Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When looking at my mail log I have noticed the following:

mail/mail.log.3:297:Mar 30 18:31:21 www postfix/smtp[21129]: 7A6C51014035D: to=<>,[]:25, delay=12, delays=0.01/0/10/2.1, dsn=2.0.0, status=sent (250 2.0.0 s2UAS7BE024449 Message accepted for delivery)

The text here [] contain the word "spam". Can I assume that the email is marked as spam?

share|improve this question

No. For better or for worse, this turns out to be their main mail server:

[me@risby ~]$ dig mx
;; ANSWER SECTION:      3600    IN  MX  1      3600    IN  MX  10

I'm not sure why anyone would call their primary mail server by such a name, but it's just a name. They may well have filed your email as spam, but if they have, it won't be because of the name of the server.

share|improve this answer

They may be using as a spam filter. A proper email server will try and if that fails then try Spambots are likely to try only one address. By using two addresses it is possible to use this connection sequence to filter some email. There may slightly delay email deliveries to them, but should not cause you email to be classified as spam.

Their broken SPF record indicates they may send email from either server. If you see email arriving from, this does not indicate that the message is spam.

If they use a database to track source addresses, it is possible to identify sending programs that do not follow the standard and connect to the mail servers in the correct order. How they handle senders that do not follow standards is up to them, but I would block all such senders that don't pass rDNS verification. Failed addresses can be agressively removed from the database. It would be appropriate to keep passing addresses in the database, flagged accordingly.

EDIT: Based on the behavior of their servers they may be failing mail delivered to the backup server and accepting mail delivered to the preferred mail server This will cause spambots which send to backup mail servers to fail.

share|improve this answer
Umm, are you sure you meant to give the same hostname twice? If you were thinking that a second delivery attempt would try, that makes sense - except that (a) a well-behaved MTA would only try that after failing to contact the lower-weight server, and the lower-weight server is fine, and (b) I already tried, and doesn't seem to be accessible on port 25. – MadHatter Mar 31 '14 at 12:46
@MadHatter Yes, I meant to use different names. When I tried neither server responded. They may have found spambots were hitting the higher priority address. – BillThor Apr 1 '14 at 2:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.