Hi, Thanks for your reply. Following is the part of SMTP logs.. 20040712 103618 127.0.0.1 SMTPD (00010112) [218.156.65.30] HELO 7hvzg07rtzzoyt2 20040712 103618 127.0.0.1 SMTPD (00010110) [218.156.65.30] HELO 7hvzg07rtzzoyt2 20040712 103618 127.0.0.1 SMTPD (0001010E) [218.156.65.30] HELO 7hvzg07rtzzoyt2 20040712 103618 127.0.0.1 SMTPD (0004010A) [218.156.65.30] HELO 7hvzg07rtzzoyt2 20040712 103618 127.0.0.1 SMTPD (00030108) [218.156.65.30] HELO 7hvzg07rtzzoyt2 20040712 103618 127.0.0.1 SMTPD (003B00F6) [218.156.65.30] HELO 7hvzg07rtzzoyt2 20040712 103618 127.0.0.1 SMTPD (00010114) [218.156.65.30] HELO 7hvzg07rtzzoyt2 20040712 103618 127.0.0.1 SMTPD (00010114) [218.156.65.30] MAIL From: [EMAIL PROTECTED] 20040712 103619 127.0.0.1 SMTPD (00010114) [218.156.65.30] RCPT To: [EMAIL PROTECTED] The SMTP eats up 100% CPU and never completes the delivery of this mail. We had to locate the respective .smd and the processing file from the queue and delete it plus restart the entire server. As a temporary solution we have setup the hanmail.net on our server..
For mails from [EMAIL PROTECTED], find the log below. [EMAIL PROTECTED] is the sender's ID. The recipient ID was [EMAIL PROTECTED] 20040709 073002 127.0.0.1 SMTPD (02F500EE) [211.239.153.89] EHLO sdyp.net 20040709 073002 127.0.0.1 SMTPD (02F500EE) [211.239.153.89] MAIL From: <[EMAIL PROTECTED]> 20040709 073003 127.0.0.1 SMTPD (02F500EE) [211.239.153.89] RCPT TO: <[EMAIL PROTECTED]> 20040709 073003 127.0.0.1 SMTPD (02F500EE) [211.239.153.89] ERR mail.ankur-coer.org invalid user <[EMAIL PROTECTED] 20040709 073003 127.0.0.1 SMTPD (02F500EE) [211.239.153.89] MAIL From: <[EMAIL PROTECTED]> 20040709 073003 127.0.0.1 SMTPD (02F500EE) [211.239.153.89] RCPT TO: <[EMAIL PROTECTED]> 20040709 073004 127.0.0.1 SMTPD (02F500EE) [211.239.153.89] ERR mail.ankur-coer.org invalid user <[EMAIL PROTECTED] 20040709 073004 127.0.0.1 SMTPD (02F500EE) [211.239.153.89] MAIL From: <[EMAIL PROTECTED]> 20040709 073004 127.0.0.1 SMTPD (02F500EE) [211.239.153.89] RCPT TO: <[EMAIL PROTECTED]> 20040709 073005 127.0.0.1 SMTPD (02F500EE) [211.239.153.89] ERR mail.ankur-coer.org invalid user <[EMAIL PROTECTED] Why this mail is accepted for delivery? We have checked the box 'Check Valid Sender'. This ID is not configured on the server. How SMTP authenticates? Any clues?? Regards, Aparna E-Tech Solutions Pvt. Ltd. ----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, July 12, 2004 6:27 PM Subject: Re: [IMail Forum] Why my server is relaying for hanmail.net??? > > >We are using IMail 6.05 on Win 2K. The relay settings are set to 'No Mail > >Relay'. > > > >Since last few months the server is trying to relay the mails to > >[EMAIL PROTECTED] or [EMAIL PROTECTED] While delivering such mails the SMTP process > >eats up 100% CPU. Even if we delete the mail from queue along with the > >msd file in queue it doesn't release the CPU. We have to restart the > >server to get back to the normal. The strange this is the sender's ID is > >any random ID e.g. <mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED] > > The only possibilities that I can think of are that a spammer guessed the > password to one of your accounts, or they are sending E-mail using a > deprecated routing format (such as "[EMAIL PROTECTED]"). Your > SMTPD log file entries should show how they are doing this. > > >But last week the server accepted the mails delivery from > ><mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED] Where 216.187.93.106 > >is our server's IP. But we have not setup any such server in > >IMail... This user was just spamming through our server. > > But if 216.187.93.106 is the IP of your IMail server, how is > "[EMAIL PROTECTED]" going to go to anyone outside of your server? It can't. > > >Why the server is acceptong such mails when the sender's IDs are invalid > >and the mail relay setting setup to 'No Mail Relay'.. > > You'll need to post the SMTPD log file entries for one of these E-mails. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > since 2000. > Declude Virus: Ultra reliable virus detection and the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
