Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been getting this since a few weeks ago:

Transcript of session follows.

 Out: 220 www.example.com ESMTP
 In:  EHLO
 Out: 501 Syntax: EHLO hostname
 In:  HELO
 Out: 501 Syntax: HELO hostname
 In:  QUIT
 Out: 221 2.0.0 Bye


For other details, see the local mail logfile

These connections come from all the internet, from 2.0.0.0/8 to 221.0.0.0/8

My question is NOT how to stop it (-j DROP --dport 25) or how to stop receiving the mails (remove protocol in postfix main.cf)

My question is simple: why? is it a misconfigured bot? I googled and saw messages related to this since 2006. I get 30 of these a day or more. I'm waaaay curious about this. Anybody has more information about it? when did it begin? what's going on?

That's all, thank you.

share|improve this question

closed as not constructive by Greg Askew, Michael Hampton, Brent Pabst, mdpc, Scott Pack Nov 9 '12 at 19:01

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

A lot of bots don't get the hostname right. I suspect that is what you are seeing. Looking at my mail database, I only see one record like this. However, a lot of bots trigger response delays and give up before they get to the EHLO/HELO step.

I don't know the Postfix capabilities, but I delay answering the connection for several seconds if the DNS entries for the server aren't good. A proper mail server will wait and connect. Most Bots don't wait around, likely because they want to deliver messages as quickly as possibly, not as reliably as possible.

Try doing a host look-up on the addresses which are failing. Valid mail servers will return a pointer to a FQDN (Fully Qualified Domain Name). This FQDN will almost always return the IP address you started with. If not, you likely have a Bot trying to connect. As the name is blank, this is most likely.

share|improve this answer
    
Thank you, initial delay in postfix I think not but it can delay answers after a soft_limit number of errors. Yes it does reverse and most are home users (comcast, rr, virginmedia, etc) and some others don't resolve (unknown). –  Mario Nov 9 '12 at 13:18
    
@Mario The reverse lookups you are getting are typical of SpamBots. I would expect forward lookups on the names you get from the reverse lookups most of the time. –  BillThor Nov 10 '12 at 2:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.