0

When looking at my mail log I have noticed the following:

mail/mail.log.3:297:Mar 30 18:31:21 www postfix/smtp[21129]: 7A6C51014035D: to=<[email protected]>, relay=spam.aserve.com.tw[118.163.3.51]:25, delay=12, delays=0.01/0/10/2.1, dsn=2.0.0, status=sent (250 2.0.0 s2UAS7BE024449 Message accepted for delivery)

The text here [relay=spam.aserve.com.tw] contain the word "spam". Can I assume that the email is marked as spam?

2 Answers 2

4

No. For better or for worse, this turns out to be their main mail server:

[me@risby ~]$ dig mx aserve.com.tw
[...]
;; ANSWER SECTION:
aserve.com.tw.      3600    IN  MX  1 spam.aserve.com.tw.
aserve.com.tw.      3600    IN  MX  10 mail.aserve.com.tw.

I'm not sure why anyone would call their primary mail server by such a name, but it's just a name. They may well have filed your email as spam, but if they have, it won't be because of the name of the server.

1

They may be using spam.aserve.com.tw. as a spam filter. A proper email server will try spam.aserve.com.tw. and if that fails then try mail.aserve.com.tw.. Spambots are likely to try only one address. By using two addresses it is possible to use this connection sequence to filter some email. There may slightly delay email deliveries to them, but should not cause you email to be classified as spam.

Their broken SPF record indicates they may send email from either server. If you see email arriving from spam.aserve.com.tw., this does not indicate that the message is spam.

If they use a database to track source addresses, it is possible to identify sending programs that do not follow the standard and connect to the mail servers in the correct order. How they handle senders that do not follow standards is up to them, but I would block all such senders that don't pass rDNS verification. Failed addresses can be agressively removed from the database. It would be appropriate to keep passing addresses in the database, flagged accordingly.

EDIT: Based on the behavior of their servers they may be failing mail delivered to the backup server mail.aserve.com.tw. and accepting mail delivered to the preferred mail server spam.aserve.com.tw.. This will cause spambots which send to backup mail servers to fail.

2
  • Umm, are you sure you meant to give the same hostname twice? If you were thinking that a second delivery attempt would try mail.aserve.com.tw., that makes sense - except that (a) a well-behaved MTA would only try that after failing to contact the lower-weight server, and the lower-weight server is fine, and (b) I already tried, and mail.aserve.com.tw doesn't seem to be accessible on port 25.
    – MadHatter
    Mar 31, 2014 at 12:46
  • @MadHatter Yes, I meant to use different names. When I tried neither server responded. They may have found spambots were hitting the higher priority address.
    – BillThor
    Apr 1, 2014 at 2:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .