Spam Filter ISP Support - no ndr when one recipient invalid

no ndr when one recipient invalid

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7061
Printed Date: 27 December 2024 at 1:25pm

Topic: no ndr when one recipient invalid

Posted By: Terry
Subject: no ndr when one recipient invalid
Date Posted: 05 June 2013 at 10:46am

Question on the Spam Filter services Version 4.5.0.81...we have an interesting problem that just showed up...an email with many recipients in the "to" came in to spamfilter and passed the spam filter rules...it was then forwarded to our edge array exchange servers however in the spamfilter logs we see that the edge array rejected one address as not valid and advised spamfilter of that issue...spamfilter appears to have not delivered the message to any of the recipients of the email and did not send an "ndr" back to the sender...when we look back in the past for a similar problem we see that spamfilter appears to have handled the issue differently and advises that "some of the addresses were invalid"

Most current log showing no delivery and no "NDR":

05/29/13 12:44:20:229 -- (243817648) Sending email from mailto:bent@apsstevedoring.com" rel="nofollow - to mailto:bill.mccormack@portofportland.com" rel="nofollow - , mailto:john.akre@portofportland.com" rel="nofollow - , mailto:marinesecurity@portofportland.com" rel="nofollow - , mailto:pat.grill@portofportland.com" rel="nofollow - , mailto:philipp.bales@portofportland.com" rel="nofollow - –

05/29/13 12:44:30:494 -- (243817648) server error - edgearray.pop.portptld.com:25 said: User unknown –

05/29/13 12:44:30:494 -- (243817648) EMail from: < mailto:bent@apsstevedoring.com" rel="nofollow - > to: mailto:bill.mccormack@portofportland.com" rel="nofollow - , mailto:john.akre@portofportland.com" rel="nofollow - , mailto:marinesecurity@portofportland.com" rel="nofollow - , mailto:pat.grill@portofportland.com" rel="nofollow - , mailto:philipp.bales@portofportland.com" rel="nofollow - -- was returned to sender - server error - edgearray.pop.portptld.com:25 said: User unknown –

05/29/13 12:44:45:735 -- (243817648) There was an error sending the NDR to mailto:bent@apsstevedoring.com" rel="nofollow - : Unable to relay --

Earlier log showing partial deliver and appropriate message back to sender:

EMail from mailto:bent@apsstevedoring.com" rel="nofollow - to mailto:bill.mccormack@portofportland.com" rel="nofollow - , mailto:john.akre@portofportland.com" rel="nofollow - , mailto:marinesecurity@portofportland.com" rel="nofollow - , mailto:pat.grill@portofportland.com" rel="nofollow - , mailto:philipp.bales@portofportland.com" rel="nofollow - -- was forwarded to edgearray.pop.portptld.com:25

05/10/13 10:28:34:040 -- (248227216) Some recipients do not exist, sending 550 to sender SMTP server. The destination SMTP server said:marinesecurity@portofportland.com: 550 User unknown –

Replies:

Posted By: LogSat
Date Posted: 05 June 2013 at 6:43pm

Terry,

We were able to reproduce the issue with this build. SpamFilter is supposed to place the remote server "on hold" after a clean email is received for a brief period of time, while it checks the existence of the recipients with your destination SMTP server. If one or more of the recipients does not exist, SpamFilter will output a 550 error back to the remote server, indicating in the description which of the email addresses did not exist. The remote server will then in turn send an NDR back to the sender. This "place on-hold" feature was introduced in SpamFilter v4.2 by adding the parameter VerifyRCPTTOForCleanEmails=1 in the SpamFilter.ini file (which is turned on by default).

This is the behavior you saw correctly in the earlier logs on the 10th. There's a bug in this build preventing it from seeing the non-existence of the recipients. Not being able to detect them, the SpamFilter should accept the email from the sender, and then, upon receiving a rejection from your destination SMTP server, SpamFilter should send an NDR bounce email back to the sender to let them know of the failure to send. This was the default behavior before the "place on hold" feature was introduced.

This bug would have not been a huge problem if it wasn't for the fact that your SMTP server rejected SpamFilter's email with the NDR. SpamFilter does not send emails back out to the internet, but relies on the default destination SMTP server to deliver such notification emails (this server can be customized with the NotificationSMTPServer parameter in the SpamFilter.ini file). Since your destination SMTP server rejected SpamFilter's NDR email, the sender was not notified.

You should allow the default destination SMTP to have SpamFilter' IP be able to relay emails to it freely so that NDR emails can be delivered if needed.

In the meantime we'll try to patch this issue as soon as possible, and will let you know as soon as a fix is ready.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Terry
Date Posted: 06 June 2013 at 11:50am

thank you Roberto, we have made the changes to the relay as adviced...must have lost that earlier when we moved the server to a new ip address...hoping the fix to the software comes pretty quickly as we had more email rejected this morning for our emergence alert system...

Posted By: LogSat
Date Posted: 06 June 2013 at 6:54pm

Terry,

We found out that the issue is actually present in all versions of SpamFilter where that new VerifyRCPTTOForCleanEmails option was added. The problem occurs when there is an email with multiple recipients, one or more are non-existent, the non-existent recipients ones are being sent via thre RCPT TO command after the valid recipients. In these conditions SpamFilter may at times miss the invalidity of the non-existent recipients before the remote SMTP server is disconnected, and is thus forced to send an NDR to the sender to inform them of the non-delivery.

As said above, this is usually not an issue and is just a matter of an extra email send by SpamFilter instead of having the remote SMTP server send the NDR to their customer, but in your case this caused a problem as SpamFilter was not allowed to relay emails.

We're testing a fix right now internally to make sure there's no issues, and we'll make it public within 2-3 days if it passes the quality assurance. If you would like to receive it sooner please let us know via email (or forum) so I can make it available for you to download.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: LogSat
Date Posted: 09 June 2013 at 5:10pm

FYI we've just made available in the registered user area SpamFilter build v4.5.1.89 with the fix for this issue.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Terry
Date Posted: 12 June 2013 at 1:07pm

Ricardo, I cannot find the version download for 4.5.1.89? the latest that seems to show for download 4.5.0.81

Posted By: Terry
Date Posted: 12 June 2013 at 1:09pm

found it...sorry

Posted By: LogSat
Date Posted: 12 June 2013 at 1:09pm

Terry,

If you login the registered user area on our website, you'll see several builds available under the section "Binaries, pre-release and/or previous builds". The last one will be the 4.5.1.89.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Terry
Date Posted: 12 June 2013 at 2:40pm

One last likely really stupid question on this...we continue to get messages like this:

06/12/13 11:03:32:640 -- (230330480) There was an error sending the NDR to mailto:bounce-50_HTML-47589632-200872-1060752-175@bounce.1105info.com" rel="nofollow - bounce-50_HTML-47589632-200872-1060752-175@bounce.1105info.com : Unable to relay --

in the logs...

is spamfilter trying to send the ndr through our configured destination mail server? or what name does it look at for the smtp server that it to send ndr through...something changed here since it worked in the past

Posted By: Terry
Date Posted: 12 June 2013 at 4:16pm

a little more info on this message...we traced some activity in the logs and it appears that these ndr's are occurring based on peoples blocked senders settings in their exchange outlook junk mail...still would like to understand where spamfilter is trying to relay the ndr however...

Posted By: LogSat
Date Posted: 12 June 2013 at 4:16pm

Hi Terry,

I had already mentioned this issue in my original reply to the post - I'll highlight in bold the solution (you can also specify a different SMTP server to be used for the notifications):

You should allow the default destination SMTP to have SpamFilter' IP be able to relay emails to it freely so that NDR emails can be delivered if needed.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP