another log entry that I did not see which specifically states that the remote server will be disconnected or that the email is rejected.
Are you absolutely certain there is not another log entry for threadID (3996) in SpamFilter's logfile after 16:41:56:328...? Please note that you may have to look several minutes past 16:41:56 if the PDF attachment is large and/or the connection to the destination server is slow. There should be either another entry in the log saying the delivery was successful, or one that states there was an issue delivering it. In either case, unless something went majorly wrong in SpamFilter, the fate of that email should have been logged. If you'd like to zip and email us the log for the 24th, I'd be happy to look over it. ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
morten44 wrote:Posted By: morten44
Date Posted: 26 September 2010 at 6:54pm
|
Hi Roberto
I have sent a mail to your support address.
Thanks for taking time to look through the lof file Looking forward to hear from you
Regards
Morten
|
Posted By: LogSat
Date Posted: 26 September 2010 at 8:09pm
|
Morten, I checked your logs, and that email was indeed delivered successfully to the destination SMTP server at 172.18.0.16 on port 2225 - please see the entries below: 09-24-10 16:41:56:328 -- (3996) Sending email from abrahamsen_morten@hotmail.com to lise@uff.dk -- 09-24-10 16:41:58:109 -- (3996) EMail from abrahamsen_morten@hotmail.com to lise@uff.dk -- was forwarded to 172.18.0.16:2225 To see why the user did not receive it, you will need to check the SMTP logs on that server at 172.18.0.16, since the line in green above will only be logged if the destination server accepts the email with a 200 (meaning success) code. Regards, ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |