Re: [Declude.JunkMail] MAILFROM failing on "user@domain@host"
>Mail from one of our users continuously fails the MAILFROM test, but I'm >not sure that it should be failing. The only funny thing this message has >is the mail server hostname appended to the end of the address, but I >thought that was valid. No, it isn't valid: >X-Note: Sent from [EMAIL PROTECTED]@mx.digical.com - >h-64-236-243-243.twi.com ([64.236.243.243]). RFC821 doesn't say how to handle this -- the return address is "[EMAIL PROTECTED]@mx.digical.com", yet only 1 "@" is allowed in the address (technically, the part to the left of the "@" could have another one, if it was quoted, but that is rarely ever used). There is an obscure routing method that is legal, and similar to this -- "[EMAIL PROTECTED]", where one mailserver would send it to mx.digical.com, which would then send it to [EMAIL PROTECTED] However, you need a "%" in there for that to be valid. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] MAILFROM failing on "user@domain@host"
Scott, Mail from one of our users continuously fails the MAILFROM test, but I'm not sure that it should be failing. The only funny thing this message has is the mail server hostname appended to the end of the address, but I thought that was valid. Can you have a look? Below are the message headers from the D*.SMD file and the contents of the Q*.SMD file, as well as the lines from the smtp logs... D*.SMD: Received: from weabsunprd12.weac.com [64.236.243.243] by mail01.excedent.us with ESMTP (SMTPD32-7.13) id AE73D740042; Thu, 26 Sep 2002 16:30:43 -0400 Received: from weabsundev02.weac.com (weabsundev02.weac.com [205.173.141.23]) by weabsunprd12.weac.com (8.10.2+Sun/8.8.8) with ESMTP id g8QKUgR09321 for <[EMAIL PROTECTED]>; Thu, 26 Sep 2002 13:30:43 -0700 (PDT) Received: from innoventJeff ([168.161.184.242]) by weabsundev02.weac.com (8.8.8+Sun/8.8.8) with ESMTP id NAA03413 for <[EMAIL PROTECTED]>; Thu, 26 Sep 2002 13:30:42 -0700 (PDT) From: "Jeff Mericle" <[EMAIL PROTECTED]> To: "Keith Mericle" <[EMAIL PROTECTED]> Date: Thu, 26 Sep 2002 13:30:49 -0700 MIME-Version: 1.0 Subject: Re: FW: Canceled: Actuate Enterprise Conference Call Reply-to: [EMAIL PROTECTED] Message-ID: <3D930C09.14872.30003FEC@localhost> Priority: normal In-reply-to: <[EMAIL PROTECTED]> X-mailer: Pegasus Mail for Windows (v4.01) Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Content-description: Mail message body X-Note: Sent from [EMAIL PROTECTED]@mx.digical.com - h-64-236-243-243.twi.com ([64.236.243.243]). X-Note: Scanned for SPAM by Excedent X-Note: HELOBOGUS, MAILFROM (14) Q*.SMD: Qd:\imail\spool\D6e730d74004282ea.SMD Hmail01.excedent.us Wd:\imail\mail01_excedent_com E0, S<[EMAIL PROTECTED]@mx.digical.com> NRCPT To:<[EMAIL PROTECTED]> R<[EMAIL PROTECTED]> SMTP LOG: 20020926 163043 127.0.0.1 SMTPD (0D740042) [64.236.243.243] EHLO weabsunprd12.weac.com 20020926 163044 127.0.0.1 SMTPD (0D740042) [64.236.243.243] MAIL From:<[EMAIL PROTECTED]@mx.digical.com> --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] mailfrom failing
> I did notice that aircanada.ca has a very low default TTL of 1 hour, so it > is very likely that they are in the process of making DNS/IP changes, and > there was a temporary glitch. > -Scott OK, that might explain it. It has happened several times in the last few days; maybe they're making a some serious changes. Thanks Scott. Josh --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] mailfrom failing
>The primary for Imail is our own dns server, 204.92.1.144. I used the same >dns server to do my lookup in the original message. I, too, got the same results as you from that server. Declude will report the "Domain [domain] has no MX/A records" only if: [1] The DNS server DOES respond, AND: [2] It reports that either a "name error" (meaning that the name does not exist, OR It reports no error, but does not have any answers (MX records) listed. I did notice that aircanada.ca has a very low default TTL of 1 hour, so it is very likely that they are in the process of making DNS/IP changes, and there was a temporary glitch. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] mailfrom failing
The primary for Imail is our own dns server, 204.92.1.144. I used the same dns server to do my lookup in the original message. Josh - Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, July 23, 2002 10:36 AM Subject: Re: [Declude.JunkMail] mailfrom failing > > >MessageHoping someone can explain this. We're having messages sent to us > >from Air Canada, specifically electronic tickets from [EMAIL PROTECTED], > >fail the mailfrom test. However, an nslookup (using the same dns iMail > >uses) for aircanada.ca shows both MX and A records. > > What is the primary DNS server listed in the IMail SMTP settings? It may > be that the DNS server has corrupt entries for AIRCANADA.CA. > -Scott > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] mailfrom failing
>MessageHoping someone can explain this. We're having messages sent to us >from Air Canada, specifically electronic tickets from [EMAIL PROTECTED], >fail the mailfrom test. However, an nslookup (using the same dns iMail >uses) for aircanada.ca shows both MX and A records. What is the primary DNS server listed in the IMail SMTP settings? It may be that the DNS server has corrupt entries for AIRCANADA.CA. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
KITHRUP:RE: [Declude.JunkMail] mailfrom failing
You might make a myfilter.txt entry that gives a negative weight to that particular domain. I have a similar problem where a client uses a mainframe to send out txt messages. It fails badheaders and REVDNS constantly. I gave it a -15 weight and now the messages go through from that server. HTH Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Josh Piche Sent: Tuesday, July 23, 2002 9:18 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] mailfrom failing MessageHoping someone can explain this. We're having messages sent to us from Air Canada, specifically electronic tickets from [EMAIL PROTECTED], fail the mailfrom test. However, an nslookup (using the same dns iMail uses) for aircanada.ca shows both MX and A records. Here's the log entries: 07/22/2002 14:44:05 Q527302d7013e817a Msg failed MAILFROM (Domain AIRCANADA.CA has no MX/A records.). 07/22/2002 14:44:05 Q527302d7013e817a Msg failed REVDNS (This E-mail was sent from a mail server 206.47.209.234 with no reverse DNS entry.). 07/22/2002 14:44:05 Q527302d7013e817a Msg failed WEIGHT9 (Weight of 17 reaches or exceeds the limit of 9.). 07/22/2002 14:44:05 Q527302d7013e817a Msg failed WEIGHT14 (Weight of 17 reaches or exceeds the limit of 16.). 07/22/2002 14:44:05 Q527302d7013e817a Subject: AIR CANADA - ELECTRONIC TICKET ITINERARY/RECEIPT 07/22/2002 14:44:05 Q527302d7013e817a From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] The dns lookup looks like this: aircanada.canameserver = ns.RezoNet.NET aircanada.canameserver = ns.InterLink.NET aircanada.ca primary name server = ns.InterLink.NET responsible mail addr = root.ns.InterLink.NET serial = 2002072203 refresh = 3600 (1 hour) retry = 900 (15 mins) expire = 2419200 (28 days) default TTL = 3600 (1 hour) aircanada.caMX preference = 30, mail exchanger = mail.q aircanada.caMX preference = 10, mail exchanger = mail.a aircanada.cainternet address = 206.45.20.197 aircanada.canameserver = ns.RezoNet.NET aircanada.canameserver = ns.InterLink.NET ns.RezoNet.NET internet address = 198.168.54.8 ns.InterLink.NETinternet address = 198.168.73.8 mail.qc.uunet.cainternet address = 198.168.54.17 mail.qc.uunet.cainternet address = 198.168.54.16 mail.aircanada.ca internet address = 206.47.209.234 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] mailfrom failing
MessageHoping someone can explain this. We're having messages sent to us from Air Canada, specifically electronic tickets from [EMAIL PROTECTED], fail the mailfrom test. However, an nslookup (using the same dns iMail uses) for aircanada.ca shows both MX and A records. Here's the log entries: 07/22/2002 14:44:05 Q527302d7013e817a Msg failed MAILFROM (Domain AIRCANADA.CA has no MX/A records.). 07/22/2002 14:44:05 Q527302d7013e817a Msg failed REVDNS (This E-mail was sent from a mail server 206.47.209.234 with no reverse DNS entry.). 07/22/2002 14:44:05 Q527302d7013e817a Msg failed WEIGHT9 (Weight of 17 reaches or exceeds the limit of 9.). 07/22/2002 14:44:05 Q527302d7013e817a Msg failed WEIGHT14 (Weight of 17 reaches or exceeds the limit of 16.). 07/22/2002 14:44:05 Q527302d7013e817a Subject: AIR CANADA - ELECTRONIC TICKET ITINERARY/RECEIPT 07/22/2002 14:44:05 Q527302d7013e817a From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] The dns lookup looks like this: aircanada.canameserver = ns.RezoNet.NET aircanada.canameserver = ns.InterLink.NET aircanada.ca primary name server = ns.InterLink.NET responsible mail addr = root.ns.InterLink.NET serial = 2002072203 refresh = 3600 (1 hour) retry = 900 (15 mins) expire = 2419200 (28 days) default TTL = 3600 (1 hour) aircanada.caMX preference = 30, mail exchanger = mail.q aircanada.caMX preference = 10, mail exchanger = mail.a aircanada.cainternet address = 206.45.20.197 aircanada.canameserver = ns.RezoNet.NET aircanada.canameserver = ns.InterLink.NET ns.RezoNet.NET internet address = 198.168.54.8 ns.InterLink.NETinternet address = 198.168.73.8 mail.qc.uunet.cainternet address = 198.168.54.17 mail.qc.uunet.cainternet address = 198.168.54.16 mail.aircanada.ca internet address = 206.47.209.234 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
