1

Here is the situation:

enter image description here

When I run the following on my local machine, the mail server responds:

$ telnet mail.server.com 2525
Trying <mail.server.com IP>...
Connected to mail.server.com.
Escape character is '^]'.
220-<provider-server-name> ESMTP Exim 4.82 #2 Sun, 05 Apr 2015 11:49:13 -0500 
220-We do not authorize the use of this system to transport unsolicited, 
220 and/or bulk e-mail.

And it responds to my commands.

When I run the same command from the bad server, I get:

$ telnet mail.server.com 2525
Trying <mail.server.com IP>...
Connected to mail.server.com.
Escape character is '^]'.

This text is missing:

220-<provider-server-name.com> ESMTP Exim 4.82 #2 Sun, 05 Apr 2015 11:49:13 -0500 
220-We do not authorize the use of this system to transport unsolicited, 
220 and/or bulk e-mail.

And it doesn't respond to my commands. I cleaned all iptables rules, accepting everything on bad server. Then I tried to setup a blocking rule on port 2525 to check, that maybe something is wrong with iptables. 

# /sbin/iptables -A OUTPUT -p tcp --dport 2525 -j DROP
# telnet mail.server.com 2525
Trying <mail.server.com IP>...

It can't connect. So, it's not iptables.

SELinux is off:

# sestatus
SELinux status:                 disabled

I have no idea, what could be blocking SMTP traffic. It connects to server, but I get no response from it. Admins on SMTP server checked and said, that bad server is not inside it's blacklist.

Improve this question
2
  • If the server answers, it is definitely not iptables. Check your Exim configuration whether the server is allowed to use the SMTP. For relay, you should of course have some kind of authentication, too. – Esa Jokinen Apr 5 '15 at 17:24
  • Have you access to the mail server log? That might contain more information. – sth Apr 5 '15 at 17:41
4

Long waiting for SMTP greeting

How long do you wait to get SMTP greeting message?
Exact duration in seconds may provide very important hint.

AFAIR some servers issue SMTP greeting message after doing DNS lookups (IP address -> DNS name -> IP address). Typical timeout for single DNS query is 75s. DNS is not the only suspect (e.g. ident timeout may be 30s).

Improve this answer
7
  • I didn't wait for long. Cause on my machine I got instant response. How can I check the incorrect DNS lookup on the mail server? – user4035 Apr 5 '15 at 17:37
  • Check if you get the SMTP greeting after (long) delay. Exact duration of the delay may provide very important hint. DNS is not the only suspect. – AnFi Apr 5 '15 at 18:06
  • Yes, I get the response in 2 minutes 20 seconds. How to check, what's wrong with DNS? – user4035 Apr 5 '15 at 18:10
  • I have seen this behaviour if this machine is not in DNS and the nameserver list includes IP-numbers not able to respond so timeouts have to occur. – Thorbjørn Ravn Andersen Apr 5 '15 at 18:15
  • Maybe you listed multiple DNS servers in your /etc/resolv.conf and some of them are unreachable/faulty. – Manuel Faux Apr 5 '15 at 20:33
2

Did you look in /etc/hosts.deny ?

Improve this answer
7
  • It can't be host, cause the connection to SMTP server is established. But I get no data from it. – user4035 Apr 5 '15 at 17:34
  • 2
    No, actually, that's the "normal" behaviour when something is blocked by TCP wrappers. It will allow the initial connection, but after that it drops. Try it with something like ssh and you'll see that exact behaviour. – DictatorBob Apr 5 '15 at 17:38
  • hosts.deny on the mail server or bad server? – user4035 Apr 5 '15 at 17:38
  • On the mail server. Might as well check /etc/hosts.allow at the same time. – DictatorBob Apr 5 '15 at 17:39
  • 1
    The "short cut" is to add the IP of your "bad server" in /etc/hosts on the mail server. But you might want to look into it a little deeper. If the mail server is unable to do DNS lookups, every host will get this delay. If it's just an issue with your "bad server" not having a DNS reverse mapping, I dont see why that would cause such a delay. – DictatorBob Apr 5 '15 at 17:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.