Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
Feb 10 13:12:52 dd1 postfix/smtp[18237]: connect to[]:25: Connection timed out
Feb 10 13:12:52 dd1 postfix/smtp[18237]: 710F5121BDD: to=<>, relay=none, delay=21424, delays=21394/0.03/30/0, dsn=4.4.1, status=deferred (connect to[]:25: Connection timed out)

the above is a couple of lines from my maillog

I have no idea who or how 'speedline' are getting onto my mail logs - it looks like they are trying to send a message ? What can you pros tell me about this log above I get a lot like this. I see that the connection timed out but should I still be concerned ?

share|improve this question

That log is of you attempting to send email TO them, not them connecting to you. Your mail server has failed to connect to theirs and instead has gone into a deferred state. This is the normal behaviour.

I'd reccomend you read the man page of sendmail so you can understand what's happening with it.

share|improve this answer
Well if we dont knowingly have any scripts that are sending spam mail out then have we been hacked, I have heard its quite popular for hackers to use legit email server to send out their emails. – landed Feb 12 '13 at 17:31
We can only answer that the behaviour of the mail server is correct. We don't know if the message was intended to be sent or not! If none of your users sent that message, yes, it might be an indication of being hacked or being an open relay. But those messages alone don't say anything one way or another - it's the normal behaviour when you can't contact the destination mail server - for legitimate traffic or illegitimate. – Scrivener Feb 12 '13 at 17:41
Good point thanks. – landed Feb 13 '13 at 9:17

Possibly. I would be suspicious of the domain resolving to the IP address In all the dns lookup I did, that domain resolves to Check if your dns is resolving correctly for other domain, in case you have dns poisoning problem.

As far as the email server is concerned, run the mailq command. If you see too many emails in the queue and do not recognize the sender/recipient addresses, you will need to do thorough investigation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.