Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I found this in my log server:

sm-mta[11410]: r9BKb6YY021119: to=<woodhzve@ralphlaurensoldes2.com>, ctladdr=<info@188.com> (33/33), delay=2+07:24:18, xdelay=00:00:01, mailer=esmtp, pri=29911032, relay=mail1.mkuku.com. [58.22.50.83], dsn=4.0.0, stat=Deferred: Connection refused by mail1.mkuku.com.

This message is repeated every 10-30 seconds with a different "to" address.

What is this? Is my server being used to send spam?

share|improve this question
    
I think that some details are missing like what SMTP server are you using and who's mail1.mkuku.com. You should also improve the formatting a bit, e.g use the {} (code sample) button for your logs. –  Cristian Ciupitu Oct 19 '13 at 13:37
add comment

2 Answers

up vote 3 down vote accepted
+50

This message essentially tells you that one of your users tried to send an email to an account that is handled by the mail1.mkuku.com server, but it failed. For each failed email, sendmail keeps it in its queue, and retries to send it later. The output of mailq will display all of the emails currently in the queue and then you can delete them selectively from /var/spool/mqueue (if you so desire).

There are two reasons as to why this failure occurs:

  • The remote server's firewall is refusing connections from your server, or
  • The SMTPd on the remote server has crushed.

You can test the connectivity with nmap to verify if the issue persists: nmap -sS mail1.mkuku.com -p 25. If the port is not reported as open, you might want to contact the administrators of that domain to add an exception to their firewall.

As to if your server is sending spam, I'm afraid that I can't answer that for you. You should check your logs to see if all the mails are coming from the same sender, and analyze his/hers usage patterns. For example, you could see whether the emails are being sent in batches and whether the user logs in from a trusted network or for example, some "weird" ip in colombia.

PS. You might want to check projecthoneypot to see if your IP has been registered as a spammer.

share|improve this answer
add comment

There are information missing, SMTP logs are made in multiple lines, usually four of them. In your log

sm-mta[11410]: r9BKb6YY021119: to=<woodhzve@ralphlaurensoldes2.com>

The r9BKb6YY021119 part is the Message ID, so if your search your log file for it, you will find the complete message and, most important, the from= part, that tells if the e-mail was sent by a legitimate user or not.

The only possible answer from your excerpt is that the destination server has refused the message.

There are some sites and tools you may use to verify your e-mail server:

http://mxtoolbox.com/diagnostic.aspx - will make a series of short tests on your server http://www.spamhelp.org/shopenrelay/ - will test if your server is open for relay http://www.dnsgoodies.com/ - has also a tool to check if your server is figuring on dns relay databases

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.