I received some emails with "Suspicious File Alert" subject every days from my CSF firewall which installed on the server.
on this mails said:
Time: Sun May 11 15:01:41 2008
File: /tmp/bd
Reason: Binary executable
Owner: nobody:nobody
Action: No action taken
or some another message.
what's mean of this message?
Since Jan 07, one of our servers has been sending thousands of emails to ne.jp hosts.
Eg from logs:
Code:
Sep 4 19:11:11 debian sm-mta[25383]: l84FY9ME016602: to=, ctladdr= (2001/2001), delay=01:37:02, xdelay=00:00:00, mailer=esmtp, pri=930403, relay=lsean.ezweb.ne.jp., dsn=4.0.0, stat=Deferred: Connection timed out with lsean.ezweb.ne.jp.
Sep 4 19:11:11 debian sm-mta[25383]: l84FYB7d016734: to=, ctladdr= (2001/2001), delay=01:37:00, xdelay=00:00:00, mailer=esmtp, pri=930403, relay=lsean.ezweb.ne.jp., dsn=4.0.0, stat=Deferred: Connection timed out with lsean.ezweb.ne.jp.
Sep 4 19:11:11 debian sm-mta[25383]: l84FY9A4016629: to=, ctladdr= (2001/2001), delay=01:37:02, xdelay=00:00:00, mailer=esmtp, pri=930403, relay=lsean.ezweb.ne.jp., dsn=4.0.0, stat=Deferred: Connection timed out with lsean.ezweb.ne.jp.
Sep 4 19:11:11 debian sm-mta[25383]: l84FY9la016616: to=, ctladdr= (2001/2001), delay=01:37:02, xdelay=00:00:00, mailer=esmtp, pri=930403, relay=lsean.ezweb.ne.jp., dsn=4.0.0, stat=Deferred: Connection timed out with lsean.ezweb.ne.jp.
Sep 4 19:11:11 debian sm-mta[25383]: l84FYCkO016807: to=, ctladdr= (2001/2001), delay=01:36:58, xdelay=00:00:00, mailer=esmtp, pri=930403, relay=lsean.ezweb.ne.jp., dsn=4.0.0, stat=Deferred: Connection timed out with lsean.ezweb.ne.jp.
Sep 4 19:11:11 debian sm-mta[25383]: l84FYB7B016730: to=, ctladdr= (2001/2001), delay=01:37:00, xdelay=00:00:00, mailer=esmtp, pri=930403, relay=lsean.ezweb.ne.jp., dsn=4.0.0, stat=Deferred: Connection timed out with lsean.ezweb.ne.jp.
Sep 4 19:11:11 debian sm-mta[25383]: l84FYCO0016757: to=, ctladdr= (2001/2001), delay=01:36:59, xdelay=00:00:00, mailer=esmtp, pri=930403, relay=lsean.ezweb.ne.jp., dsn=4.0.0, stat=Deferred: Connection timed out with lsean.ezweb.ne.jp.
Sep 4 19:11:11 debian sm-mta[25383]: l84FYDjq016819: to=, ctladdr= (2001/2001), delay=01:36:58, xdelay=00:00:00, mailer=esmtp, pri=930403, relay=lsean.ezweb.ne.jp., dsn=4.0.0, stat=Deferred: Connection timed out with lsean.ezweb.ne.jp.
Sep 4 19:11:11 debian sm-mta[25383]: l84FYBhL016751: to=, ctladdr= (2001/2001), delay=01:37:00, xdelay=00:00:00, mailer=esmtp, pri=930403, relay=lsean.ezweb.ne.jp., dsn=4.0.0, stat=Deferred: Connection timed out with lsean.ezweb.ne.jp.
Sep 4 19:11:11 debian sm-mta[25383]: l84FYDPw016811: to=, ctladdr= (2001/2001), delay=01:36:58, xdelay=00:00:00, mailer=esmtp, pri=930403, relay=lsean.ezweb.ne.jp., dsn=4.0.0, stat=Deferred: Connection timed out with lsean.ezweb.ne.jp.
We're absolutely unable to track or find out who is sending it or how to stop this.
So I'm wondering if it is possible to prevent sendmail from sending to:
lsean.ezweb.ne.jp, OR
docomo.ne.jp, OR
softbank.ne.jp
/var/mail/vhostswww logs are not showing helpful info at all. Eg:
Code:
--l84GRnX5029819.1188924137/debian--
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=ISO-2022-JP
Mime-Version: 1.0
From: hanako.@docomo.ne.jp
Subject:
To: a_j.n-y_bluespider-tattoo@softbank.ne.jp
Message-Id: <200709041410.l84EA0Fh007971@debian>
Date: Tue, 4 Sep 2007 16:10:00 +0200
Tue, 4 Sep 2007 16:10:00 +0200
by debian (8.13.4/8.13.4/Submit) id l84EA0Fh007971;
Received: (from vhostswww@localhost)
for ; Tue, 4 Sep 2007 16:10:00 +0200
by debian (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id l84EA0jk007973
Received: from debian (localhost [127.0.0.1])
Return-Path:
Content-Type: text/rfc822-headers
--l84GRnX5029819.1188924137/debian
Last-Attempt-Date: Tue, 4 Sep 2007 18:42:16 +0200
Diagnostic-Code: SMTP; 550 Invalid recipient:
Remote-MTA: DNS; mx.softbank.ne.jp
Status: 5.1.1
Action: failed
Final-Recipient: RFC822; a_j.n-y_bluespider-tattoo@softbank.ne.jp
Arrival-Date: Tue, 4 Sep 2007 16:10:00 +0200
Reporting-MTA: dns; debian
Content-Type: message/delivery-status
--l84GRnX5029819.1188924137/debian
<<< 503 No recipients specified
550 5.1.1 ... User unknown
<<< 550 Invalid recipient:
>>> DATA
... while talking to mx.softbank.ne.jp.:
----- Transcript of session follows -----
(reason: 550 Invalid recipient: )
----- The following addresses had permanent fatal errors -----
from localhost [127.0.0.1]
The original message was received at Tue, 4 Sep 2007 16:10:00 +0200
--l84GRnX5029819.1188924137/debian
This is a MIME-encapsulated message
Auto-Submitted: auto-generated (failure)
Subject: Returned mail: see transcript for details
boundary="l84GRnX5029819.1188924137/debian"
Content-Type: multipart/report; report-type=delivery-status;
MIME-Version: 1.0
To:
Message-Id: <200709041642.l84GRnX5029819@debian>
From: Mail Delivery Subsystem
Date: Tue, 4 Sep 2007 18:42:17 +0200
Tue, 4 Sep 2007 18:42:17 +0200
by debian (8.13.4/8.13.4/Debian-3sarge3) id l84GRnX5029819;
Received: from localhost (localhost)
Return-Path:
From MAILER-DAEMON Tue Sep 4 18:42:17 2007
--l84GRnX4029819.1188924135/debian--
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=ISO-2022-JP
Mime-Version: 1.0
From: hanako.@docomo.ne.jp
Subject:
To: a_j.n-y_bluespider-tattoo@softbank.ne.jp
Message-Id: <200709041411.l84EB8CS011861@debian>
Date: Tue, 4 Sep 2007 16:11:08 +0200
Tue, 4 Sep 2007 16:11:08 +0200
by debian (8.13.4/8.13.4/Submit) id l84EB8CS011861;
Received: (from vhostswww@localhost)
for ; Tue, 4 Sep 2007 16:11:09 +0200
by debian (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id l84EB8f6011862
Received: from debian (localhost [127.0.0.1])
Return-Path:
Content-Type: text/rfc822-headers
--l84GRnX4029819.1188924135/debian
Last-Attempt-Date: Tue, 4 Sep 2007 18:42:15 +0200
Diagnostic-Code: SMTP; 550 Invalid recipient:
Remote-MTA: DNS; mx.softbank.ne.jp
Status: 5.1.1
Action: failed
Final-Recipient: RFC822; a_j.n-y_bluespider-tattoo@softbank.ne.jp
Arrival-Date: Tue, 4 Sep 2007 16:11:09 +0200
Reporting-MTA: dns; debian
Content-Type: message/delivery-status
--l84GRnX4029819.1188924135/debian
<<< 503 No recipients specified
550 5.1.1 ... User unknown
<<< 550 Invalid recipient:
>>> DATA
... while talking to mx.softbank.ne.jp.:
----- Transcript of session follows -----
(reason: 550 Invalid recipient: )
----- The following addresses had permanent fatal errors -----
from localhost [127.0.0.1]
The original message was received at Tue, 4 Sep 2007 16:11:09 +0200
--l84GRnX4029819.1188924135/debian
This is a MIME-encapsulated message
Auto-Submitted: auto-generated (failure)
Subject: Returned mail: see transcript for details
boundary="l84GRnX4029819.1188924135/debian"
Content-Type: multipart/report; report-type=delivery-status;
MIME-Version: 1.0
To:
Message-Id: <200709041642.l84GRnX4029819@debian>
From: Mail Delivery Subsystem
Date: Tue, 4 Sep 2007 18:42:15 +0200
Tue, 4 Sep 2007 18:42:15 +0200
by debian (8.13.4/8.13.4/Debian-3sarge3) id l84GRnX4029819;
Received: from localhost (localhost)
Return-Path:
From MAILER-DAEMON Tue Sep 4 18:42:15 2007
--l84GRnX3029819.1188924134/debian--
How would I solve this problem as it's making our server load skyhigh 24/7.
Additional info about system:
> Debian Linux, latest kernel
> Sendmail (we've tried postfix, exim, with same results)
> Non cPanel system.
Only one domain suddenly out of the blue is not receiving emails via web or pop3.
- deleted / recreated email
- eximup forced
- domain exists in trueuserdomains, localdomains but not in remotedomains (shouldn't)
- restarted pop server
Mail works fine on the various other domains on this box
cpanel/centos
What could be the cause? Site works fine, made no server edits.
EXIM logs show this for example
2008-01-03 20:20:03 [1643] 1JAcAE-0000QS-Ly ** admin@domain.com F=<root@server.hostdomain.com> P=<root@server.hostdomain.com> R=lookuphost T=remote_smtp: SMTP error from remote mail server after RCPT TO:<admin@domain.com>: host sentry.domainbank.com [64.85.73.28]: 553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1) .......
I have an email account "support(at)anything.com".
I need the emails sent to that account be derivated to different email accounts, for ex:
john(at)anything.com
mary(at)anything.com
And the system save in memory from which address was sent the email, so the next time that an email is sent to support(at)anything.com, this arrives to the same recipient that the first time.
Example:
charly(at)hotmail.com send an email to support(at)anything.com and is derivated to john(at)anything.com.
A month later charly(at)hotmail.com send again an email to support(at)anything.com and the system detect that the address sent an email before to john(at)anything.com, so, now the email will be derivated (or redirected) to john forever.
Exists any software that do that? Any help?
im getting 50 and more spam mails each day, how do i secure my vps to stop 99% of the spam from coming in as i understand theres no way to completely block spams.
Im using directadmin control panel and enabled SpamAssasain but its not much of use even when i apply strict options on it.
i just open a small company for advertising, beside i will make email adviertising campaign, so what i can do for it? i want to know the best way to send this bulk email, the number of emails what i have arround 500000 emails .
View 7 Replies View RelatedI have a problem with outgoing mail because they tend to reach the junk mail of Yahoo, MSN, and GMail.
What can be done to change that?
I have recently switched to GreenGeeks, great company and great support, but I am having a huge problem that all my clients and I are having problems with. No one can send emails to ATT, Verizon, Earthlink, Comcast, Etc. because they bounce back as being blocked. I have contacted them to unblock the IP and they do, but then a few days pass and it's blocked again. WTH? I've contacted GreenGeeks and they are aware of the problem but I really need to move on with this problem, does anyone know of any solution to do?
Example: ....
Hello all....I use an email blasting software for my clients and newsletter and this is what happened: I was at my mother's house and accidentally used the wrong server (I do my marketing on a diff. smtp server) and after I did that when I sent emails to my mother's email address (with the isp she is with) she would not receive my emails.
I called my domain's company and they said there was no problem on their end as I did tests and my emails went through. I called my mom's isp service and they said there was nothing wrong but to email this email address for "blocked" accounts and they never responded but the weird thing is when I send my mother email's, they go through if I send it from the "online backend" of godaddy rather through my MS Outlook.
To make things worse...I have a client who uses TimeWarner and he doesn't get my emails now either! Again...it works if I log-in on the backend but not through my outlook. Is there a port being blocked? I appreciate the responses as I don't know what to do and I need my main email address to send to clients.
So got my dedi the other day. Everything is perfect. However I'm running into some issues.
I have setup some forwarders in cPanel to redirect to my Gmail but unfortunatley I'm not getting them all.
I sent some emails from various address and only received one.
Now I can only think of 3 issues.
1. Something to do with DC/Network.
2. cPanel problem (DC set cpanel up)
3. DNS servers (DC set them)
I have used the mail troubleshooter in WHM and all seems to be fine, it says its sending mail to Gmail so not sure what the problem is.
This is the qmail-send program at ultimatemedicalresearch.theplanet.host.
I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.
<abc@xyz.com>:
TLS connect failed: error:14077410SL routinesSL23_GET_SERVER_HELLOslv3 alert handshake failure; connected to <IP>.
I'm not going to try again; this message has been in the queue too long.
Executed the following commands as root on both servers (recipient and sender):
openssl s_client -connect [host]:993 returns OK both ways.
openssl s_client -connect [host]:995 returns OK both ways.
openssl s_client -connect [host]:465 very slow response. CONNECTED(00000003) appears then it waits for quite some time (>20s). Then it says: 30179:error:14077410SL routinesSL23_GET_SERVER_HELLOslv3 alert handshake failure23_clnt.c:578. This is shown only when I execute the command on server 1. Server 2 hangs also but returns the 220 message which is OK.
It is odd that the above commands return different certificates, not the ones that are set up on the servers. I am using Plesk, I have set up my certificates and assigned them to those IP addresses.
What could be done to make the mailing system between these two server to work ?
I have a problem with sending emails, previously could not send e-mails using port 25, but this is changing under the port 26. and now they are sent.
But probelma now is that when sending emails to gmail and hotmail arrive as SPAM. Yahoo definitely dont get
Similarly using webmail mail arrives as SPAM.
Someone knows how to fix this problem?
Or someone knows how to make the mail arrives well?
Emails are not being sent from my Server,php n SMTP both, I have checked my IP's are not is spam lis, I'm unble to find out the reason,
View 12 Replies View RelatedGot this strange issue here. Comcast customers cannot receive any emails sent from my server. With the others, most of the emails are being sent to a spam folder instead of inbox.
Serve is Centos 5 / Cpanel
I confirmed IP has proper reverse dns and is not blaclisted. I also setup SPF as well.
I create an email address at my site:webmaster@mydomain.com.But it can't receive emails.What's the problem?
Delivery to the following recipient failed permanently:
Technical details of permanent failure:
PERM_FAILURE: Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 530 530 Relaying not allowed (state 14).
I am using couple of emails on my domain since 3 years. I am having a big amount of spam emails. If I use SpamAssassin™ in the Cpanel it will miss sometimes hotmail, yahoo emails etc.. If I disable it, I will continue receiving those spam emails. However, some of my clients uses free emails like hotmail and yahoo.
View 10 Replies View RelatedI have 2 server one is Linux server+Cpanel+CSF firewall where my site is running and one is windows server where my exchange mail server is running .Now thing is that when anyone send mail through my web site (after filling contact form) to me it doesn't come to my email id but when i stop my firewall and then i check contact form and fill it the mail goes to my mail id.
I have php script with SMTP authentication.
which port is blocked in my firewall and after disabling firewall it work.how can i check when firewall is on that time why mails are not coming in my email id that time which port is blocked by firewall.
Allow Port in firewall:-- 25,80,20,21,465,443,110,143
for a week now for some reason noone from my server can send emails or some going some times.i can receive correctly but i cant send.why might be the problem,what i must check.
View 6 Replies View RelatedIn general I have been happy with hostmonster. Mostly because their support staff is polite and are willing to help. However, I do question the server reliability at times.
Lately when a customer registers at my forum or gallery, the customer does not get the activation email 4 or 5 hours later. Today, I tested it and sure enough, the activation email took 4 or 5 hours before it came.
I talked to tech support and they acknowledged they had over 250,000 emails backed up. That there are too many connections with hotmail accounts and that was causing a problem as well.
A customer having to wait 4 or 5 hours before they receive an activation email seems a bit long.
I'm not sure if hostmonster is going to do anything to prevent this from happening in the future, but for now they seem to be satisfied with the emails backing up on the server and the time it takes for them to be sent. They indicated this does not happen often, but I really don't know since I don't send myself emails on a daily basis.
I would rate email as one of the most important functions there is for a webmaster. Otherwise, hostmonster staff has been responsive and my hope is this will not be a constant problem.
If there are any other hostmonster webmasters out there, I would appreciate your feedback. You may have to send yourself a registration or a email to test it.
I have a client who wants to have 100% uptime for his emails only. Is it possible to have 2 hostings with same domain and have the emails goes to any server.
View 18 Replies View RelatedMy server seems to be set up okay and almost everything works except for email.
Sending using Outlook or Telnet both appear to send okay and checking for email also appears to work okay. It is just that no emails are ever received (neither sending or receiving produce any errors on the email client).
In my logs I do see an error:
Jan 2 11:15:05 cobalt sendmail[29380]: l02AF5mA029380: localhost [127.0.0.1] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Jan 2 11:15:05 cobalt dovecot: pop3-login: Aborted login: rip=127.0.0.1, lip=12
I set it to forward those emails to my email, it's not sending any. Does anyone have a clue why? I'm able to receive other emails from the server without any problems.
View 0 Replies View RelatedI have phpnuke installed and i send out weekly newsletters and people seem to get them in their junk box in there email. How can i make it so my emails go to there inbox but not there junk box in their email?
View 4 Replies View RelatedI have a site hosted on a vds with Godaddy. For the past couple of months, every single day I get at least 12 emails coming though with the subject title -
'Status warning from ip-218-119-109-95.ip.secureserver.net'
each email reads something as follows -
System integrity monitor on ip-218-119-109-95.ip.secureserver.net has taken action in responce to an event. Recent event logs are enclosed below for your inspection. There has been 10 events today, if an average of 8 events is reached, e-mail alerts will be terminated for the duration of the day.
>
> - Events Summary:
> Total event count: 10
> Average event count: 3
>
> - Service Summary:
> HTTP [restarted - 8 events]
> DNS [online - 1 events]
> MYSQL [online - 1 events]
>
> - System Summary:
> No system modules enabled - edit conf.sim
>
Can anyone tell me what on earth these emails mean? I don't get much sense out of Godaddy when I ask, they just state it is a monitoring system in place. I really would like to know what all these emails refer to? is it a regular happening, or something to be worried about, or what the heck do they mean?
Would really appreciate if you don't be too technical in your answer as I'm not too familiar with a lot of hosting issues. (Also please note I have altered the ip address in the email details for privacy reasons).
Basically all i want to know is this something I should be worried about?
I wanna install curl on my server its Centos 4.5 and SL told me I have around 30K mails pending on the serve can anyone tell me how to remove them from pending?
View 6 Replies View RelatedI had a strange issue on my VPS this morning. For over an hour the cpu load was very high and the VPS very slow. I couldn't find what was going on but I think a user ran a script to send about 150 emails.
Since this morning, exim can't deliver emails. I'm not sure if it's to all domains or only the 4 that are stuck there now. I tried exim -bh on those domains and I got the following
>>> host in hosts_connection_nolog? no (option unset)
>>> host in host_lookup? no (option unset)
>>> host in host_reject_connection? no (option unset)
>>> host in sender_unqualified_hosts? no (option unset)
>>> host in recipient_unqualified_hosts? no (option unset)
>>> host in helo_verify_hosts? no (option unset)
>>> host in helo_try_verify_hosts? no (option unset)
>>> host in helo_accept_junk_hosts? yes (matched "*")
220-vps.netsimplicite.com ESMTP Exim 4.63 #1 Sat, 24 Feb 2007 19:42:44 -0500
220-We do not authorize the use of this system to transport unsolicited,
220 and/or bulk e-mail.
Was I blocked by these servers or is something wrong on my side?
What configuration do you suggest for email using mainly? Around 20K emails per day. Mail server is Exim, running with Spam Assassin and Clamd
View 10 Replies View Relatedim tryying to setup a forum, but i cannot use email verification, every time i try to send a email it gets bounced back with these details, no matter who i try to send to,hoster has changed to several ips wiht same prob?
This is the qmail-send program at mail.removed.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.
<email removed>:
Connected to ?.?.?.? but sender was rejected.
Remote host said: 550 Your e-mail was rejected for policy reasons on this gateway.
Reasons for rejection may be related to content such as obscene language, graphics, or spam-like characteristics (or) other reputation problems. For sender troubleshooting information, please go to [url]. Please note: if you are an end-user please contact your E-mail/Internet Service Provider for assistance.
--- Below this line is a copy of the message.
Return-Path: <email removed>
Received: (qmail 2710 invoked by uid 48); 27 May 2007 18:15:42 +0100
Date: 27 May 2007 18:15:41 +0100
To: email removed
Subject: vBulletin Email Test
From: "email removed" <big@belley.fsnet.co.uk>
Message-ID: <200705271741.689d1b902386@www.pc-mod.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-Mailer: vBulletin Mail via PHP
You are receiving this email because your email address was entered as an email test at Pc -Mod.
The first step of this email test script has been completed. However, a formatting test is still necessary:
A paragraph break.
A single line break.
Another paragraph break.
Another single line break.
Another single line break.
If the above lines look correct, you are finished. The email features on your server are setup correctly.
If this email is run together on one line, there is possibly a configuration error with your mail server. Please ensure it is configured correctly.
can anyone please help this is doing my hea din now. realy strange.
i know the server is rented from servers4you
After I moved my VB forum to a dedicated server all the emails sent to my members are not getting through. What should I check ?
Im using Cpanel with WHM
A client is not receiving some of her e-mails from one account she has on the server.
She receives most but some are getting lost (not being received or bouncing back)
All other e-mail accounts that she has on our server are receiving e-mail fine.
The missing emails are from different domains so it's not a problem with the people sending the emails.
I deleted and reinstalled the account on the server and got her to delete and reinstall the account in Outlook express.
That didnt work.
There are no spam filters in place either on the her server account or in her e-mail client and we are not using any RBLs to block email.
The missing emails are not in the mail queue either.
I have a P4 2.8GHz Linux box with a Gig of RAM. How many emails per hour could I expect that this server can handle per hour? I would of course want that the server has enough horse power to handle visitors to the web sites.
This is sort of a followup to a previous thread that I started concerning the limit on # of emails per domain per hour. The box came with a [cPanel] default of 500 per hour. Can I expect for my server to be able to handle more than that? 1000? 2000? 10,000? Do I need a more powerful server? I hope not - I just don't have the budget.
[ FYI - The emails are legitimate and not spam. I am sending out email reminders of personal events and holidays to subscribers that enable this option. ]
