Re: whois

2014-11-05 Thread Michael J Wise
> Anybody on this list run whois on spams? Yes, all the time, but only to get CIDR ranges, not for Abuse addresses. And this ... is *NOT* the list to talk anti-spam techniques. > Would like to report sources and spammed domains, but... SpamCop. Aloha mai Nai`a. -- " So this is how Liberty die

Re: whois

2014-11-05 Thread Michael J Wise
> Anybody on this list run whois on spams? Yes, all the time, but only to get CIDR ranges, not for Abuse addresses. And this ... is *NOT* the list to talk anti-spam techniques. > Would like to report sources and spammed domains, but... SpamCop. Aloha mai Nai`a. -- " So this is how Liberty die

whois

2014-11-05 Thread Joseph Brown
Anybody on this list run whois on spams? I’ve been struggling w/spam lately, some malware somewhere nabbed emails addy's, now I’m getting spammed a lot. Would like to report sources and spammed domains, but… I have fears of the malevolent… Wondering if you guys have any suggestions. -Joe

Re: tcp_table: flag_pattern vs flag_fixed

2014-11-05 Thread Damian Lukowski
Am 05.11.2014 17:31, schrieb Wietse Venema: > Viktor Dukhovni: >> On Wed, Nov 05, 2014 at 10:47:33AM -0500, Wietse Venema wrote: >> >>> postfix-us...@arcsin.de: Since the tcp_table is consulted with a full address, it can produce wrong answers even if it is placed at the last position of

Re: tcp_table: flag_pattern vs flag_fixed

2014-11-05 Thread Wietse Venema
Viktor Dukhovni: > On Wed, Nov 05, 2014 at 10:47:33AM -0500, Wietse Venema wrote: > > > postfix-us...@arcsin.de: > > > Since the tcp_table is consulted with a full address, it can produce wrong > > > answers even if it is placed at the last position of transport_maps. > > > > I have a revolutiona

Re: lost connection with [mail server] while performing the EHLO handshake after TLS established

2014-11-05 Thread Viktor Dukhovni
On Wed, Nov 05, 2014 at 03:30:06PM +, Viktor Dukhovni wrote: > > recorded it appears that our customer's system is sending a [RST, ACK] > > packet directly after sending "TLSv1 Application Data", which very > > probably is its EHLO. > > You may have read the wrong direction for the Applicatio

Re: Correction

2014-11-05 Thread J.
Ok, thanks. From: Wietse Venema To: Postfix users Sent: Wednesday, November 5, 2014 7:59 AM Subject: Re: Correction [actual quote from qmail non-delivery notification, address anonymized] > : > Remote host said: > 550 5.7.1 Spam not accepted here. > [BODY]

Re: Correction

2014-11-05 Thread Wietse Venema
[actual quote from qmail non-delivery notification, address anonymized] > : > Remote host said: > 550 5.7.1 Spam not accepted here. > [BODY] > > --- Below this line is a copy of the message. > > Received: from [etc...] [actual Postfix configuration details] > header_checks: > /Subject: VvVvV/

Re: tcp_table: flag_pattern vs flag_fixed

2014-11-05 Thread Viktor Dukhovni
On Wed, Nov 05, 2014 at 10:47:33AM -0500, Wietse Venema wrote: > postfix-us...@arcsin.de: > > Since the tcp_table is consulted with a full address, it can produce wrong > > answers even if it is placed at the last position of transport_maps. > > I have a revolutionary suggestion: DO NOT REPLY WIT

Re: Correction

2014-11-05 Thread J.
header_checks: /Subject: VvVvV/ REJECT Spam not accepted here. body_checks:/VvVvV/ REJECT Spam not accepted here. From: Wietse Venema To: Postfix users Sent: Wednesday, November 5, 2014 7:15 AM Subject: Re: Correction J.: > This is the message failur

Re: tcp_table: flag_pattern vs flag_fixed

2014-11-05 Thread Wietse Venema
postfix-us...@arcsin.de: > Since the tcp_table is consulted with a full address, it can produce wrong > answers even if it is placed at the last position of transport_maps. I have a revolutionary suggestion: DO NOT REPLY WITH INCORRECT INFORMATION. Wietse

Re: tcp_table: flag_pattern vs flag_fixed

2014-11-05 Thread postfix-users
Wietse Venema: > Damian Lukowski: >> Hi, >> >> is there a reason that tcp_table has the DICT_FLAG_PATTERN flag >> instead of DICT_FLAG_FIXED? One could create more flexible transport >> map chains if tcp_table was also queried for pure domains. > Like pcre, regexp, and socketmap, tcp_table is quer

Re: lost connection with [mail server] while performing the EHLO handshake after TLS established

2014-11-05 Thread Viktor Dukhovni
On Wed, Nov 05, 2014 at 01:27:49PM +0100, Tobias Reckhard wrote: > Nov 5 12:36:45 pxmail1 postfix/smtp[8378]: > Trusted TLS connection established to > mail01.i-sec.tuv.com[193.24.224.9]:25: > TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits) > Nov 5 12:36:45 pxmail1 postfix/smtp[8378]:

Re: header checks/body checks

2014-11-05 Thread Noel Jones
On 11/4/2014 6:38 PM, J. wrote: > > No, the "[BODY]" line is sent to the connecting server with the > error that I write. I didn't write it. Here's a sample rejected > message when I sent a test message from my web-mail to my postfix > server: > > Remote host said: > 550 Spam not accepted. > [BOD

Re: Correction

2014-11-05 Thread Wietse Venema
J.: > This is the message failure notice I received from my web-mail > related to the log file entry (the second one I believe) The only > thing I'm changing is the email address. I don't include what > follows the received from because that's just the web mail co's > ip addresses etc. I'm not sure

Re: Correction

2014-11-05 Thread J.
I do not put HTML in my config. Postfix writes a snip of each message in the log when it rejects a message that matches a body_check rule (and often emails have HTML in their body as I'm sure you know). Here's a test rule that I created so I could send a message that would be rejected and allow

Re: Correction

2014-11-05 Thread J.
This is the message failure notice I received from my web-mail related to the log file entry (the second one I believe) The only thing I'm changing is the email address. I don't include what follows the received from because that's just the web mail co's ip addresses etc. I'm not sure what you'r

Re: tcp_table: flag_pattern vs flag_fixed

2014-11-05 Thread Wietse Venema
Damian Lukowski: > Hi, > > is there a reason that tcp_table has the DICT_FLAG_PATTERN flag > instead of DICT_FLAG_FIXED? One could create more flexible transport > map chains if tcp_table was also queried for pure domains. Like pcre, regexp, and socketmap, tcp_table is queried only with the full

tcp_table: flag_pattern vs flag_fixed

2014-11-05 Thread Damian Lukowski
Hi, is there a reason that tcp_table has the DICT_FLAG_PATTERN flag instead of DICT_FLAG_FIXED? One could create more flexible transport map chains if tcp_table was also queried for pure domains. Regards Damian

Re: Why is there msg id in logs but no recipient?

2014-11-05 Thread Wietse Venema
Tobi: > > > maybe connection lost or something similar > > not all loglines contain the queue-id > Hi > > thanks for your input. After greping for the ip I could see 'timeout > after data' > But I still wonder why there is a message-id logged? Is the message-id > generated before the complete tra

lost connection with [mail server] while performing the EHLO handshake after TLS established

2014-11-05 Thread Tobias Reckhard
Hello I'm experiencing the above problem on a customer's system while trying to send mail to the domain i-sec.tuv.com -- I've replaced the HELO/EHLO of our customer with mail.customer. The logs say: Nov 5 12:36:45 pxmail1 postfix/smtp[8378]: < mail01.i-sec.tuv.com[193.24.224.9]:25: 220 mail01.i-

Re: Correction

2014-11-05 Thread Wietse Venema
J.: > I don't think my assumption is completely unwarranted. I created a > header_checks rule and then sent a message from outside our system and this > shows up in the log: > > Nov 4 12:09:24 kest postfix/cleanup[13287]: 375FR2F2491F: reject: header > Subject: VvVvV test message...[etc] > >

Re: Why is there msg id in logs but no recipient?

2014-11-05 Thread Cristiano Deana
On Wed, Nov 5, 2014 at 11:37 AM, Tobi wrote: Hi, > Nov 5 05:26:44 213.196.149.XX postfix/smtpd[30553]: B93D2180036: > client=unknown[188.119.245.XX], sasl_method=LOGIN, > sasl_username=our_u...@example.com > Nov 5 05:26:46 213.196.149.XX postfix/cleanup[30375]: B93D2180036: > message-id=<0

Re: Why is there msg id in logs but no recipient?

2014-11-05 Thread Tobi
Am 05.11.2014 um 11:40 schrieb li...@rhsoft.net: > Am 05.11.2014 um 11:37 schrieb Tobi: >> I got a imho weird problem with understanding the logs. We have an >> client that authenticates correctly which generates an id from postfix. >> If I grep this id through the logs I can see a logline with a

Re: Why is there msg id in logs but no recipient?

2014-11-05 Thread li...@rhsoft.net
Am 05.11.2014 um 11:37 schrieb Tobi: I got a imho weird problem with understanding the logs. We have an client that authenticates correctly which generates an id from postfix. If I grep this id through the logs I can see a logline with a message-id. But why there is no recipient? Nov 5 05:26:4

Why is there msg id in logs but no recipient?

2014-11-05 Thread Tobi
Hi list I got a imho weird problem with understanding the logs. We have an client that authenticates correctly which generates an id from postfix. If I grep this id through the logs I can see a logline with a message-id. But why there is no recipient? << Nov 5 05:26:44 213.196.149.XX postfix/smt

Re: Correction

2014-11-05 Thread li...@rhsoft.net
Am 05.11.2014 um 06:45 schrieb J.: I don't think my assumption is completely unwarranted. I created a header_checks rule and then sent a message from outside our system and this shows up in the log: Nov 4 12:09:24 kest postfix/cleanup[13287]: 375FR2F2491F: reject: header Subject: VvVvV test me

Re: header checks/body checks

2014-11-05 Thread li...@rhsoft.net
Am 05.11.2014 um 03:07 schrieb J.: Maybe I don't know the name of notification where this message comes from, but it is certainly postfix. I admin the "remote host" that "said" that. I entered the text "Spam not accepted" in my body_checks file, and the next line I don't know how to control. I w

Re: header checks/body checks

2014-11-05 Thread li...@rhsoft.net
Am 05.11.2014 um 03:07 schrieb J.: Maybe I don't know the name of notification where this message comes from, but it is certainly postfix. I admin the "remote host" that "said" that. I entered the text "Spam not accepted" in my body_checks file, and the next line I don't know how to control. I w