Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hi I have a mail server on windows 2003 ( MailEnable) I setup mail server to authonticate users before sending mail. (This mail server requires authentication when attempting to send to a non-local e-mail address) but from yesterday , without change any setting I got many Message Delivery Delay from mail server for email address that I never try to sending email: I afraid that I someone try to sending Spam from my mail server,How can I check this possiblity ? and fix the problem.

Thanks

MailEnable: Message delivery has been delayed.

Message is waiting at *.info for delivery to mailin-03.mx.aol.com.

The message will be retried for another 29 hours.

Reason: Mail Server for aol.com could not accept your email at this time. MailEnable will keep trying to deliver this message and will notify you of any progress.

The remote mail server returned the error: 421-: (DNS:NR)

share|improve this question
add comment

3 Answers

The reason your email isn't being accepted is that your IP addresses does not have reverse DNS.

What happens is:

  1. The AOL mail server gets a connection from 1.1.1.1 (example)
  2. It then tries to resolve 1.1.1.1, gets smtp.example.com (example)
  3. It then tries to resolve smtp.example.com and gets another IP address or is unable to resolve it.
  4. It then sends an error message to your mail server, telling it that you need reverse DNS to be able to send email to them (which is quite common btw).
share|improve this answer
    
Thanks for your info, but my current problem is , I didnt sent any email to AOL. I see this email in my mail server outgoing Queue –  Ashian Jul 13 '09 at 9:23
    
You sure about that? Doesn't have to be @aol.com and it may not even be you. In any case, make sure that your mail server can be resolved using RDNS (it is important). Back to your problem. If you're absolutely sure that nobody should be sending any emails and you're still receiving errors. Try enabling logging or even traffic logging so that you can see who is connecting to your mail server. –  Andrioid Jul 13 '09 at 9:33
add comment

MailEnable will keep trying to deliver this message and will notify you of any progress.

The message looks like you received it through email. Or did you see it in the log files?

If you received an email: are you sure this warning is from your mail server, and not from some other server?

(Another server, that happens to be running MailEnable as well, may have been abused for spam, using your email address as the sender. However, in that case you'd also receive all kind of Out of the Office replies, and all sorts of truly undeliverable messages.)

share|improve this answer
    
how can I sure that this message sent from my email server? –  Ashian Jul 13 '09 at 9:23
    
So, this is indeed an email message you received, and not something from a log file? I doubt an administrator would get such messages, as that would flood the administrator's mailbox... So, who is the Sender, and what address is used as the Recipient? In the headers of the message you can tell where the message originated from. Something called "Show message headers" or "Show long headers" or something like that. How many messages are we talking about by the way? –  Arjan Jul 13 '09 at 10:04
    
Hello Arjan - I am facing the same issue. I do not see any sender in the From field. MailEnable: Message delivery has been delayed. Message is waiting at home for delivery to gmail-smtp-in.l.google.com. The message will be retried for another 19 hours. Reason: Mail Server for gmail.com could not accept your email at this time. MailEnable will keep trying to deliver this message and will notify you of any progress. The remote mail server returned the error: 421-4.7.0 [94.76.244.200 10] Our system has detected an unusual rate of –  user75002 Mar 18 '11 at 16:26
    
@siri, it seems the cause is in "Our system has detected an unusual rate of ...". If not, then looking at google.com/appsstatus and clicking the little icon that is visible right now next to "Information available", gets one "We are aware that some users experienced difficulties accessing their accounts for up to 16 minutes today from 15:48 to 16:04 PDT. We're sorry for any inconvenience that this has caused. Everything should now be back to normal." Could that have applied to you? (I don't understand the timestamps, as right now it's 15:27 PDT...) –  Arjan Mar 18 '11 at 22:27
add comment

You need to enable logging on the SMTPserver; in the Logging Properties Advanced tab make sure you tick all the options. This will record everything passing through the server. NB log files can be big, especially if you're being spammed. You may want to put the log directory on a partition with lots of free space.

NB authentication doesn't offer any protection if your passwords are weak. Spammers frequently attack authenticated SMTP servers by trying to guess passwords. I usually turn authentication off unless I have some guarantee that passwords will be strong, e.g. use a group policy to enable complex passwords.

JR

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.