On Sun, Oct 22, 2017 at 1:27 PM, Viktor Dukhovni <postfix-us...@dukhovni.org> wrote: > > >> On Oct 21, 2017, at 9:23 PM, Henry <der...@gmail.com> wrote: >> >> # grep 1613DAE169 mail.log >> Oct 20 04:42:12 mail postfix/cleanup[23726]: 1613DAE169: >> message-id=<20171019174212.1613dae...@mydomain.com> >> Oct 20 04:42:12 mail postfix/bounce[23745]: EEA9AA65A2: sender >> non-delivery notification: 1613DAE169 > > This is a bounce (non-delivery report) for an earlier message > with a queue-id of EEA9AA65A2. To determine why you're sending > a bounce, search the logs for "EEA9AA65A2". > >> Oct 20 04:42:12 mail postfix/qmgr[1275]: 1613DAE169: from=<>, >> size=12123, nrcpt=1 (queue active) >> Oct 20 04:42:45 mail postfix/smtp[23915]: 1613DAE169: >> to=<zvnpozz...@brev.krcnet.com>, relay=none, delay=33, >> delays=0.02/0.17/33/0, dsn=4.4.1, status=deferred (connect to >> brev.krcnet.com[69.172.201.153]:25: Connection timed out) > > The purported sending system is down at present. > > -- > Viktor. >
Thanks Viktor, root@mail:/var/log# grep EEA9AA65A2 mail.log Oct 15 06:32:00 mail postfix/qmgr[1275]: EEA9AA65A2: from=<zvnpozz...@brev.krcnet.com>, size=9979, nrcpt=3 (queue active) Oct 15 06:32:03 mail postfix/lmtp[28970]: EEA9AA65A2: to=<me.lastn...@mydomain.com>, relay=mail.mydomain.com[/var/lib/imap/socket/lmtp], delay=9250, delays=9248/2/0.05/0.02, dsn=4.2.2, status=deferred (host mail.mydomain.com[/var/lib/imap/socket/lmtp] said: 452 4.2.2 Over quota SESSIONID=<mail-28976-1508009523-1-8051276567117181905> (in reply to RCPT TO command)) Above repeats 50+ times... My mail server is making hundreds of outbound connections to "69.172.201.153" on port 25 even though there are no users on the system.
