This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Our messages look like spam!

Over the weekend, we installed a new Astaro box on our company network.  Today, one of our users had his email to a local cable provider refused as spam.  On top of that, all of our email to Yahoo is being sent to the Bulk Mail folders.  What could be wrong?  I can post headers of messages to Yahoo if it helps...  The actual error the user is getting is this:

http://security.rr.com/mail_blocks.htm#security - 20031124>

TIA, John

My SMTP configuration is below...

Hostname (MX): The name listed in the mx record of my mail server.  The IP address of this record now points to my Astaro box.

SMTP Routes
myrealdomain.com -> Mail_Private

Recipient verification: On

Outgoing mail
Allowed networks:
  Internal_Network__
  Mail_Private

Use SmartHost: Off

TLS transaction encryption: On
SMTP authentication: On
Authentication Methods: NT/2000/XP Server

Global Whitelist
Trusted hosts/networks: Internal_Network__
Trusted domains:

Blcok RCPT hacks: On
RBL: Off
Sender address verification: On
Use callouts: On
Sender Blacklist: off
MIME Error checking: off
File extension filter: on
Virus Protection Off
Spam detection: both thresholds set
Spam Sender Whitelist:

This thread was automatically locked due to age.

Parents

0 jours over 21 years ago

More information:  We have 5 public IPs.  Before we had Astaro (or any firewall), we had separate machines on each address.  My .172 address was my mail server, .170 was my web server, etc.  Now we have the astaro box which has all the public IPs.  My mail DNS record resolves to the .172 address.

The problem might be that the main address on the ASL box is the .170 address.  Yahoo sees the message as being from the .170 address (the Received: header)...but when it does the reverse lookup on my mail record it is .172.  It assumes the message is spoofed.

Could this be the problem?  If so, how do I fix it?
Cancel
Vote Up 0 Vote Down

Cancel
0 jours over 21 years ago in reply to jours

I verified the problem is that my MX record did not resolve to the originating address of the message.  To summarize:  The ASL box has addresses 170, 171, 172, and 173.  Mail.myrealdomain.com resolves to 172.  When ASL sends the messages, it sends them on the 170 address.  This looks like SPAM.

I've fixed it for now by entering SNAT rules as follows
From 170->Any, SMTP, Change SRC to 172
From 171->Any, SMTP, Change SRC to 172
From 173->Any, SMTP, Change SRC to 172

This feels like a bit of a hack, seems like I might have a conceptual problem.  Is there any better way to address this?

Thanks for reading,
John
Cancel
Vote Up 0 Vote Down

Cancel
0 SecApp over 21 years ago in reply to jours

A round-robin DNS entry might make it work without the SNAT...
Cancel
Vote Up 0 Vote Down

Cancel
0 Biffa over 21 years ago in reply to jours

[ QUOTE ]
I verified the problem is that my MX record did not resolve to the originating address of the message.  To summarize:  The ASL box has addresses 170, 171, 172, and 173.  Mail.myrealdomain.com resolves to 172.  When ASL sends the messages, it sends them on the 170 address.  This looks like SPAM.

I've fixed it for now by entering SNAT rules as follows
From 170->Any, SMTP, Change SRC to 172
From 171->Any, SMTP, Change SRC to 172
From 173->Any, SMTP, Change SRC to 172

This feels like a bit of a hack, seems like I might have a conceptual problem.  Is there any better way to address this?

Thanks for reading,
John

[/ QUOTE ]

Yep, change the MX record to 170.
Cancel
Vote Up 0 Vote Down

Cancel
0 pablito over 21 years ago in reply to Biffa

Just to clarify, the IP that appears at the far end will always be the primary IP of the ASL internet interface. If you want a specific IP to be used then place that IP as the primary IP.

For inbound you want MX to point to the primary IP and to have the SMTP proxy set so the hostname matches the MX record name.
Cancel
Vote Up 0 Vote Down

Cancel
0 donavan over 21 years ago in reply to pablito

I have to question the accuracy of your statement.  My experiences would indicate otherwise.  And BTW:  I wish I could force the SMTP proxy to use the base IP address (239.130).  I've included an example email below as well as my network configs.  And as to why it chooses to use eth0:4 I have no clue.  Any suggestions?

eth0      Link encap:Ethernet  HWaddr 00:E0:29:52:EB:C4
          inet addr:216.58.239.130  Bcast:216.58.239.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:500444 errors:0 dropped:0 overruns:0 frame:0
          TX packets:427568 errors:396 dropped:0 overruns:0 carrier:396
          collisions:0 txqueuelen:100
          Interrupt:11 Base address:0x2000

eth0:1    Link encap:Ethernet  HWaddr 00:E0:29:52:EB:C4
          inet addr:216.58.239.133  Bcast:216.58.239.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:11 Base address:0x2000

eth0:3    Link encap:Ethernet  HWaddr 00:E0:29:52:EB:C4
          inet addr:216.58.239.132  Bcast:216.58.239.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:11 Base address:0x2000

eth0:4    Link encap:Ethernet  HWaddr 00:E0:29:52:EB:C4
          inet addr:216.58.239.131  Bcast:216.58.239.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:11 Base address:0x2000

eth0:5    Link encap:Ethernet  HWaddr 00:E0:29:52:EB:C4
          inet addr:216.58.239.134  Bcast:216.58.239.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:11 Base address:0x2000

Received: from mail.4wx.net (basketsbyshannon.com [216.58.239.131])
        by carbon.cudenver.edu (8.11.1/8.8.8) with ESMTP id hB86RBu32494
        for ; Sun, 7 Dec 2003 23:27:11 -0700 (MST)
Received: from [192.168.94.232] (helo=shzaam.4wx.net)
        by mail.4wx.net with esmtp (Exim 4.22)
        id 1ATErR-0000EP-E4
        for dnelson@carbon.cudenver.edu; Mon, 08 Dec 2003 00:27:13 -0600
Received: from wm.4wx.net (localhost.localdomain [127.0.0.1])
        by shzaam.4wx.net (Postfix) with ESMTP id 631F77D08
        for ; Mon,  8 Dec 2003 00:27:13 -0600 (CST)
From: "donavan nelson"
To: dnelson@carbon.cudenver.edu
Subject: header test
Date: Mon, 8 Dec 2003 00:27:13 -0600
Message-Id:
X-Mailer: Open WebMail 2.21 20031128
X-OriginatingIP: 192.168.94.253 (donavan)
MIME-Version: 1.0
Content-Type: text/plain;
        charset=iso-8859-1
X-Scan-Signature: f17621e567d3a5544ec1e01d07640df6

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

this is the outgoing header test.

--
Donavan Nelson
donavan@whiteboxlinux.net
http://whiteboxlinux.net
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 donavan over 21 years ago in reply to pablito

I have to question the accuracy of your statement.  My experiences would indicate otherwise.  And BTW:  I wish I could force the SMTP proxy to use the base IP address (239.130).  I've included an example email below as well as my network configs.  And as to why it chooses to use eth0:4 I have no clue.  Any suggestions?

eth0      Link encap:Ethernet  HWaddr 00:E0:29:52:EB:C4
          inet addr:216.58.239.130  Bcast:216.58.239.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:500444 errors:0 dropped:0 overruns:0 frame:0
          TX packets:427568 errors:396 dropped:0 overruns:0 carrier:396
          collisions:0 txqueuelen:100
          Interrupt:11 Base address:0x2000

eth0:1    Link encap:Ethernet  HWaddr 00:E0:29:52:EB:C4
          inet addr:216.58.239.133  Bcast:216.58.239.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:11 Base address:0x2000

eth0:3    Link encap:Ethernet  HWaddr 00:E0:29:52:EB:C4
          inet addr:216.58.239.132  Bcast:216.58.239.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:11 Base address:0x2000

eth0:4    Link encap:Ethernet  HWaddr 00:E0:29:52:EB:C4
          inet addr:216.58.239.131  Bcast:216.58.239.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:11 Base address:0x2000

eth0:5    Link encap:Ethernet  HWaddr 00:E0:29:52:EB:C4
          inet addr:216.58.239.134  Bcast:216.58.239.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:11 Base address:0x2000

Received: from mail.4wx.net (basketsbyshannon.com [216.58.239.131])
        by carbon.cudenver.edu (8.11.1/8.8.8) with ESMTP id hB86RBu32494
        for ; Sun, 7 Dec 2003 23:27:11 -0700 (MST)
Received: from [192.168.94.232] (helo=shzaam.4wx.net)
        by mail.4wx.net with esmtp (Exim 4.22)
        id 1ATErR-0000EP-E4
        for dnelson@carbon.cudenver.edu; Mon, 08 Dec 2003 00:27:13 -0600
Received: from wm.4wx.net (localhost.localdomain [127.0.0.1])
        by shzaam.4wx.net (Postfix) with ESMTP id 631F77D08
        for ; Mon,  8 Dec 2003 00:27:13 -0600 (CST)
From: "donavan nelson"
To: dnelson@carbon.cudenver.edu
Subject: header test
Date: Mon, 8 Dec 2003 00:27:13 -0600
Message-Id:
X-Mailer: Open WebMail 2.21 20031128
X-OriginatingIP: 192.168.94.253 (donavan)
MIME-Version: 1.0
Content-Type: text/plain;
        charset=iso-8859-1
X-Scan-Signature: f17621e567d3a5544ec1e01d07640df6

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

this is the outgoing header test.

--
Donavan Nelson
donavan@whiteboxlinux.net
http://whiteboxlinux.net
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data