On 3/7/2011 7:21 AM, Stan Hoeppner wrote:
myrdhin bzh put forth on 3/7/2011 1:53 AM:
No, it's not SPAM.
Ok, agreed, not spam.
In fact, zeDomain.tld is a french know domain : wanadoo.fr (and orange.fr). :(
The same 10 servers handle mail for both wanadoo.fr and orange.fr. All
Postfix controls relevant to your issue available in 2.1.5 are based on
connection concurrency, not rate limiting. The connection concurrency
is on a *per domain* basis. Orange is the largest ISP in France, yes?
How many other recipient domains you send mail to are also hosted by
this same Orange 10 server mail farm? If your answer is "a lot", you
could completely disable concurrency and still possibly trip their 3
connections per server limit, simply due to the number of recipient
domains for which you have mail queued. They didn't list them in the
same order, but if you sort them you'll see it's the same 10 servers.
smtp.wanadoo.fr. 600 IN A 80.12.242.62
smtp.wanadoo.fr. 600 IN A 80.12.242.148
smtp.wanadoo.fr. 600 IN A 193.252.22.65
smtp.wanadoo.fr. 600 IN A 193.252.23.67
smtp.wanadoo.fr. 600 IN A 80.12.242.9
smtp.wanadoo.fr. 600 IN A 80.12.242.53
smtp.wanadoo.fr. 600 IN A 80.12.242.142
smtp.wanadoo.fr. 600 IN A 80.12.242.82
smtp.wanadoo.fr. 600 IN A 193.252.22.92
smtp.wanadoo.fr. 600 IN A 80.12.242.15
smtp-in.orange.fr. 600 IN A 80.12.242.148
smtp-in.orange.fr. 600 IN A 80.12.242.53
smtp-in.orange.fr. 600 IN A 80.12.242.9
smtp-in.orange.fr. 600 IN A 193.252.23.67
smtp-in.orange.fr. 600 IN A 193.252.22.65
smtp-in.orange.fr. 600 IN A 80.12.242.142
smtp-in.orange.fr. 600 IN A 80.12.242.62
smtp-in.orange.fr. 600 IN A 80.12.242.82
smtp-in.orange.fr. 600 IN A 193.252.22.92
smtp-in.orange.fr. 600 IN A 80.12.242.15
I would suggest you grep your mail log for all outbound smtp connections
to these 10 IP addresses, and document all the recipient domains. Then
add all these domains to your slow transport map. If you still get
those 421 errors, completely disable concurrency.
Nice explanation and reasonable advice.
If you still get the
errors, you probably can't fix the problem until you upgrade to 2.5+ and
have access to rate delay controls.
Unfortunately, the newer postfix rate delay controls are still
based on the recipient domain, not the MX destination.
Maybe some clever firewall rules could help.
Hmm, I'll wonder out loud if a check_recipient_mx_access table
that returns FILTER slow: would help. It would affect all
recipients of a multi-recipient message, but maybe that would
be acceptable.
-- Noel Jones
