So yesterday we found out that one of our old pop servers had been hacked and was sending out spam. We promptly took care of the situation and it would seem that it's all taken care of. I've been watching the logs closely and they're back to their normal rate of logging local mail.
Every now and then, we'll get a line that looks like this:
Mar 16 06:02:50 sm-mta: p2GC2h1w098312: to=<email@example.com>, delay=00:00:07, xdelay=00:00:07, mailer=esmtp, pri=33208, relay=www.spdcom.info. [18.104.22.168], dsn=4.0.0, stat=Deferred: Connection refused by www.spdcom.info.
I'm not an expert when it comes to mail servers and I only have a basic understanding of how relays work. But after yesterday I locked the mail server down with the /etc/mail/access file to only localhost and a few of my own IP addresses. I've checked my mail server on www.checkor.com as well as another tool and it passes their open relay test (as in it's secure and doesn't allow OR). Now I'm certain I have nothing that would be sending email to anything at spdcom.info. So can someone tell me exactly what this message means?