Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So yesterday we found out that one of our old pop servers had been hacked and was sending out spam. We promptly took care of the situation and it would seem that it's all taken care of. I've been watching the logs closely and they're back to their normal rate of logging local mail.

Every now and then, we'll get a line that looks like this:

Mar 16 06:02:50 sm-mta[98312]: p2GC2h1w098312: to=<>, delay=00:00:07, xdelay=00:00:07, mailer=esmtp, pri=33208, [], dsn=4.0.0, stat=Deferred: Connection refused by

I'm not an expert when it comes to mail servers and I only have a basic understanding of how relays work. But after yesterday I locked the mail server down with the /etc/mail/access file to only localhost and a few of my own IP addresses. I've checked my mail server on as well as another tool and it passes their open relay test (as in it's secure and doesn't allow OR). Now I'm certain I have nothing that would be sending email to anything at So can someone tell me exactly what this message means?

share|improve this question
up vote 3 down vote accepted

It's likely that when your machine was sending spam, some of that couldn't be delivered, and ended up in a queue of messages to be retried later. The bit of the log message that reads "stat=Deferred: Connection refused by" indicates that.

I would run (assuming you're running sendmail)

sendmail -bp

and check to see what messages you still have queued. Some investigation of /var/spool/mqueue should reveal to you which queue files you might want to delete.

share|improve this answer
That was exactly the problem. Thank you very much! – Safado Mar 16 '11 at 16:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.