I found the problem. The address was defined correctly in mm_config.py, but for some reason it was truncated in Defaults.py. I don't really understand the mechanism by which changes in mm_config.py are propagate to Defaults.py...but something went wrong!
I edited Defaults.py and restarted MM and am monitoring our logs. So far I don't see any more errors. thanks, douglas Mark Sapiro wrote: > douglas repetto wrote: >> We've been getting many many strange mailman-bounces. It seems that >> somewhere the mailman-bounces address is mis-configured. It should be >> [EMAIL PROTECTED], but mail seems to be sent as >> [EMAIL PROTECTED] (note missing "u"). That's causing >> bounces to bounce all over the place...in our mail log we get messages like: >> >> >> >> Jul 19 12:02:50 roar postfix/smtp[18535]: 9F86883BE24: >> to=<[EMAIL PROTECTED]>, relay=none, delay=0, >> status=bounced (Host or domain name not found. Name service error for >> name=music.columbia.ed type=A: Host not found) >> >> but also: >> >> Jul 19 12:02:54 roar postfix/qmgr[10647]: E969F83BE2C: >> from=<[EMAIL PROTECTED]>, size=4419, nrcpt=1 (queue active) >> >> >> >> >> So both the correct address and the incorrect address are being >> used...I've poked around in all of our configs and I can't find the >> incorrect address anywhere. > > > The domain comes from the host_name attribute of the mailman list > (visible on the mailman list's admin->General Options page). > > >> My suspicion at this point is that there's a >> virus somewhere on a users computer that is propagating the incorrect >> address and that many of the messages are the result of spoofed mail. > > > I think this is likely. Presumably the mail that causes this > >> Jul 19 12:02:50 roar postfix/smtp[18535]: 9F86883BE24: >> to=<[EMAIL PROTECTED]>, relay=none, delay=0, >> status=bounced (Host or domain name not found. Name service error for >> name=music.columbia.ed type=A: Host not found) > > originates from within your network from someone or some thing > connecting to postfix on your server to send this mail. If it came > from outside, it would never get to your domain in the first place. > What are the other log entries with the same 9F86883BE24 id. They may > give you a clue as to the source of this message. > > It is not at all unusual for 'harvested' email addresses to be > truncated. > -- ............................................... http://artbots.org .....douglas.....irving........................ http://dorkbot.org .......................... http://music.columbia.edu/cmc/music-dsp .......... repetto....... http://works.music.columbia.edu/organism ............................... http://music.columbia.edu/~douglas ------------------------------------------------------ Mailman-Users mailing list [email protected] http://mail.python.org/mailman/listinfo/mailman-users Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/ Unsubscribe: http://mail.python.org/mailman/options/mailman-users/archive%40jab.org Security Policy: http://www.python.org/cgi-bin/faqw-mm.py?req=show&file=faq01.027.htp
