Tag Info

New answers tagged

-2

FYI The difficulty with /24 blacklists is NOT mistakenly punishing innocent senders who happen to have IP allocation separate from the spammers, but which shares the same /24 block. And that is precisely why ivmSIP/24 is so new. For this very reason, we were reluctant to get into this /24 business. Until one day, several “light bulbs” went off ...


0

If it's not a DNS problem, the blacklisted IP may be a 3rd party IP and not yours. Check your routing configuration to see if any packets are redirected via another than default normal path. They may explain why your original IP is clean but mails are still blocked with blacklisted IP.


0

Use this tool http://mxtoolbox.com/supertool.aspx to make sure your server is setup properly. Likely you just missed a DNS record. "If you are on RATS-Dyna, your reverse DNS is probably not set up correctly." http://spamrats.com/removal.php


1

I installed Declude (which is free) and Message Sniffer (which isn't) and over the past 4 days I've seen one spam message come in my test email account, as opposed to the dozens it was getting per day. As far as I can tell, we haven't had good email filtered out. Spamassassin would probably also be a good solution although I didn't have any luck with it ...


7

This quesiton is so broken that I'm going to break with ServerFault protocol here and respond to the question with some of my own questions to point out 1) How it could be improved, and 2) why control panels and web host helper applications are bad. Title: Individual accounts being spammed on server, even though DNS not hosted What do you mean "DNS not ...


1

This line Feb 25 14:25:22 web postfix/smtpd[31725]: 34C89740E40: client=unknown[213.6.194.39], sasl_method=PLAIN, sasl_username=contact@example.com tells us that someone sends email via your server after SMTP auth with username contact@example.com. In this stage, spammer has likely know your password of that user. Feb 25 14:25:26 web ...


0

This looks to me like you have a web page that is being used to send mail to user-input email addresses - thus you may or may not be an actual mail relay, but you are being used as an origin for spam.


1

Spoofing the "Referer" header is really easy, and I have seen many times scrapers and bots doing that. It would be great if you could sniff that TCP traffic and show us how these HTTP requests look like. Tcpdump can do the trick; It depends on your environment, but give it a try: $ tcpdump -i eth0 -A -vvv -s 500 'tcp port 80 and ip[2:2] > 40 and ...


1

You can try submitting the form with no error code selected, and hope for the best. If you're lucky, a human being might read it. You can also try contacting AOL Postmaster by phone, on +1 703 265-4670 (reportedly AOL postmaster operations are now being handled in India; you've been warned).


1

Checking around for similar errors, and looking through AOL's Postmaster errors, nothing immediately ties up with what you've reported but doing some cross-referencing (for example from this thread), the linked error codes (521 5.2.1 which you reference in your question) are possibly linked to the 421 CON:B1 error code from the above-linked error code list ...


1

Let's split it per statement Servers that reject all bounce mails (contrary to the RFCs). Yes, this misconfigured server rejects all email with sender <>. To work around this problem, postfix, for example, uses either the local postmaster address or an address of "double-bounce" in the MAIL FROM part of the callout. Yes, this workaround ...


1

Look to this diagram, there are three independent entrances where the email could enter postfix, sendmail (via pickup), smtpd and qmqpd. The last entrance was rarely used here. When email send through smtpd, then the email source likely from outside (the exception when connection from 127.0.0.1). Outside email was considered untrusted obivously. So, postfix ...


2

Looks like you just became quite popular. Someone must have placed a link to some of your articles. this is one of the largest russian professional communities this is one of the largest russian entertainment sites this is mobile subsite of p. 1. this is the most popular russian social network


-1

Feature you are talking about already exists out of the box in Plesk 12 http://download1.parallels.com/Plesk/Doc/en-US/online/plesk-administrator-guide/index.htm?fileName=71349.htm


3

Look for the Barracuda "Deep-Header Scan" feature. Depending on your unit and firmware revision, it's likely masked under the IP Configuration > Trusted Forwarder setting. Trusted Forwarder Configuration Enter the IP addresses of machines that you have set up to forward email (i.e. Trusted Forwarders) to the Barracuda Spam & Virus Firewall ...


1

The only reasonable thing I can suggest is to make your forwarding use SRS so that any SPF checks use the originating sender. But ultimately it comes down to the "their servers, their rules" problem. If you don't want to pay Google for their services then they can do what they want and leave you with nobody to talk to. SRS info: http://www.openspf.org/SRS


2

I've sold/deployed lots of Barracuda Spam Filters over the year. I don't use the quarantine feature in any of my deployments. Without even addressing the unique mail flow issues you have (use distribution groups?), it's not necessary. Is there a reason your users would request the quarantine functionality?


0

Have you checked the domain with MX Toolbox and perhaps intoDNS tools? It could be that you do not have a proper PTR record (reverse DNS record) connected to the sending server IP address/domain. As explained on this site: Reverse DNS is setup very similar to how normal (forward) DNS is setup. When you delegate forward DNS the owner of the domain tell ...


2

Do not install the DNS role on your Exchange server. Do not configure the Exchange server NIC to use DNS servers other than the DNS servers that service your AD domain. Contact Vamsoft regarding that recommendation to find out exactly what they mean. It's not clear to me from reading the Deployment Guide what DNS servers they're referring to but the Best ...



Top 50 recent answers are included