On 03/11/2014 10:46 AM, Scot Needy wrote:
The device is behind a firewall/SLB.
So I take it that all of the messages appear to be coming from the 10.x
address. spamdyke's pretty much ineffective that way, because it relies
heavily on the sender's IP address for many of its filters.
I can't make the source IP transparent at this time. My only other
option would be to stand it up directly on the public network.
Making the source IP transparent would be the best solution. Many people
put QMT directly on the public network though. Just be sure to have
iptables configured appropriately (and enabled). I think the firewall.sh
scripts does a good job of this. I don't recall any complaints about it.
--
-Eric 'shubes'
On Mar 11, 2014, at 1:23 PM, Eric Shubert <[email protected]
<mailto:[email protected]>> wrote:
On 03/11/2014 09:57 AM, Scot Needy wrote:
NOTE: All sender domains and IP’s have been replaced with a unique name.
CHKUSER accepted sender: from<[email protected]
<mailto:[email protected]>::> remote
<na01-by2-obe.outbound.protection.outlook.com:unknown:10.189.254.17>
rcpt <> : sender accepted
spamdyke[8804]: DENIED_OTHER from:[email protected]
<http://mydomain.com> to:[email protected]
<http://supportdomain.com> origin_ip: 10.189.254.17 origin_rdns:
(unknown) auth: (unknown) encryption: TLS reason:
550_See_http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_
<http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_>(#5.7.1)
CHKUSER accepted sender: from<[email protected]
<mailto:[email protected]>::> remote
<na01-bn1-obe.outbound.protection.outlook.com:unknown:10.189.254.17>
rcpt <> : sender accepted
spamdyke[16794]: DENIED_OTHER from:[email protected]
<http://mydomain.com> to:[email protected]
<http://supportdomain.com> origin_ip: 10.189.254.17 origin_rdns:
(unknown) auth: (unknown) encryption: TLS reason:
550_See_http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_
<http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_>(#5.7.1)
CHKUSER accepted sender: from<[email protected]
<mailto:[email protected]>::> remote
<na01-bn1-obe.outbound.protection.outlook.com:unknown:10.189.254.17>
rcpt <> : sender accepted
spamdyke[31470]: DENIED_OTHER from:[email protected]
<http://mydomain.com> to:[email protected]
<http://supportdomain.com> origin_ip: 10.189.254.17 origin_rdns:
(unknown) auth: (unknown) encryption: TLS reason:
550_See_http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_
<http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_>(#5.7.1)
Looks to me as though there may be a firewall-type device on your
perimeter which is doing more than simply NAT. The origin_ip is
typically the address of the sending host, which would be public. This
holds true even when QMT is behind a NAT'ing firewall (I typically do
this).
Isoutlook.com <http://outlook.com/>the only domain you have messages
coming from which show this 10. address?
Is there some sort of VPN going on here?
What device is sitting on the immediate outside of QMT?
--
-Eric 'shubes'
---------------------------------------------------------------------
To unsubscribe, e-mail:[email protected]
<mailto:[email protected]>
For additional commands,
e-mail:[email protected]
<mailto:[email protected]>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
