>This morning I got this Log entry:
>
>09:15 08:09 SMTPD(280D0148) [195.49.65.182] connect 195.24.84.97 port 65434
There's no reverse value, for this ip address
>09:15 08:09 SMTPD(280D0148) [195.24.84.97] HELO 8009cv271826
The above EHLO/HELO name "should" be a Fully Qualified Host Name.
>09:15 08:09 SMTPD(280D0148) [195.24.84.97] MAIL FROM: <[EMAIL PROTECTED]>
>09:15 08:09 SMTPD(280D0148) [195.24.84.97] RCPT TO: <[EMAIL PROTECTED]>
Assuming, Patrick, that your mail server is not AOL.com, this is
known as an attempt to relay.
>09:15 08:09 SMTPD(280D0148) [195.24.84.97] ERR waldo.ch invalid user
><[EMAIL PROTECTED]>
Since you probably aren't AOL.com and Imail is not allowing relaying,
Imail cannot find <[EMAIL PROTECTED]> as a local Imail user so "invalid
(Imail) user". Imail works.
>Both adresses exist, [EMAIL PROTECTED] & [EMAIL PROTECTED]
# dig foobar.ch
; <<>> DiG 8.2 <<>> foobar.ch
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUERY SECTION:
;; foobar.ch, type = A, class = IN
;; ANSWER SECTION:
foobar.ch. 1D IN A 212.40.5.74
# dig foobar.ch mx
; <<>> DiG 8.2 <<>> foobar.ch mx
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; QUERY SECTION:
;; foobar.ch, type = MX, class = IN
;; ANSWER SECTION:
foobar.ch. 1D IN MX 10 mail.foobar.ch.
;; ADDITIONAL SECTION:
mail.foobar.ch. 1D IN A 212.40.5.74
You can see that foobar.ch's and mail.foobar.ch's ip addresses are
not in the same net as "alleged ip" 195.24.84.97 of the "SMTP
client", so this stinks like ip spoofing.
btw, foobar is FUBAR "F@cked Up Beyond All Repair". You might take
this critical issue with Claudio bello:
Domain name:
foobar.ch
Holder of domain name:
Claudio Andenmatten
Stationsstrasse 32
CH-8003 Z�rich
Switzerland
>Is maybe waldo.ch just a wrong user who try to send a mail as [EMAIL PROTECTED]
>without permission?
Imail denies relaying for ip 195.24.84.97 and the sender is not
AUTHenticate for relaying, either.
This looks like a relay attempt with spoofed everything on the sender
side. If you want to avoid this Imail error message in the future, in
Imail SMTP Security, click "Relay for Anyone". vbg
Len
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
