Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite

I have the following configured:

  1. mail.firstdomain.com - 1.1.1.1 - This domain sends out a lot of email (our newsletter to clients), and thus I keep the two separated.

  2. mail.seconddomain.com - 2.2.2.2 - This domain is were we send out email from our app (registrations, notifications, etc...)

  3. mail.mypersonaldomain.com - 3.3.3.3 - This is my personal email hosted by Google/GMail

I have some email that are sending from mail.secondomain.com being rejected:

 Could not deliver message to the following recipient(s):

 Failed Recipient: joe@domain.com
 Reason: Remote host said: 554 mail server permanently rejected message (#5.3.0)

In the header:

 Received: from 1.1.1.1 [2.2.2.2] by mail.mypersonaldomain.com with SMTP; (date and time)

How is this possible?

1.1.1.1 is not involved in the email sending. I assume this is from the recipients server associating the email from 2.2.2.2 with the other IP (1.1.1.1) and further, with my personal email server (mail.personaldomain).

I checked all the configuration, and I don't see anything other than mail.seconddomain.com being used. 1.1.1.1 and 2.2.2.2 are even in separate data centers.

Any ideas?

share|improve this question

4 Answers

up vote 4 down vote accepted

My answer is similar to that of splattne but I have a different interpretation of the Recieved header 

Received: from 1.1.1.1 [2.2.2.2] by mail.mypersonaldomain.com with SMTP; (date and time)

The exact format of Recieved lines varies with different servers, but generally the from part consists of the name given in the HELO/EHLO SMTP command with the IP address the connection was recieved from in square brackets.

This received line to me looks like the server gave '1.1.1.1' as its name in the HELO command.

Are you able to run wireshark, or other equivalent package, to sniff the SMTP session and verify the hostname given within the SMTP protocol?

share|improve this answer
Correct, and the full syntax of Received is in the standard, RFC 5322, section 3.6.7 (it does not mean anyone follow the standard). – bortzmeyer Jun 17 '09 at 7:14
Unfortunately 3.6.7 is very loose in its definition. It doesn't define any of the keywords such as "from" or "by" or the order of the fields. Basically the RFC just says that anything goes up until the semi-colon. After the semi-colon is the date in a pretty flexible format. – Russell Heilling Jun 17 '09 at 8:27
up vote 0 down vote

Is the text after "from" being picked up from the reverse-DNS entry for 2.2.2.2?

Try

"host 2.2.2.2"

to check.

(the "host" command is fairly standard on Unix-a-like systems, there will be Windows equivalents if you need one and failing that search Google for one of the many sites that will do rDNS lookups for you)

share|improve this answer
host returns seconddomain.com – Jason Jun 16 '09 at 19:41
Are you sending from a machine with a name in firstdomain.com? If so, and that "received" line is the first in the chain, then it may be saying that "a client MTA on 1.1.1.1 connected to me to drop in a message". Though while that would solve the "where did 1.1.1.1 come from" issue it would also open a "but where does 2.2.2.2 come from" question... – David Spillett Jun 16 '09 at 20:45
I have found that both 1.1.1.1 and 2.2.2.2 have similar reverse DNS settings (comp1.mypersonaldomain.com and comp2.mypersonaldomain.com). This could be part of the reason... but I have many computers with this reverse DNS and it is ironic that these IPs were shown. – Jason Jun 16 '09 at 20:55
up vote 0 down vote

mail.mypersonaldomain.com seems to be the name given to the SMTP service. Your server is telling the remote SMTP the name using the SMTP HELO/EHLO command.

share|improve this answer
I don't think it is. The Windows SMTP service uses the local domain, the name of the computer (mycomputer). However, the setting has a fully qualified domain as www.seconddomain.com. Furthermore, I'm wondering if the reverse DNS on this server has something to do with it. It is www.firstdomain.com, but nowhere do I indicate mail.firstdomain.com. AND... how did it get 1.1.1.1? – Jason Jun 16 '09 at 19:38
do you use a smart host in your Windows SMTP relay options? – splattne♦ Jun 16 '09 at 19:47
No, I do not. Should I? – Jason Jun 16 '09 at 20:08
No. But if you had, that could have been an explanation for what you see. Hm... – splattne♦ Jun 16 '09 at 20:17
Wrong explanation, see Russell Heilling's text. – bortzmeyer Jun 17 '09 at 7:15
show 1 more comment
up vote 0 down vote

Write to check-auth@verifier.port25.com and you will receive back a nice report with a lot of details on how your mail server looks like, as seen from your correspondants. A great tool when debugging mail delivery problems.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.