Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So yesterday we found out that one of our old pop servers had been hacked and was sending out spam. We promptly took care of the situation and it would seem that it's all taken care of. I've been watching the logs closely and they're back to their normal rate of logging local mail.

Every now and then, we'll get a line that looks like this:

Mar 16 06:02:50 sm-mta[98312]: p2GC2h1w098312: to=<info@www.spdcom.info>, delay=00:00:07, xdelay=00:00:07, mailer=esmtp, pri=33208, relay=www.spdcom.info. [87.204.255.46], dsn=4.0.0, stat=Deferred: Connection refused by www.spdcom.info.

I'm not an expert when it comes to mail servers and I only have a basic understanding of how relays work. But after yesterday I locked the mail server down with the /etc/mail/access file to only localhost and a few of my own IP addresses. I've checked my mail server on www.checkor.com as well as another tool and it passes their open relay test (as in it's secure and doesn't allow OR). Now I'm certain I have nothing that would be sending email to anything at spdcom.info. So can someone tell me exactly what this message means?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

It's likely that when your machine was sending spam, some of that couldn't be delivered, and ended up in a queue of messages to be retried later. The bit of the log message that reads "stat=Deferred: Connection refused by www.spdcom.info.com" indicates that.

I would run (assuming you're running sendmail)

sendmail -bp

and check to see what messages you still have queued. Some investigation of /var/spool/mqueue should reveal to you which queue files you might want to delete.

share|improve this answer
    
That was exactly the problem. Thank you very much! –  Safado Mar 16 '11 at 16:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.