Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
Feb 10 13:12:52 dd1 postfix/smtp[18237]: connect to go-speedline.com[67.249.162.124]:25: Connection timed out
Feb 10 13:12:52 dd1 postfix/smtp[18237]: 710F5121BDD: to=<Dydayfet@go-speedline.com>, relay=none, delay=21424, delays=21394/0.03/30/0, dsn=4.4.1, status=deferred (connect to go-speedline.com[67.249.162.124]:25: Connection timed out)

the above is a couple of lines from my maillog

I have no idea who or how 'speedline' are getting onto my mail logs - it looks like they are trying to send a message ? What can you pros tell me about this log above I get a lot like this. I see that the connection timed out but should I still be concerned ?

share|improve this question

2 Answers 2

That log is of you attempting to send email TO them, not them connecting to you. Your mail server has failed to connect to theirs and instead has gone into a deferred state. This is the normal behaviour.

I'd reccomend you read the man page of sendmail so you can understand what's happening with it.

share|improve this answer
    
Well if we dont knowingly have any scripts that are sending spam mail out then have we been hacked, I have heard its quite popular for hackers to use legit email server to send out their emails. –  landed Feb 12 '13 at 17:31
    
We can only answer that the behaviour of the mail server is correct. We don't know if the message was intended to be sent or not! If none of your users sent that message, yes, it might be an indication of being hacked or being an open relay. But those messages alone don't say anything one way or another - it's the normal behaviour when you can't contact the destination mail server - for legitimate traffic or illegitimate. –  Scrivener Feb 12 '13 at 17:41
    
Good point thanks. –  landed Feb 13 '13 at 9:17

Possibly. I would be suspicious of the domain go-speedline.com resolving to the IP address 67.249.162.124. In all the dns lookup I did, that domain resolves to 63.249.162.124. Check if your dns is resolving correctly for other domain, in case you have dns poisoning problem.

As far as the email server is concerned, run the mailq command. If you see too many emails in the queue and do not recognize the sender/recipient addresses, you will need to do thorough investigation.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.