[OT] bounced messages

James Moe <jimoe@xxxxxxxxxxxxxxxxxxxxxxxxxx> · Mon, 13 Aug 2018 12:43:36 -0700

Hello,
  I received a note from the list manager complaining that our server
has rejected an unconscionable number of message.
  Has there been some configuration change of the mailing list recently?

  There are reasons for the rejections: our SPAM filter.
 1. The filter found one set of messages being sent from a blocklisted
site (23.83.215.44), and rejected the messages.
 2. The filter uses a greylist to decide about the validity if a sender
(nearly 2/3 of spam is rejected this way). The list does not retry
delayed messages?

  This particular site (or IP range) is often blocklisted.
$ host 23.83.215.44
44.215.83.23.in-addr.arpa domain name pointer
crimson.oak.relay.mailchannels.net.

----[ sample of Blocklisted IP ]----
2018-08-13_10:53:45 82822-18122 [Worker_1] [TLS-in] [TLS-out]
[FromMissing] 23.83.215.44
<users-return-117706-jimoe=sohnen-moe.com@xxxxxxxxxxxxxxxx> to:
jimoe@xxxxxxxxxxxxxx [scoring] multiple (2) 'From:' header tags found (
DoNoFrom )
2018-08-13_10:53:45 82822-18122 [Worker_1] [TLS-in] [TLS-out]
[FromMissing] 23.83.215.44
<users-return-117706-jimoe=sohnen-moe.com@xxxxxxxxxxxxxxxx> to:
jimoe@xxxxxxxxxxxxxx [scoring] missing or invalid address in (2) 'From:'
header tag(s) ( DoNoFrom )
2018-08-13_10:53:45 82822-18122 [Worker_1] [TLS-in] [TLS-out] [DNSBL]
23.83.215.44 <users-return-117706-jimoe=sohnen-moe.com@xxxxxxxxxxxxxxxx>
to: jimoe@xxxxxxxxxxxxxx [spam found] (DNSBL, 74.6.131.124 listed in
safe.dnsbl.sorbs.net) [Re users httpd Problem setting up ssl] ->
/usr/local/bin/assp2/spam-yes/18122.eml;

2018-08-13_10:53:45 82822-18122 [Worker_1] [TLS-in] [TLS-out]
23.83.215.44 <users-return-117706-jimoe=sohnen-moe.com@xxxxxxxxxxxxxxxx>
to: jimoe@xxxxxxxxxxxxxx [SMTP Error] 554 5.7.1 DNS Blacklisted by
safe.dnsbl.sorbs.net

2018-08-13_10:53:45 82822-18122 [Worker_1] [TLS-in] [TLS-out]
23.83.215.44 <users-return-117706-jimoe=sohnen-moe.com@xxxxxxxxxxxxxxxx>
to: jimoe@xxxxxxxxxxxxxx finished message - received DATA size: 10.95
kByte - sent DATA size: 0 Byte
2018-08-13_10:53:45 82822-18122 [Worker_1] [TLS-in] [TLS-out]
23.83.215.44 <users-return-117706-jimoe=sohnen-moe.com@xxxxxxxxxxxxxxxx>
to: jimoe@xxxxxxxxxxxxxx disconnected: session:7F62DD6BBCE0 23.83.215.44
- processing time 4 seconds
2018-08-13_10:53:45 [Worker_1] Worker_1 will sleep now
----[ end ]----

----[ sample of greylisted response ]----
2018-08-13_01:52:11 [Worker_1] Worker_1 wakes up
2018-08-13_01:52:11 [Worker_1] Connected: session:7F62FA585BC0
23.83.215.32:20236 > 192.168.69.246:25 > 192.168.69.246:125
2018-08-13_01:52:11 [Worker_1] 23.83.215.32 info: got STARTTLS request
from 23.83.215.32
2018-08-13_01:52:12 50332-03786 [Worker_1] [TLS-in] [TLS-out]
23.83.215.32 <users-return-117704-jimoe=sohnen-moe.com@xxxxxxxxxxxxxxxx>
info: found message size announcement: 6.94 kByte
2018-08-13_01:52:12 50332-03786 [Worker_1] [TLS-in] [TLS-out]
23.83.215.32 <users-return-117704-jimoe=sohnen-moe.com@xxxxxxxxxxxxxxxx>
to: jimoe@xxxxxxxxxxxxxx recipient delayed: jimoe@xxxxxxxxxxxxxx
2018-08-13_01:52:12 50332-03786 [Worker_1] [TLS-in] [TLS-out]
23.83.215.32 <users-return-117704-jimoe=sohnen-moe.com@xxxxxxxxxxxxxxxx>
to: jimoe@xxxxxxxxxxxxxx [SMTP Status] 451 4.7.1 Please try again later
- are you for real?
2018-08-13_01:52:12 50332-03786 [Worker_1] [TLS-in] [TLS-out]
23.83.215.32 <users-return-117704-jimoe=sohnen-moe.com@xxxxxxxxxxxxxxxx>
to: jimoe@xxxxxxxxxxxxxx disconnected: session:7F62FA585BC0 23.83.215.32
- processing time 1 seconds
2018-08-13_01:52:12 [Worker_1] Worker_1 will sleep now
----[ end ]----

-- 
James Moe
moe dot james at sohnen-moe dot com
520.743.3936
Think.