Is all the held email legitimate? If not could the machines they are using be compromised and using their account information to send spam email?
Kevin Bilbee > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Todd Richards > Sent: Thursday, March 02, 2006 3:29 PM > To: [email protected] > Subject: RE: [IMail Forum] Problem sending mail - Update > > > Well, I actually remoted into a computer on their network today, and > personally set up a test account with authentication. That > message also got > held. They haven't changed anything on their network recently > that they can > think of that would have caused this. If they have a firewall, it's > something built in to their personal router. This is just a small two > person office that is having problems. > > I just checked the hijack logs and it says right there that the IP address > is being held for reaching a level 2 threshold. I was searching > before for > an email address - not an IP. So it was there all the time right in front > of me. > > Anyway, I'm moving this to the Declude list so I don't bother you all any > more! > > Thanks! > > Todd > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick > Sent: Thursday, March 02, 2006 4:57 PM > To: [email protected] > Subject: RE: [IMail Forum] Problem sending mail - Update > > Since they can send messages local to the server it appears they > may have an > smtp authentication problem. Do they have a Firewall? I came across a > problem where a Watchguard firewall was stripping the ESMTP information. > > If that is the case you have to reconfigure to watchguard. Some > links that > discuss this. > > http://www.gordano.com/kb.htm?q=481 > > http://www.avolio.com/columns/smtp_proxy.html > > Alternatively if your client has a static IP address you can just > add it to > the relay for addresses list. > > Just a thought. > > Chuck Schick > Warp 8, Inc. > (303)-421-5140 > www.warp8.com > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards > Sent: Thursday, March 02, 2006 11:40 AM > To: [email protected] > Subject: [IMail Forum] Problem sending mail - Update > > > > Well, the problem still exists. This client is the only one that has > alerted me that is having a problem sending messages. He can receive > messages fine, and can send to anyone else on our server. But he > is unable > to send to anyone else. It effects both him and his secretary (same > office). I was able to remote into his computer today and set up a test > account ("test@" using his domain) in Outlook Express. I sent a few test > messages, to addresses on our server (came through fine) and a > Yahoo address > (didn't work). I then logged into the test account via the web interface > and sent a test message to the Yahoo account and it went through almost > immediately. > > I then set the test account up on my PC in Outlook Express and > sent an test > email to the same Yahoo account. Again, I received it almost immediately. > So it's not his domain name, or our mail server as far as I can tell. > > Does this suggest that his ISP is blocking something on their end? I did > try to use 587 on the test account, and I just noticed that our Declude is > holding the message - possibly because it's "test@"? So maybe it > is his ISP > causing problems on Port 25? I also noticed on the session ID for the > message using port 587, there were no messages about "RSET" that > we had been > getting. > > I welcome any additional feedback or suggestions. > > Thanks! > > Todd > > > > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of GlobalWeb.net > Webmaster > Sent: Tuesday, February 28, 2006 5:00 PM > To: [email protected] > Subject: RE: [IMail Forum] Problem sending mail > > If running JunkMail , grab the session id from the syslog, open up the > declude log and search for the same session id. See what the declude logs > show you. > > > > Randy A. > GlobalWeb.net > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards > Sent: Tuesday, February 28, 2006 4:54 PM > To: [email protected] > Subject: RE: [IMail Forum] Problem sending mail > > Yes, we are using Declude Junkmail, and just installed Declude AV > yesterday > morning. But nobody else is having this problem? > > Todd > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of GlobalWeb.net > Webmaster > Sent: Tuesday, February 28, 2006 3:51 PM > To: [email protected] > Subject: RE: [IMail Forum] Problem sending mail > > Todd, > > Are you using any 3rd party Spam filters? > > Randy A. > GlobalWeb.net > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards > Sent: Tuesday, February 28, 2006 4:34 PM > To: [email protected] > Subject: [IMail Forum] Problem sending mail > > Hi Everyone. > > Had a user today call and say that all mail he has been sending > for the past > day or so hasn't been going through. It appears to go through on his end > but a follow up call to the recipients says otherwise. He can > send fine to > me (on the same server) but after that it's a problem. I started looking > through the logs and here is a typical log for his email address. > > 02:28 13:09 SMTPD(9fde008300005329) [192.168.1.204] connect 71.212.163.106 > port 23880 02:28 13:09 SMTPD(9fde008300005329) [71.212.163.106] EHLO > Portable 02:28 13:09 SMTPD(9fde008300005329) [71.212.163.106] AUTH 02:28 > 13:09 SMTPD(9fde008300005329) [71.212.163.106] AUTH 02:28 13:09 > SMTPD(9fde008300005329) [71.212.163.106] AUTH 02:28 13:09 > SMTPD(9fde008300005329) Authenticated [EMAIL PROTECTED], session > treated as local. 02:28 13:09 SMTPD(9fde008300005329) > [71.212.163.106] MAIL > FROM: <[EMAIL PROTECTED]> 02:28 13:09 SMTPD(9fde008300005329) > [71.212.163.106] RCPT TO: <[EMAIL PROTECTED]> 02:28 13:09 > SMTPD(9fde008300005329) [x] looking up smartmarketingnow.com in > HOSTS 02:28 > 13:09 SMTPD(9fde008300005329) [71.212.163.106] RSET 02:28 13:09 > SMTPD(9fde008300005329) [71.212.163.106] RSET 02:28 13:09 > SMTPD(9fde008300005329) [71.212.163.106] MAIL FROM: > <[EMAIL PROTECTED]> 02:28 13:09 SMTPD(9fde008300005329) > [71.212.163.106] RCPT TO: <[EMAIL PROTECTED]> 02:28 13:09 > SMTPD(9fde008300005329) [x] looking up smartmarketingnow.com in > HOSTS 02:28 > 13:09 SMTPD(9fde008300005329) [71.212.163.106] DATA 02:28 13:09 > SMTPD(9fde008300005329) [71.212.163.106] > d:\IMail\spool\D9fde008300005329.SMD 912809 > > It just stops there. There is no "rdeliver", "closing socket", or > "finished" messages. The "RSET" is something that I'm a little concerned > about, as I don't see that in other threads. > > Does anyone have any suggestions on what else to look at? He is the only > one who I have heard is having a problem. I'm sending to everyone just > fine, as are several others on our server. > > Thanks for any ideas. > > Todd > > ______________________________________________ > Todd Richards > National Network, Inc. > [EMAIL PROTECTED] > 402.778.7903 > > --- > [This E-mail scanned for viruses by Declude] > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > --- > [This E-mail scanned for viruses by Declude] > > > --- > [This E-mail scanned for viruses by Declude] > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > --- > [This E-mail scanned for viruses by Declude] > > > --- > [This E-mail scanned for viruses by Declude] > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > --- > [This E-mail scanned for viruses by Declude] > > > --- > [This E-mail scanned for viruses by Declude] > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
