I'd like to seek help on how to read eximlog file. I saw the below inside eximlog. I'm wondering now because realemail@domain.com does not exist on this user emailaddress when I browse his cpanel. Now who is sending it? the only correct info is the pixelxl which is the user.
2007-03-25 14:49:41 1HVMXt-0000SV-7j => pixelxl <realemail@domain.com> F=<vsbqd@domain.com> R=localuser T=local_delivery S=2213
2007-03-25 14:49:41 1HVMXt-0000SV-7j Completed
What are the best ways to block outgoing spam? Installing APF would help ful?
Any other idea for outgoing spam?
I am trying to make sure my server configuration is optimally set to prevent my outgoing activation emails being set as spam.
so far I have set up an SPF record - Using Plesk for mydomain.com set up a DNS record of type TXT and value v=spf1 mx -all.
How do I check if this has been set up correctly?
I am using CentOS with Apache and Plesk 8.3 and I am sending mail using PHP's mail() function. The majority of the emails that aren't being received are going to hotmail accounts but I haven't yet sent a large enough amount of emails to view any concrete pattern. Curiously they don't appear to be going to the user's spam folder they are just being deleted outright.
Also, I'm not sure if it's related but one of my users mistyped their email address as @gogglemail.com and I now have a message in the qmail mail queue which is dated 1970. Is this something I am failing to do at a PHP level (i.e. not setting a date attribute)?
Can you share your mod_security rules to stop outgoing spam? (most generated by php contact forms)
And for incoming?
I would like to know what rules can work with mod_security 1.9.4.
I'm wondering if theres anything I can install on the server that will either filter or track outgoing spam. I don't want to limit the number of emails sent per hour or anything, I just want to be able to maybe search through some flagged emails or something. Or if they send the exact same email more than x times it can disable their account... I'm not sure
View 1 Replies View RelatedA user in my server trying to send email, but email is flagged as "Absolute Spam" by Spamassassin. It says IP is listed in SBL/XBL.
There is an IP address in "Received-From" part of the headers. That IP is actually listed in several spam databases, but not my server's IP (Below, red and bold).
Email is sent from my server, but how come "From" IP is different from mine?
Headers of the email are below:
Quote:
Received: from [203.215.94.252] (helo=[10.0.0.7])
by server1.kanmonline-server101.net with esmtp (Exim 4.63)
(envelope-from <*********@sweetmail.org>)
id 1HQ3Yj-0007jV-6J
for ************@ezweb.ne.jp; Sun, 11 Mar 2007 00:32:37 +0900
Mime-Version: 1.0 (Apple Message framework v624)
In-Reply-To: <**********************@nm03imap01c.ezweb.ne.jp>
References: <**********************@nm03imap01c.ezweb.ne.jp>
Content-Type: text/plain; charset=ISO-2022-JP; delsp=yes; format=flowed
Message-Id: <98108bd45ea8b8bbd10cc7c35b6fad81@sweetmail.org>
Content-Transfer-Encoding: 7bit
From: =?ISO-2022-JP?B?GyRCOWI2NhsoQiAbJEIwITUqO1IbKEI=?= <**********@sweetmail.org>
Subject: Re:
Date: Sat, 10 Mar 2007 23:32:34 -0800
To: *********@ezweb.ne.jp
X-Mailer: Apple Mail (2.624)
I have a linux VPS with WHM and exim 4.68.
What common settings can I configure to not have emails sent to spam folder for mail servers like gmail, yahoo, and hotmail?
Reverse DNS seems to work, on dnsstuff.com my server name comes up for my IP.
mail.domain.com is coming up as the same IP as reverse DNS.
SPF record is set up for the domain.
I just did the update to 12.0.18 #6 and everything seemed to go pretty well. One feature we were really interested in was the Outgoing Spam Filter. Unfortunately, the error I see when I go to that feature reads, "Protection : Not active. There are some problems that prevent the service from being started."
When I Google that error, I'm brought to some KB articles but they are all for the older Outgoing Spam Filter that you need a license key for. I don't believe that is the case any more - if it is, I don't know where to get the key. I will say point out I'm a bit of a Linux novice (we are running CentOS 6.5 on this server), so I'm not really sure where to look....
I have a hard problem with my VPS. I have postfix as mail server on plesk 12 under ubuntu 12.
I dont know why the outgoing mails of all my domains in my servers are getting spam in servers like gmail, yahoo, hotmail...
I'm using mxtoolbox to fix errors and warnings and finally fixed all of them, but my mails are still outgoing to spam.
In mxtoolbox actually I have no mail server errors / warning, u can see it with, for example, this one of my domains: [URL] ....
Headers:
This message is an automatic response from Port25's authentication verifier service at verifier.port25.com. The service allows email senders to perform a simple check of various sender authentication mechanisms. It is provided free of charge, in the hope that it is useful to the email community.
[Code] ....
The problem is that all the mail that exits my VPS server (OVH) is going to the spam folders of Gmail, Outlook, etc accounts.
I've tried to connect my Gmail account to check via POP3 my inbox on my VPS, and all I get is an SSL error.
I have some error when the new outgoing spam protection (limitation for outgoing mail) is enabled. Mail clients are unable to use SMTP for sending mails. "My mail client says: The message could not be sent. You are not allowed to use sendmail utility."
I don't undestand the blocking behaviour since the checkbox "Allow scripts and users to use Sendmail" is checked and no limit is exeeded.This is the relevant log part of maillog:
Code:
Jul 3 00:44:36 srv01 postfix/smtpd[3326]: C0E5182A20: client=46.128.x.x.dynamic.cablesurf.de[46.128.x.x], sasl_method=CRAM-MD5, sasl_username=info@domain.de
Jul 3 00:44:36 srv01 postfix/cleanup[3331]: C0E5182A20: message-id=<0A380CA8-AAE3-4FA8-BA7A-A3FDF7CD16E2@domain.de>
Jul 3 00:44:37 srv01 /usr/lib/plesk-9.0/psa-pc-remote[3280]: handlers_stderr: DATA REPLY:554:[B]5.7.0 The message could not be sent. You are not allowed to use sendmail utility.[/B] REJECT
Jul 3 00:44:37 srv01 /usr/lib/plesk-9.0/psa-pc-remote[3280]: REJECT during call 'limit-out' handler
Jul 3 00:44:37 srv01 postfix/cleanup[3331]: C0E5182A20: milter-reject: END-OF-MESSAGE from 46.128.213.43.dynamic.cablesurf.de[46.128.x.x]: 5.7.0 The message could not be sent. You are not allowed to use sendmail utility.; from=<info@domain.de> to=<mail@domain2.de> proto=ESMTP helo=<[192.168.1.20]>
Jul 3 00:44:37 srv01 postfix/smtpd[3326]: disconnect from 46.128.x.x.dynamic.cablesurf.de[46.128.x.x]
Moreover I disabled the line "non_smtpd_milters" in postfix main.conf since my server has same issues discribed in the following thread:
Postfix: mails sent through sendmail binary are blocked because of wrong HELO
My server is sending all emails via exim smarthost to other specialised exim server (both cPanel). How may I limit customers from sending out SPAM ? Mean to scan outgoing emails and delete/store in some folder which ones identified as SPAM. Preferrably the scan part to be on exim email proxy cause it is much idle.
View 0 Replies View RelatedI want to use scp to backup files, however I find most tutorials confusing as to which computer is the remote and the local. Is the local the one you are logged into via ssh command, or the computer from which you logged into ssh.
Lets say I am on my Windows computer. I open up putty, and login to the ssh connection of a remote linux computer. What scp command do I enter into the ssh terminal to copy a file from D:ackup of the windows computer to /home/backup of the linux computer?
I am getting ready to install APF, I have read multiple articles, but am still confused with the following parameters and what needs to be included in each:
IG_TCP_CPORTS
IG_UDP_CPORTS
EG_TCP_CPORTS
EG_UDP_CPORTS
These are the ports that I want to use:
21,22,25,53,80,110,143,443,465,873,993,995
How do I know what port goes in what parameter? How do I know if it goes in TCP or UDP and if it goes in Ingress or Egress?
What is the difference between TCP and UDP?
Is it ok to have a port listed in both TCP an UDP, and also in Ingress as well as in Egress?
having my own dedicated server. I have apf installed and I wanted to see how it blocked IPs so I had a friend, whoes IP I knew, help me. I added his IP to the deny_hosts.rules, thinking that would block him from my server, but it did not. Now, mind you, the way I added his IP was to simply use an editor and add his IP to the bottom of the list. Then I got to thinking, does teh apf only load the rules every so often? If so, how can I tell when or how often the rules load? ALso, do I need to add an IP using apr -d IPNUMBER in order for the apf to recognize it? I'd appreciate some info on how the apf works and how I can add IPs myself that I want to add and be sure that they are being blocked.
View 3 Replies View RelatedI am going to place my first physical server to a server room. I wish to use it also as an nameserver for my domains and I am missing some basic principle there. I can probably configure BIND etc, but how will the servers upper in the hierarchy learn that this is a nameserver for certain domains? To start with, I have several empty domains (they are not hosted and so far using nameservers of a big company).
View 3 Replies View RelatedI am still trying to diagnose a problem some members have on my forums, when they load a page it will load a grey screen (my background color) and stop, after 15-30 seconds+ it will finally load the page
i opened a ticket with my server co and they forwared it to the NOC, NOC said it was apache config problem, server co said it was fixed and was due to apache log reaching 2GB limit, logrotate installed
same problem still existed, opened tk with server management co, they tweaked httpd.conf and disabled logs, problem still exists
I asked 3rd management co about it, changed some settings in httpd, said it may be due to ads on the sites, i took out the ads and a stat script
problem still exists, the thing is the problem exists with some users and not others, doing speed tests to the server shows it is very quick, load is low, no i/o wait and i just installed the second GB of memory so memory is fine
this is happeneing to users on seperate forums, one using vB, one using IPB, so it is server/ hardware related, AMD barton 3000, with 2GB ram, nowehere reaching the bandwidth limit or 10mbps port speed limit
any ideas? doing tracerts to the server shows a timeout before the sites IP address, every time, but doing a tracert OUT of the server shows no time outs....
One of the other message boards that I am on has a server at LayeredTech.
Now they said in there they had no issues whatsoever with the network. But when I did this tracert: .....
I have a basic understanding of their role and how they work in general (mapping domain names to ip addresses).
I'll start with my setup/scenario:
Plesk - (dedicated company server - serving parent site via WHMCS)
ResellerClub - (domain registrar)
Cpanel/WHM - (shared server)
1. What would be the recommendation for a new hosting provider when it comes to name server(s)?
2. Do most who have limited resources use the BIND service on each WHM shared server itself? So if you have umpteen shared servers you would have umpteen name servers, as well?
2a. If so is it preferred/recommended to ultimately use completely separate/dedicated server(s) for DNS services for all shared servers? What is common?
3. If using the WHM shared server itself is the common practice, what are its pros and cons?
For the last week or two my VPS keeps getting added to blacklists.
Yesterday I noticed that a website on the server was forward mail from a contact form to the clients AOL account, obviously scripts were completing the form on the website and that was being sent to AOL, who would of obviously blacklisted the IP.
I've stopped that now, but we're still getting black listed. I've had my VPS provider get exim to record the path that sent the e-mail, and there are no scripts on the server sending out mails that I should be worried about.
Some questions to help me.
How can you identify an outgoing e-mail? is it by the character '=>'? If so, is it normal for there to be e-mails being sent out:
2007-08-23 19:04:10 1IOH2K-00038j-Jg => /dev/null <shaun[at]sr8.co.uk> F=<aaron_straubegnvu[at]yahoo.com> R=central_filter T=**bypassed** S=0 QT=6s DT=0s
2007-08-23 19:04:10 1IOH2K-00038j-Jg Completed QT=6s
I'm puzzled as to why the server keeps being blacklisted, when I can't really see any problems in the log file?
The CBL website (which blacklisted us) says we were added at around 19:00GMT, so I've checked the logs for that time and can't really find much.
On the server there is one account with an autoresponder set as that person is away on holiday.
I recently went from dedicated to Dotster VPS to cut down on price and also because I do not have as many of clients I once had.
I chose their cPanel Premium
[url]
Soon after I realized via the Virtuozzo Panel, that I have limits on everything
.
I was pretty upset that none of these limits were posted anywhere on Dotsters site and its a surprise not welcomed.
I want to post some images so maybe you can tell me if their limits are reasonable or if they are way off.
[url]
I had them actually raise my diskinodes from 400/500k to 600/700k
and also my quotaugidlimit from 100 to 200.
For some reason I have 162 ugid's but i have only restored 23 or so accounts on this server, with no other special things running besides the standards. Shouldn't I be around under 100 ugid's?
So my main problems that I have is the folowing limits:
diskinodes: I have only 35 gigs used of the 50 allocated, their initial quota of 500,000 seemed low. now they bumped be to 700,000 and i'm almost there.
quotaugidlimit: for only having 23 accounts it's crazy to believe that I had to have their initial limit raise to 200. I have noticed a lot more users like #2121, #13232, #124312 and so on compaired to my dedicated server. My dedicated had about 5, this VPS shows about 30 or so.
kmemsize: their limit is 18,022,400 bytes, which I always seem to be reaching.
privvmpages: hard limit is 292,912 and i'm usually exceeding this one.
Here is a screenshot of my QoS:
[url]
Also, I noticed once I reach/exceed limits, the first things to be shutdown is my webmail and cpanel and so on, but the sites stay up Is there a way of setting up which resources are shut down in what order? To have mail up is the biggest request. I rather have ftp and cpanel down first.
I am really not happy with what is going on and gaining some user feedback would be great. I really wish Dotster had a complete breakdown of limits, before I bought.