[MDaemon-L] Analisa Log Email - blocked because its content presents a potential

[Syafril Hermansyah]

On June 17, 2016 3:38:34 PM GMT+07:00, Bambang Setiawan via MDaemon-L 
 wrote:

>Mohon bantuannya jika log email terlampir kenapa ya Pak ?
  Thu 2016-06-1612:46:27: <--
>552-5.7.0 This message was blockedbecause its content presents a
>potential Thu 2016-06-16 12:46:27: <-- 552-5.7.0 security issue.Please
>visit  Thu2016-06-16 12:46:27: <--
>552-5.7.0https://support.google.com/mail/answer/6590to review our
>message  


Mail ditolak karena mengandung lampiran yang tidak diperkenankan oleh 
googlemail.


https://support.google.com/mail/answer/6590


To prevent against potential viruses, Gmail doesn't allow you to attach certain 
types of files, including:

Certain file types (listed below), including their compressed form (like .gz or 
.bz2 files) or when found within archives (like .zip or .tgz files)Documents 
with malicious macrosArchives whose listed file content is password 
protectedArchives whose content includes a password protected archive

Note: If you try to attach a document that is too large, your message won't 
send. Learn more aboutattachments and file size limits.

File types you can't include as attachments

.ADE, .ADP, .BAT, .CHM, .CMD, .COM, .CPL, .EXE, .HTA, .INS, .ISP, .JAR, .JSE, 
.LIB, .LNK, .MDE, .MSC, .MSP, .MST, .PIF, .SCR, .SCT, .SHB, .SYS, .VB, .VBE, 
.VBS, .VXD, .WSC, .WSF, .WSH



-- 
syafril
--
Syafril Hermansyah

Sent from my Android device with K-9 Mail. Please excuse my brevity.

-- 
--MDaemon-L--
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 16.0.2, SP 5.0, BES 2.0.2, OC 3.5.2, SG 4.0

[MDaemon-L] Analisa Log Email - blocked because its content presents a potential

[Bambang Setiawan via MDaemon-L]

Dear Pak Syafril,
Mohon bantuannya jika log email terlampir kenapa ya Pak ?
--- Session Transcript --- Thu 2016-06-1612:46:18: Session 164127; child 1  
Thu2016-06-16 12:46:18:Parsing 
message<\pd3540374.msg> Thu 2016-06-1612:46:18: *  
From: pompi.sat...@persada.id  Thu 2016-06-1612:46:18: *  To: l...@iforte.co.id 
 Thu 2016-06-16 12:46:18: *  Subject: FW:Informasi Kandidat posisi Field 
Technician iFORTE (Update15 Juni 2016)  Thu2016-06-16 12:46:18: * Size (bytes): 
1400849  Thu2016-06-16 12:46:18: *Message-ID: 
<003501d1c793$1f1784d0$5d468e70$@persada.id> Thu 2016-06-1612:46:18: Attempting 
SMTP connection to [iforte.co.id]  Thu2016-06-16 12:46:18: Resolving MX records 
for[iforte.co.id] (DNS Server:202.155.0.15)... Thu 2016-06-1612:46:18: *  P=001 
S=001 D=iforte.co.idTTL=(479) MX=[aspmx.l.google.com]  Thu2016-06-16 12:46:18: 
*  P=005 S=002D=iforte.co.id TTL=(479) MX=[alt1.aspmx.l.google.com]  Thu 
2016-06-1612:46:18: *  P=005S=003 D=iforte.co.id TTL=(479) 
MX=[alt2.aspmx.l.google.com]  Thu 2016-06-16 12:46:18: *  P=010 S=004 
D=iforte.co.id TTL=(479)MX=[alt3.aspmx.l.google.com]  Thu2016-06-1612:46:18: *  
P=010S=005 D=iforte.co.id TTL=(479) MX=[alt4.aspmx.l.google.com]  Thu 
2016-06-16 12:46:18: *  P=015 S=000 D=iforte.co.id 
TTL=(479)MX=[mta.iforte.net.id]  Thu 2016-06-1612:46:18:Attempting SMTP 
connection to[aspmx.l.google.com:25]  Thu 2016-06-1612:46:18: Resolving A 
record for [aspmx.l.google.com](DNS Server:202.155.0.15)... Thu 
2016-06-1612:46:18: *  D=aspmx.l.google.com TTL=(1)A=[74.125.200.26] Thu 
2016-06-16 12:46:18: Attempting SMTP connection to[74.125.200.26:25] Thu 
2016-06-16 12:46:18: Waiting for socket connection... Thu 2016-06-1612:46:18: * 
 Connection established(124.81.84.135:55570 ->74.125.200.26:25) Thu 2016-06-16 
12:46:18: Waiting for protocol to start... Thu 2016-06-1612:46:18: <-- 220 
mx.google.com ESMTP w16si3927054pfj.162 - gsmtp  Thu 2016-06-16 12:46:18: --> 
EHLOmail.persada.id  Thu 2016-06-1612:46:18: <-- 250-mx.google.com at your 
service,[124.81.84.135]  Thu2016-06-16 12:46:18: <-- 250-SIZE 157286400  Thu 
2016-06-16 12:46:18: <--250-8BITMIME  Thu 2016-06-16 12:46:18:<-- 250-STARTTLS  
Thu 2016-06-1612:46:18: <-- 250-ENHANCEDSTATUSCODES  Thu 2016-06-16 12:46:18: 
<--250-PIPELINING  Thu 2016-06-16 12:46:18:<-- 250-CHUNKING  Thu 
2016-06-1612:46:18: <-- 250 SMTPUTF8  Thu 2016-06-16 12:46:18: --> 
MAILFrom:SIZE=1400849  Thu 2016-06-16 12:46:19:<--250 
2.1.0 OK w16si3927054pfj.162 - gsmtp  Thu 2016-06-16 12:46:19: --> RCPT 
To:  Thu 2016-06-16 12:46:19: <-- 250 2.1.5 
OKw16si3927054pfj.162 - gsmtp  Thu 2016-06-16 12:46:19: --> DATA  Thu2016-06-16 
12:46:19: <-- 354  Go ahead w16si3927054pfj.162 - gsmtp  Thu2016-06-16 
12:46:19: Sending<\pd3540374.msg> to 
[74.125.200.26]  Thu 2016-06-16 12:46:26: TransferComplete  Thu 
2016-06-1612:46:27: <-- 552-5.7.0 This message was blockedbecause its content 
presents a potential Thu 2016-06-16 12:46:27: <-- 552-5.7.0 security 
issue.Please visit  Thu2016-06-16 12:46:27: <-- 
552-5.7.0https://support.google.com/mail/answer/6590to review our message  
Thu2016-06-16 12:46:27: <-- 552 5.7.0 content andattachment content guidelines. 
w16si3927054pfj.162 - gsmtp  Thu 2016-06-16 12:46:27: --> QUIT--- End 
Transcript ---

Atas bantuannya diucapkan terima kasih. 
Bambang SetiawanPERSADA
--
--MDaemon-L--
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 16.0.2, SP 5.0, BES 2.0.2, OC 3.5.2, SG 4.0

[MDaemon-L] Analisa log email

[Yudis]

On 6/15/2016 9:17 AM, Syafril Hermansyah wrote:

On 15/06/16 09:08, Yudis wrote:

Mohon bantuannya analisa pentalan error email saat kirim ke domain kami
berikut ini :

Action: failed
Final-Recipient: rfc822;d...@saranainstrument.com

Status: 5.0.0
Remote-MTA: dns; cm.websitewelcome.com 
Diagnostic-Code: smtp; 452 4.1.1 ... temporary failure: retry timeout
exceeded

Sender gagal resolve MX domain saranainstrument.com.
Hubungi DNS hoster (fiber.net.id) untuk perbaikkan kapasitas DNS response.

Pak Syafril,

Ok, terima kasih atas bantuannya.

Regards,
*Yudis*
*IT Officer*
+62-21-5347855
Ext.321

--
--MDaemon-L--
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 16.0.2, SP 5.0, BES 2.0.2, OC 3.5.2, SG 3.0.3

[MDaemon-L] Analisa log email

[Syafril Hermansyah]

On 15/06/16 09:08, Yudis wrote:
> Mohon bantuannya analisa pentalan error email saat kirim ke domain kami
> berikut ini :
> 
> Action: failed
> Final-Recipient: rfc822;d...@saranainstrument.com
> 
> Status: 5.0.0
> Remote-MTA: dns; cm.websitewelcome.com 
> Diagnostic-Code: smtp; 452 4.1.1 ... temporary failure: retry timeout
> exceeded

Sender gagal resolve MX domain saranainstrument.com.
Hubungi DNS hoster (fiber.net.id) untuk perbaikkan kapasitas DNS response.



-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, MDaemon 16.0.3-64 Beta B, SP 5.0.1-64 Beta A
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.

Competition is the keen cutting edge of business, always shaving away at
costs.
--- Henry Ford


-- 
--MDaemon-L--
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 16.0.2, SP 5.0, BES 2.0.2, OC 3.5.2, SG 3.0.3

[MDaemon-L] Analisa log email

[Yudis]

Pak Syafril,

Mohon bantuannya analisa pentalan error email saat kirim ke domain kami 
berikut ini :


-- Forwarded message --
From: Mail Delivery System 
To: 
Cc:
Date: Wed, 15 Jun 2016 08:39:06 +0700
Subject: Mail delivery failed: returning message to sender
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

a...@saranainstrument.com 
hostcm.websitewelcome.com 
[192.185.0.102]

SMTP error from remote mail server after RCPT
TO:>:
452 4.1.1 ... temporary failure: retry timeout exceeded
d...@saranainstrument.com 
hostcm.websitewelcome.com 
[108.167.139.19]

SMTP error from remote mail server after RCPT
TO:>

:
452 4.1.1 ... temporary failure: retry timeout exceeded

Action: failed
Final-Recipient:rfc822;d...@saranainstrument.com 


Status: 5.0.0
Remote-MTA: dns;cm.websitewelcome.com 
Diagnostic-Code: smtp; 452 4.1.1 ... temporary failure: retry timeout 
exceeded


Action: failed
Final-Recipient:rfc822;a...@saranainstrument.com 


Status: 5.0.0
Remote-MTA: dns;cm.websitewelcome.com 
Diagnostic-Code: smtp; 452 4.1.1 ... temporary failure: retry timeout 
exceeded



--
Regards,
*Yudis*
*IT Officer*
+62-21-5347855
Ext.321

--
--MDaemon-L--
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 16.0.2, SP 5.0, BES 2.0.2, OC 3.5.2, SG 3.0.3

[MDaemon-L] Analisa Log

[Ivan]

On 24/03/16 13:02, Sukardy wrote:

malah kadang filter mereka terlalu ketat email bukan spam ikut dilempar ke spam 
folder

Yang ini juga saya alami Pak. Saya kira saya doank yg complain ke CBN. 
Hahahaha


saya bikin filter aja : setiap email yg terdeteksi forward ke admin lalu delete 
message,
jadinya user tidak terganggu

Saya juga sudah set filter untuk delete message yang terdeteksi,
hanya saja notifikasi ke penerima masih terkirim ke penerima.
Saya pernah tanya ke Pak Syafril cara menghilangkan notifikasi ini.
Sampai hari ini saya masih belum menemukan cara menghilangkan notifikasi 
tersebut.
Mungkin Pak Ivan bisa kasih masukkan sedikit mengenai ini?
Apakah di tempat Bapak, penerima mendapat notifikasi Virus Found ataupun 
Restricted Attachment?
Terima Kasih.

Regards,

Sukardy
Pak utk disable notif ke user lewat menu : 
Security-ContentFilter-Notification lalu di hilangkan centang yg tidak 
dibutuhkan. user aman deh tdk terima notif


--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.5.3, SP 4.5.1, BES 2.0.2, OC 3.5.2, SG 3.0.3

[MDaemon-L] Analisa Log

[Syafril Hermansyah]

On 24/03/16 13:02, Sukardy wrote:
> Saya pernah tanya ke Pak Syafril cara menghilangkan notifikasi ini.
> Sampai hari ini saya masih belum menemukan cara menghilangkan notifikasi 
> tersebut.

Kasus terakhir yang Anda sampaikan itu notifikasi dari server lain,
bukan dari MDaemon milik sendiri.

http://www.mail-archive.com/mdaemon-l%40dutaint.com/msg38634.html

Notifikasi salah arah macam itu sebenarnya bisa ditangani dengan
pengaktifan BackScatter, tetapi backscatter tidak mendukung
domainpop/multipop hanya untuk mail yang masuk lewat SMTP (direct
incoiming, ETRN/ATRN/ODMR).


-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, MDaemon 16.0.1-64, SP 4.5.1-64
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.

Perkecualian tdk selalu mrpkan pembuktian daripada hukum lama yg ada,
perkecualian bisa juga mrpkan pertanda dari masa mendatang, tibanya
hukum baru
-- Marie van Ebner-Eschenbach, 1830-1916


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.5.3, SP 4.5.1, BES 2.0.2, OC 3.5.2, SG 3.0.3

[MDaemon-L] Analisa Log

[Sukardy]

> malah kadang filter mereka terlalu ketat email bukan spam ikut dilempar ke 
> spam folder
Yang ini juga saya alami Pak. Saya kira saya doank yg complain ke CBN. 
Hahahaha

> saya bikin filter aja : setiap email yg terdeteksi forward ke admin lalu 
> delete message, 
> jadinya user tidak terganggu
Saya juga sudah set filter untuk delete message yang terdeteksi,
hanya saja notifikasi ke penerima masih terkirim ke penerima.
Saya pernah tanya ke Pak Syafril cara menghilangkan notifikasi ini.
Sampai hari ini saya masih belum menemukan cara menghilangkan notifikasi 
tersebut.
Mungkin Pak Ivan bisa kasih masukkan sedikit mengenai ini?
Apakah di tempat Bapak, penerima mendapat notifikasi Virus Found ataupun 
Restricted Attachment?
Terima Kasih.

Regards,

Sukardy


--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.5.3, SP 4.5.1, BES 2.0.2, OC 3.5.2, SG 3.0.3

[MDaemon-L] Analisa Log

[Ivan]

On 24/03/16 09:40, Sukardy wrote:

Pak Ivan memakai spooling Email CBN juga ya? kasus kita sama Pak.
Saya sudah sampaikan ke CBN mengenai ini. IP-IP pengirim email itu saya list 
ada sekitar 300an IP saat ini.
Saya sudah kasih listnya ke CBN. Tidak tahu apakah mereka masukkan ke blacklist 
atau tidak.
Tapi yang buat saya kesal itu jawabannya begini :

"Terima kasih atas kepercayaanya menggunakan jasa dan layanan CBN.
Kami sudah melakukan pengecekan atas kinerja sistem CBN,
hasilnya saat ini kami tidak menemukan kendala.
IP Address yang terdeteksi mengirimkan spam akan terblokir secara otomatis oleh 
filter tersebut."

Hari ini ada ratusan email lagi yang mengandung virus yg masuk ke MDAEMON.
Apakah IP Address diatas itu blm terdeteksi mengirimkan SPAM oleh CBN?
Perlu dilist-in IP dan kasih ke mereka lagi kali ya?
Yes pak dicuekin sama CBN, malah kadang filter mereka terlalu ketat 
email bukan spam ikut dilempar ke spam folder. 1 hari 2x harus login ke 
webmail cbn utk lepasin email yg bukan spam, lapor juga percuma ga beres2.


Ya 1 bulan terakhir ini serangan email virus sedang menggila, kadang 1 
hari bisa 2000email tertangkap MDAV, saya bikin filter aja : setiap 
email yg terdeteksi forward ke admin lalu delete message, jadinya user 
tidak terganggu

--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.5.3, SP 4.5.1, BES 2.0.2, OC 3.5.2, SG 3.0.3

[MDaemon-L] Analisa Log

[Sukardy]

> Pak ada email virus yang from dan to nya dari email saya i...@pttdp.com, 
> cara lacak sumbernya gimana ya ? 
> kalo dr email source tidak ketauan mungkin krn saya pakai domainpop ya ?
> Received: from [10.64.162.1] (port=13881 helo=mx-1-3.int.cbn.net.id)
>   by backend-1-2.int.cbn.net.id with esmtp (Exim 4.80.1)
>   (envelope-from )
>   id 1aihxt-00068n-AF
>   for i...@pttdp.com; Wed, 23 Mar 2016 19:32:45 +0700
> Received: from [202.38.182.240] (port=62266)
>   by mx-1-3.int.cbn.net.id with esmtp (Exim 4.80.1)
>   (envelope-from )
>   id 1aihxs-0002ty-T0
>   for i...@pttdp.com; Wed, 23 Mar 2016 19:32:45 +0700

Pak Ivan memakai spooling Email CBN juga ya? kasus kita sama Pak.
Saya sudah sampaikan ke CBN mengenai ini. IP-IP pengirim email itu saya list 
ada sekitar 300an IP saat ini.
Saya sudah kasih listnya ke CBN. Tidak tahu apakah mereka masukkan ke blacklist 
atau tidak.
Tapi yang buat saya kesal itu jawabannya begini :

"Terima kasih atas kepercayaanya menggunakan jasa dan layanan CBN. 
Kami sudah melakukan pengecekan atas kinerja sistem CBN, 
hasilnya saat ini kami tidak menemukan kendala. 
IP Address yang terdeteksi mengirimkan spam akan terblokir secara otomatis oleh 
filter tersebut."

Hari ini ada ratusan email lagi yang mengandung virus yg masuk ke MDAEMON.
Apakah IP Address diatas itu blm terdeteksi mengirimkan SPAM oleh CBN?
Perlu dilist-in IP dan kasih ke mereka lagi kali ya?


--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.5.3, SP 4.5.1, BES 2.0.2, OC 3.5.2, SG 3.0.3

[MDaemon-L] Analisa Log

[Syafril Hermansyah]

On 2016-03-23 21:53, Ivan wrote:
> Pak ada email virus yang from dan to nya dari email saya i...@pttdp.com,
> cara lacak sumbernya gimana ya ? 


Virus atau spam mail?
Melacaknya dari message header.

> kalo dr email source tidak ketauan
> mungkin krn saya pakai domainpop ya ?


Tidak masalah kalau sekedar melacak sumber, kalau block sender host dari
sender  memang tidak bisa kalau pakai domainpop.


> Received: from [202.38.182.240] (port=62266)
> by mx-1-3.int.cbn.net.id with esmtp (Exim 4.80.1)
> (envelope-from )
> id 1aihxs-0002ty-T0
> for i...@pttdp.com; Wed, 23 Mar 2016 19:32:45 +0700 

sumber virusnya adalah node/PC di Bangalore India.

$ whois 202.38.182.240

inetnum:202.38.180.0 - 202.38.183.255
netname:SREERAM-NED1-IN
descr:  Northeast Dataa Network Pvt Ltd
country:IN
admin-c:NDNP1-AP
tech-c: NDNP1-AP
status: ALLOCATED PORTABLE
mnt-by: MAINT-IN-IRINN
mnt-lower:  MAINT-SREERAM-NED1-IN
mnt-routes: MAINT-SREERAM-NED1-IN
mnt-irt:IRT-SREERAM-NED1-IN
changed:hm-chan...@apnic.net 20130523
source: APNIC

irt:IRT-SREERAM-NED1-IN
address:#117/1, 2nd Main Road, Pai Layout, Doorvaninagar Post
Bangalore-560016
e-mail: sreeramdhaya...@nedataa.com
abuse-mailbox:  sreeramdhaya...@nedataa.com
admin-c:NDNP1-AP
tech-c: NDNP1-AP
auth:   # Filtered
mnt-by: MAINT-SREERAM-NED1-IN
changed:hm-chan...@apnic.net 20110509
changed:hm-chan...@apnic.net 20131022
source: APNIC










-- 
syafril
---
Syafril Hermansyah
Running MDaemon 16.0.1-64 Beta A, SP 4.5.1-64

Jangan pernah mengatakan kepada orang lain bagaimana mengerjakan
sesuatu, tapi sebut saja apa yang mesti dia lakukan. Niscaya mereka akan
mengejutkan Anda dengan kemampuannya.
-- George S. Patton

-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.5.3, SP 4.5.1, BES 2.0.2, OC 3.5.2, SG 3.0.3

[MDaemon-L] Analisa Log

[Ivan]

Pak ada email virus yang from dan to nya dari email saya i...@pttdp.com, 
cara lacak sumbernya gimana ya ? kalo dr email source tidak ketauan 
mungkin krn saya pakai domainpop ya ?


X-MDAV-Result: infected
X-MDAV-Infected: ???
X-MDAV-Processed: webmail.pttdp.com, Wed, 23 Mar 2016 19:26:41 +0700
Return-path: 
Received: from pop.cbn.net.id ([210.210.188.40])
by pttdp.com ([117.102.88.187])
(MDaemon PRO v15.5.2)
with DomainPOP id md50001117983.msg for ;
Wed, 23 Mar 2016 19:26:40 +0700
VBR-Info: md=pttdp.com; mc=all; mv=vbr.emailcertification.org;
X-MDRemoteIP: 210.210.188.40
X-MDHelo:
X-MDArrival-Date: Wed, 23 Mar 2016 19:26:40 +0700
X-Return-Path: i...@pttdp.com
X-Envelope-From: i...@pttdp.com
X-MDaemon-Deliver-To: i...@pttdp.com
Envelope-to: i...@pttdp.com
Delivery-date: Wed, 23 Mar 2016 19:32:45 +0700
Received: from [10.64.162.1] (port=13881 helo=mx-1-3.int.cbn.net.id)
by backend-1-2.int.cbn.net.id with esmtp (Exim 4.80.1)
(envelope-from )
id 1aihxt-00068n-AF
for i...@pttdp.com; Wed, 23 Mar 2016 19:32:45 +0700
Received: from [202.38.182.240] (port=62266)
by mx-1-3.int.cbn.net.id with esmtp (Exim 4.80.1)
(envelope-from )
id 1aihxs-0002ty-T0
for i...@pttdp.com; Wed, 23 Mar 2016 19:32:45 +0700
Message-ID: 
Date: Wed, 23 Mar 2016 18:02:44 +0530
Subject: Image75437956777247.pdf
From: ivan 
To: i...@pttdp.com
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--_com.android.email_2139828701233904"

_com.android.email_2139828701233904
Content-Type: multipart/alternative;
boundary="--_com.android.email_0774518356089447"

_com.android.email_0774518356089447
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.5.3, SP 4.5.1, BES 2.0.2, OC 3.5.2, SG 3.0.3

[MDaemon-L] Analisa log SMTP IN

[Syafril Hermansyah]

On 30/09/15 11:52, farid wrote:
> apakah penyabab dari mail tidak bisa masuk ?

Karena sender kirim mail dengan size lebih dari 1024 Kb (smtp size
limit).

-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, MDaemon 15.5.1-64 Beta B, SP 4.5.1-64
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.

Seorang pemberani yang sebenarnya bukannya dia yang dengan membabi buta
melompat masuk ke dalam jurang, melainkan adalah dia yang dengan
perlahan-lahan dan mata terbuka memasuki jurang itu setelah mengukur
dalamnya
-- P.J. Stahl


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.5.0, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2

[MDaemon-L] Analisa Log SMTP IN

[farid]

Dear Pak Syafril 

 

Apakah Log In dibawah ini juga diakibatkan karena SIZE 1024 sehingga
session Terminated .

 

Saya telah merubah setting refuses message to domain large than semula 10240
kb  kemudian jadi 0 .

 

Berapa lama perubahan itu berlaku ? 

 

Sebab  di SMTP In di server banyak antrian . 

 

Regard's

 

 

Moch.Farid

 

 

Session 2837; child 45

Wed 2015-09-30 15:06:37: Accepting SMTP connection from
[209.85.212.194:34934] to [192.168.1.10:25]

Wed 2015-09-30 15:06:37: --> 220 tanobelfood.com ESMTP MDaemon 13.0.4; Wed,
30 Sep 2015 15:06:37 +0700

Wed 2015-09-30 15:06:37: <-- EHLO mail-wi0-f194.google.com

Wed 2015-09-30 15:06:37: --> 250-tanobelfood.com Hello
mail-wi0-f194.google.com, pleased to meet you

Wed 2015-09-30 15:06:37: --> 250-ETRN

Wed 2015-09-30 15:06:37: --> 250-AUTH LOGIN CRAM-MD5 PLAIN

Wed 2015-09-30 15:06:37: --> 250-8BITMIME

Wed 2015-09-30 15:06:37: --> 250 SIZE 1024

Wed 2015-09-30 15:06:38: <-- MAIL FROM:
SIZE=38361

Wed 2015-09-30 15:06:38: Performing PTR lookup (194.212.85.209.IN-ADDR.ARPA)

Wed 2015-09-30 15:06:38: *  D=194.212.85.209.IN-ADDR.ARPA TTL=(1440)
PTR=[mail-wi0-f194.google.com]

Wed 2015-09-30 15:06:38: *  Gathering A records...

Wed 2015-09-30 15:06:38: *  D=mail-wi0-f194.google.com TTL=(1440)
A=[209.85.212.194]

Wed 2015-09-30 15:06:38:  End PTR results

Wed 2015-09-30 15:06:38: Performing IP lookup (mail-wi0-f194.google.com)

Wed 2015-09-30 15:06:38: *  D=mail-wi0-f194.google.com TTL=(1440)
A=[209.85.212.194]

Wed 2015-09-30 15:06:38:  End IP lookup results

Wed 2015-09-30 15:06:38: Performing IP lookup (gmail.com)

Wed 2015-09-30 15:06:38: *  D=gmail.com TTL=(36) A=[74.125.130.19]

Wed 2015-09-30 15:06:38: *  D=gmail.com TTL=(36) A=[74.125.130.83]

Wed 2015-09-30 15:06:38: *  D=gmail.com TTL=(36) A=[74.125.130.18]

Wed 2015-09-30 15:06:38: *  D=gmail.com TTL=(36) A=[74.125.130.17]

Wed 2015-09-30 15:06:38: *  P=005 S=002 D=gmail.com TTL=(56)
MX=[gmail-smtp-in.l.google.com]

Wed 2015-09-30 15:06:38: *  P=010 S=000 D=gmail.com TTL=(56)
MX=[alt1.gmail-smtp-in.l.google.com]

Wed 2015-09-30 15:06:38: *  P=020 S=003 D=gmail.com TTL=(56)
MX=[alt2.gmail-smtp-in.l.google.com]

Wed 2015-09-30 15:06:38: *  P=030 S=001 D=gmail.com TTL=(56)
MX=[alt3.gmail-smtp-in.l.google.com]

Wed 2015-09-30 15:06:38: *  P=040 S=004 D=gmail.com TTL=(56)
MX=[alt4.gmail-smtp-in.l.google.com]

Wed 2015-09-30 15:06:38: *  D=gmail.com TTL=(36) A=[74.125.130.19]

Wed 2015-09-30 15:06:38: *  D=gmail.com TTL=(36) A=[74.125.130.19]

Wed 2015-09-30 15:06:38: *  D=gmail.com TTL=(36) A=[74.125.130.19]

Wed 2015-09-30 15:06:38: *  D=gmail.com TTL=(36) A=[74.125.130.19]

Wed 2015-09-30 15:06:38: *  D=gmail.com TTL=(36) A=[74.125.130.19]

Wed 2015-09-30 15:06:38:  End IP lookup results

Wed 2015-09-30 15:06:38: Performing SPF lookup (gmail.com / 209.85.212.194)

Wed 2015-09-30 15:09:38: *  DNS: 180 second wait for DNS response exceeded
(DNS Server: 202.134.1.10)

Wed 2015-09-30 15:12:38: *  DNS: 180 second wait for DNS response exceeded
(DNS Server: 118.98.44.100)

Wed 2015-09-30 15:12:38: *  Result: none; no SPF record in DNS

Wed 2015-09-30 15:12:38:  End SPF results

Wed 2015-09-30 15:12:38: --> 250 , Sender ok

Wed 2015-09-30 15:12:38: Connection closed

Wed 2015-09-30 15:12:38: SMTP session terminated (Bytes in/out: 84/269)

Wed 2015-09-30 15:12:38: --

Wed 2015-09-30 15:06:39: Session 2838; child 46

Wed 2015-09-30 15:06:39: Accepting SMTP connection from
[106.10.151.149:46318] to [192.168.1.10:25]

Wed 2015-09-30 15:06:39: --> 220 tanobelfood.com ESMTP MDaemon 13.0.4; Wed,
30 Sep 2015 15:06:39 +0700

Wed 2015-09-30 15:06:39: <-- EHLO nm28-vm6.bullet.mail.sg3.yahoo.com

Wed 2015-09-30 15:06:39: --> 250-tanobelfood.com Hello
nm28-vm6.bullet.mail.sg3.yahoo.com, pleased to meet you

Wed 2015-09-30 15:06:39: --> 250-ETRN

Wed 2015-09-30 15:06:39: --> 250-AUTH LOGIN CRAM-MD5 PLAIN

Wed 2015-09-30 15:06:39: --> 250-8BITMIME

Wed 2015-09-30 15:06:39: --> 250 SIZE 1024

Wed 2015-09-30 15:06:39: <-- MAIL FROM:

Wed 2015-09-30 15:06:39: Performing PTR lookup (149.151.10.106.IN-ADDR.ARPA)

Wed 2015-09-30 15:06:39: *  D=149.151.10.106.IN-ADDR.ARPA TTL=(30)
PTR=[nm28-vm6.bullet.mail.sg3.yahoo.com]

Wed 2015-09-30 15:06:39: *  Gathering A records...

Wed 2015-09-30 15:06:39: *  D=nm28-vm6.bullet.mail.sg3.yahoo.com TTL=(30)
A=[106.10.151.149]

Wed 2015-09-30 15:06:39:  End PTR results

Wed 2015-09-30 15:06:39: Performing IP lookup
(nm28-vm6.bullet.mail.sg3.yahoo.com)

Wed 2015-09-30 15:06:39: *  D=nm28-vm6.bullet.mail.sg3.yahoo.com TTL=(60)
A=[106.10.151.149]

Wed 2015-09-30 15:06:39:  End IP lookup results

Wed 2015-09-30 15:06:39: Performing IP lookup (yahoo.co.id)

Wed 2015-09-30 15:06:39: *  D=yahoo.co.id TTL=(119) A=[98.137.236.150]

Wed 2015-09-30 15:06:39: *  D=yahoo.co.id TTL=(119) A=[188.125.73.108]

Wed 2015-09-30 15:06:39: *  D=yahoo.co.id TTL=(119) 

[MDaemon-L] Analisa log SMTP IN

[farid]

Terima kasih Pak Syafril 


-Original Message-
From: MDaemon-L@dutaint.com [mailto:MDaemon-L@dutaint.com] On Behalf Of
Syafril Hermansyah
Sent: Wednesday, September 30, 2015 1:00 PM
To: Milis Komunitas MDaemon Indonesia
Subject: [MDaemon-L] Analisa log SMTP IN

On 30/09/15 11:52, farid wrote:
> apakah penyabab dari mail tidak bisa masuk ?

Karena sender kirim mail dengan size lebih dari 1024 Kb (smtp size
limit).

--
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, MDaemon 15.5.1-64 Beta B, SP 4.5.1-64 Harap tidak cc:
atau kirim ke private mail untuk masalah MDaemon.

Seorang pemberani yang sebenarnya bukannya dia yang dengan membabi buta
melompat masuk ke dalam jurang, melainkan adalah dia yang dengan
perlahan-lahan dan mata terbuka memasuki jurang itu setelah mengukur
dalamnya
-- P.J. Stahl


--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id Henti Langgan: Kirim mail ke
MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com Versi
terakhir MD 15.5.0, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2



-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.5.0, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2

[MDaemon-L] Analisa log SMTP IN

[farid]

Terima kasih Pak Syahril 

-Original Message-
From: MDaemon-L@dutaint.com [mailto:MDaemon-L@dutaint.com] On Behalf Of
Syafril Hermansyah
Sent: Wednesday, September 30, 2015 1:00 PM
To: Milis Komunitas MDaemon Indonesia
Subject: [MDaemon-L] Analisa log SMTP IN

On 30/09/15 11:52, farid wrote:
> apakah penyabab dari mail tidak bisa masuk ?

Karena sender kirim mail dengan size lebih dari 1024 Kb (smtp size
limit).

--
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, MDaemon 15.5.1-64 Beta B, SP 4.5.1-64 Harap tidak cc:
atau kirim ke private mail untuk masalah MDaemon.

Seorang pemberani yang sebenarnya bukannya dia yang dengan membabi buta
melompat masuk ke dalam jurang, melainkan adalah dia yang dengan
perlahan-lahan dan mata terbuka memasuki jurang itu setelah mengukur
dalamnya
-- P.J. Stahl


--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id Henti Langgan: Kirim mail ke
MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com Versi
terakhir MD 15.5.0, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2



-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.5.0, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2

[MDaemon-L] Analisa Log SMTP IN

[Syafril Hermansyah]

On 30/09/15 15:21, farid wrote:
> Apakah Log In dibawah ini juga diakibatkan karena SIZE 1024
> sehingga session Terminated .

Tidak.

> Saya telah merubah setting refuses message to domain large than
> semula 10240 kb  kemudian jadi 0 .

Tidak ada pengaruhnya, mail tidak masuk bukan karena message size tetapi
karena time out.

> Wed 2015-09-30 15:09:38: *  DNS: 180 second wait for DNS response exceeded 
> (DNS Server: 202.134.1.10)
> 
> Wed 2015-09-30 15:12:38: *  DNS: 180 second wait for DNS response exceeded 
> (DNS Server: 118.98.44.100)

Yang diatas itu salah satu sumber penyebab time out, dalam hal itu idle
time outnya terlalu tinggi.
Idle time out DNS rekomendasinya tidak melebihi 60 seconds.

Gunakan DNS benchmark untuk mencari tahu DNS terbaik untuk server Anda,
run di MDaemon server.

http://www.mail-archive.com/mdaemon-l@dutaint.com/msg22546.html

http://www.techsupportalert.com/content/how-find-best-dns-server.htm



-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, MDaemon 15.5.1-64 Beta B, SP 4.5.1-64
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.

Kejujuran mrpkan dasar dari semua sukses, tanpa kejujuran ini
kepercayaan dan kemampuan utk melakukan apapun akan terhenti
-- Mary Kay Ash


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.5.0, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2

[MDaemon-L] Analisa log SMTP IN

[farid]

 

Dear P.Syahril 

 

Mohon Analisa Log SMTP IN  , apakah penyabab dari mail tidak bisa masuk ?

 

Regard's

 

Moch.Farid

 

 

 

Session 1321; child 40

Wed 2015-09-30 11:15:24: Accepting SMTP connection from
[106.10.148.163:33761] to [192.168.1.10:25]

Wed 2015-09-30 11:15:24: --> 220 tanobelfood.com ESMTP MDaemon 13.0.4; Wed,
30 Sep 2015 11:15:24 +0700

Wed 2015-09-30 11:15:24: <-- EHLO nm6-vm4.bullet.mail.sg3.yahoo.com

Wed 2015-09-30 11:15:24: --> 250-tanobelfood.com Hello
nm6-vm4.bullet.mail.sg3.yahoo.com, pleased to meet you

Wed 2015-09-30 11:15:24: --> 250-ETRN

Wed 2015-09-30 11:15:24: --> 250-AUTH LOGIN CRAM-MD5 PLAIN

Wed 2015-09-30 11:15:24: --> 250-8BITMIME

Wed 2015-09-30 11:15:24: --> 250 SIZE 1024

Wed 2015-09-30 11:15:24: <-- QUIT

Wed 2015-09-30 11:15:24: --> 221 See ya in cyberspace

Wed 2015-09-30 11:15:24: SMTP session terminated (Bytes in/out: 46/257)

Wed 2015-09-30 11:15:24: --

Wed 2015-09-30 11:15:24: Session 1322; child 40

Wed 2015-09-30 11:15:24: Accepting SMTP connection from
[106.10.148.163:52272] to [192.168.1.10:25]

Wed 2015-09-30 11:15:24: --> 220 tanobelfood.com ESMTP MDaemon 13.0.4; Wed,
30 Sep 2015 11:15:24 +0700

Wed 2015-09-30 11:15:24: <-- EHLO nm6-vm4.bullet.mail.sg3.yahoo.com

Wed 2015-09-30 11:15:24: --> 250-tanobelfood.com Hello
nm6-vm4.bullet.mail.sg3.yahoo.com, pleased to meet you

Wed 2015-09-30 11:15:24: --> 250-ETRN

Wed 2015-09-30 11:15:24: --> 250-AUTH LOGIN CRAM-MD5 PLAIN

Wed 2015-09-30 11:15:24: --> 250-8BITMIME

Wed 2015-09-30 11:15:24: --> 250 SIZE 1024

Wed 2015-09-30 11:15:24: <-- QUIT

Wed 2015-09-30 11:15:24: --> 221 See ya in cyberspace

Wed 2015-09-30 11:15:24: SMTP session terminated (Bytes in/out: 46/257)

Wed 2015-09-30 11:15:24: --

Wed 2015-09-30 11:15:24: Session 1323; child 40

Wed 2015-09-30 11:15:24: Accepting SMTP connection from
[106.10.148.163:39971] to [192.168.1.10:25]

Wed 2015-09-30 11:15:24: --> 220 tanobelfood.com ESMTP MDaemon 13.0.4; Wed,
30 Sep 2015 11:15:24 +0700

Wed 2015-09-30 11:15:24: <-- EHLO nm6-vm4.bullet.mail.sg3.yahoo.com

Wed 2015-09-30 11:15:24: --> 250-tanobelfood.com Hello
nm6-vm4.bullet.mail.sg3.yahoo.com, pleased to meet you

Wed 2015-09-30 11:15:24: --> 250-ETRN

Wed 2015-09-30 11:15:24: --> 250-AUTH LOGIN CRAM-MD5 PLAIN

Wed 2015-09-30 11:15:24: --> 250-8BITMIME

Wed 2015-09-30 11:15:24: --> 250 SIZE 1024

Wed 2015-09-30 11:15:24: <-- QUIT

Wed 2015-09-30 11:15:24: --> 221 See ya in cyberspace

Wed 2015-09-30 11:15:24: SMTP session terminated (Bytes in/out: 46/257)

Wed 2015-09-30 11:15:24: --

Wed 2015-09-30 11:15:24: Session 1324; child 40

Wed 2015-09-30 11:15:24: Accepting SMTP connection from
[106.10.148.163:36544] to [192.168.1.10:25]

Wed 2015-09-30 11:15:24: --> 220 tanobelfood.com ESMTP MDaemon 13.0.4; Wed,
30 Sep 2015 11:15:24 +0700

Wed 2015-09-30 11:15:24: <-- EHLO nm6-vm4.bullet.mail.sg3.yahoo.com

Wed 2015-09-30 11:15:24: --> 250-tanobelfood.com Hello
nm6-vm4.bullet.mail.sg3.yahoo.com, pleased to meet you

Wed 2015-09-30 11:15:24: --> 250-ETRN

Wed 2015-09-30 11:15:24: --> 250-AUTH LOGIN CRAM-MD5 PLAIN

Wed 2015-09-30 11:15:24: --> 250-8BITMIME

Wed 2015-09-30 11:15:24: --> 250 SIZE 1024

Wed 2015-09-30 11:15:24: <-- QUIT

Wed 2015-09-30 11:15:24: --> 221 See ya in cyberspace

Wed 2015-09-30 11:15:24: SMTP session terminated (Bytes in/out: 46/257)


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.5.0, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2

[MDaemon-L] Analisa log

[Syafril Hermansyah]

On 08/09/15 13:43, Yudis wrote:
> User kami tidak pernah melalukan forwading ke akun zee...@live.com
> Setelah saya cek, ternyata akun user kami tsb menu forwardingnya aktif
> dan dituju ke akun zee...@live.com
> Saya sdh ganti password user tsb dan menonaktifkan forwading.

Yang lebih penting adalah ganti passwordnya dengan "Strong password",
karena itulah sumber masalah sebenarnya yang membuat spammer bisa
mengaktifkan autoforward ke akun miliknya untuk keperluan
industrial/marketing intelligent.

Kalau sudah pakai MD 15.0.3 keatas maka perubahan password akun itu bisa
dengan weak password jika lewat webadmin (remote administration) akan
tetapi sebaiknya dipaksa ke user tersebut untuk ganti passwordnya dulu
lewat webmail baru bisa diakses lewat email client.

http://mdaemon.dutaint.co.id/mdaemon/15.0/index.html?ae_account.htm

[x] Account must change mailbox password before it can connect

di versi mendatang perubahan lewat MDconfig oleh system administrator
juga bisa pakai weak password.

Jika masih pakai MDaemon lama maka terpaksa Anda harus non aktifkan dulu
strong password, dan setelah ganti password diaktifkan kembali.


> Yang ingin saya tanyakan lagi Pak, sumber pemalsu itu berasal dari mana ya 
> Pak ?
> Apakah pemilik akun zee...@live.com ?

Ya, kemungkinan besar begitu.

> Dan berarti dia membuat akun pemalsu dari domain @honeyvel.com

Kemungkinan begitu, dengan perkataan lain akun di domain honeyvel.com
juga palsu.
Ini adalah trick hacker tingkat tinggi untuk melakukan penipuan.

Untuk sementara di block saja domain honeyvel.com di sender blacklist
dan recipient blacklist.

http://mdaemon.dutaint.co.id/mdaemon/15.0/index.html?security--sender-blacklist.htm

http://mdaemon.dutaint.co.id/mdaemon/15.0/index.html?security--recipient-blacklist.htm

-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, MDaemon 15.5-64 Beta RC4, SP 4.5.1-64
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.

Meraih mimpi itu baik tapi melampaui mimpi itu jauh lebih baik…
--- Anies Baswedan


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.0.3, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2

[MDaemon-L] Analisa log

[Ivan]

Sorry ikut nimbrung, cukup menarik ini casenya. maksud menu forwarding 
aktif ini di MD atau di mail client ? kalau di MD bukankah hanya admin 
yang bisa setting mail forwarding ?



On 08/09/2015 13:43, Yudis wrote:
Setelah saya cek, ternyata akun user kami tsb menu forwardingnya aktif 
dan dituju ke akun zee...@live.com


--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.0.3, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2

[MDaemon-L] Analisa log

[Yudis]

On 9/8/2015 2:42 PM, Ivan wrote:
Sorry ikut nimbrung, cukup menarik ini casenya. maksud menu forwarding 
aktif ini di MD atau di mail client ? kalau di MD bukankah hanya admin 
yang bisa setting mail forwarding ?




Iya Mas Ivan, menu ini aktif sendiri tanpa admin atau user yang 
mengaktifkannya.Tidak tahu aktifnya melalui MD atau webmail.
Sepertinya ini ulah spam yang bisa mengaktifkan forwarding dan mengisi 
alamat email yang dituju. Benar2 hacker tinggat tinggi yang bisa 
melakukannya. :-(
Ada baiknya seperti saran Pak Syafril tiap user harus mengaktifkan 
strong password agar tidak kena hijack spam.


Regards
Yudis

--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.0.3, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2

[MDaemon-L] Analisa log

[Yudis]

On 9/8/2015 2:10 PM, Syafril Hermansyah wrote:

Yang lebih penting adalah ganti passwordnya dengan "Strong password",
karena itulah sumber masalah sebenarnya yang membuat spammer bisa
mengaktifkan autoforward ke akun miliknya untuk keperluan
industrial/marketing intelligent.

Kalau sudah pakai MD 15.0.3 keatas maka perubahan password akun itu bisa
dengan weak password jika lewat webadmin (remote administration) akan
tetapi sebaiknya dipaksa ke user tersebut untuk ganti passwordnya dulu
lewat webmail baru bisa diakses lewat email client.

http://mdaemon.dutaint.co.id/mdaemon/15.0/index.html?ae_account.htm

[x] Account must change mailbox password before it can connect

di versi mendatang perubahan lewat MDconfig oleh system administrator
juga bisa pakai weak password.

Jika masih pakai MDaemon lama maka terpaksa Anda harus non aktifkan dulu
strong password, dan setelah ganti password diaktifkan kembali.



Iya Pak, memang user kami itu blm memenuhi kriteria strong password.
Saya sdh menggantinya dengan strong password.

Terima kasih atas penjelasannya Pak.


Kemungkinan begitu, dengan perkataan lain akun di domain honeyvel.com
juga palsu.
Ini adalah trick hacker tingkat tinggi untuk melakukan penipuan.

Untuk sementara di block saja domain honeyvel.com di sender blacklist
dan recipient blacklist.

http://mdaemon.dutaint.co.id/mdaemon/15.0/index.html?security--sender-blacklist.htm

http://mdaemon.dutaint.co.id/mdaemon/15.0/index.html?security--recipient-blacklist.htm



Baik Pak, sudah saya block.
Sepertinya hacker ini memang hacker tinggi Pak, sampai kita sudah 
percaya untuk transfer pembayaran ke rekening yang mereka info.

Karena mereka sudah tahu history email dari user kami itu.
Tapi kami bersyukur uangnya masih tertahan oleh pihak bank karena kita 
mencantumkan nama perusahaan yang dituju berbeda dengan pemilik 
rekening. :-)


Terima kasih atas penjelasannya Pak

Regards
Yudis

--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.0.3, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2

[MDaemon-L] Analisa log

[Yudis]

On 9/8/2015 12:05 PM, Syafril Hermansyah wrote:
Kalau user itu memang sengaja (secara sadar) mengaktifkan autoforward 
akunnya ke zee...@live.com maka tidak kena hijack. Tetapi kalau user 
itu tidak tahu kalau akunnya mengaktifkan autoforward ke 
zee...@live.com maka benar akun itu ter hijack. Trick 
mengubah/mengaktifkan autoforward ini merupakan salah satu cara 
spammer untuk mengumpulkan informasi (industry intelligent). 

User kami tidak pernah melalukan forwading ke akun zee...@live.com
Setelah saya cek, ternyata akun user kami tsb menu forwardingnya aktif 
dan dituju ke akun zee...@live.com

Saya sdh ganti password user tsb dan menonaktifkan forwading.

Saya tidak tahu persisnya. Kelihatannya sih mirip dengan cara memalsu 
"tahu sumedang asli Bung Seng" dengan "tahu sumedang tiruan Bung 
Keng". Sudah periksa ke http://www.honeyvel.com atau 
http://www.heysu.com? Apakah perusahaan itu memang rekan bisnis 
perusahaan? 
Http://www.honeyvel.com atau http://www.heysu.com bukan rekan bisnis 
kami Pak.

Http://www.honeywell.com yang rekan bisnis kami.
Dan kami tidak memperhatikan antara email dari 
sor.pheng.c...@honeyvell.com dan sor.pheng.c...@honeywell.com
Sepertinya orang ini (sor.pheng.c...@honeyvell.com) sudah mengumpulkan 
informasi dari forwarding email dan berusaha memanfaatkan kelengahan kami.
Kami sampai balas2an email ke sor.pheng.c...@honeyvell.com dan tanpa 
kami sadari ternyata alamat emailnya berbeda dengan rekan bisnis kami 
yang sebenarnya. Sampai kami konfirmasi ke rekan bisnis kami 
(sor.pheng.c...@honeywell.com) bahwa dia tidak pernah balas2an email apapun.


Yang ingin saya tanyakan lagi Pak, sumber pemalsu itu berasal dari mana 
ya Pak ?

Apakah pemilik akun zee...@live.com ?
Dan berarti dia membuat akun pemalsu dari domain @honeyvel.com

Terima kasih

Regards

Yudis

--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.0.3, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2

[MDaemon-L] Analisa log

[Syafril Hermansyah]

On 08/09/15 14:42, Ivan wrote:

---
Mohon tidak posting dengan top posting style di milis ini, selalu
gunakan bottom posting style untuk kemudahaan pembacaan.

Mail yang susah dibaca akan lambat diresponse karena butuh waktu untuk
mengerti maksudnya.
Top posting merepotkan pembacaan di perangkat bergerak (mobile device)
karena harus menaik/turunkan kursor (scroll up/scroll down) untuk
mengkaitkan antara response dengan konteks pembicaraan (saya terbiasa
baca dulu mail dari milis di mobile devices, yang susah dibaca di
tandai/tag "later").

Untuk saya mail dengan top posting mengindikasikan mail itu
tidak urgent, jadi boleh diresponse kapan-2x saja atau tidak usah
diresponse sama sekali.

Yang dimaksud top posting
http://en.wikipedia.org/wiki/Posting_style#Top-posting

dan yang dimaksud bottom posting
http://en.wikipedia.org/wiki/Posting_style#Bottom-posting

Bottom posting butuh disiplin dalam memangkas teks yang dikutip ulang,
sisakan hanya teks sesuai dengan konteks yang akan dijawab saja.

http://en.wikipedia.org/wiki/Posting_style#How_much_to_trim

Gunakan fitur select text when reply di Thunderbird akan sangat membantu

http://www.ghidinelli.com/2010/11/08/faster-email-reply-partial-quote-thunderbird

Kalau ingin kursor otomatis ada dibawah maka ubah sedikit settingnya

http://help.ic.utoronto.ca/content/54/322/en/location-of-your-reply-and-signature-in-thunderbird.html
---

> Sorry ikut nimbrung, cukup menarik ini casenya. maksud menu forwarding
> aktif ini di MD atau di mail client ? 

Hanya di MDaemon yang bisa otomatis mail diforward dan hidup/aktif terus
7x24 jam.

> kalau di MD bukankah hanya admin  yang bisa setting mail forwarding ?

Kalau user diberi hak untuk mengaktifkan "edit forwarding address" maka
user tersebut akan bisa mengaktifkannya dari webmail advance menu
(webadmin).

http://mdaemon.dutaint.co.id/mdaemon/15.0/index.html?template-manager_web-services.htm

-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, MDaemon 15.5-64 Beta RC4, SP 4.5.1-64
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.

Org yg bijaksana adalah yang mengetahui sejauh mana dia bisa pergi
terlalu jauh
-- Jean Cocteau, born 1891


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.0.3, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2

[MDaemon-L] Analisa log

[Yudis]

Pak Syafril,

Mohon bantuan analisa log terlampir.

Yang ingin saya tanyakan :
1. Apakah email a...@saranainstrument.com kena hijack ?
2. Apakah domain @honeyvel.com adalah domain yang memalsukan dari domain 
@honeywell.com ?


Terima kasih
--
Regards,
*Yudis*
*IT Officer*
+62-21-5347855
Ext.321
Tue 2015-09-01 04:14:25: Session 084224; child 0001
Tue 2015-09-01 04:14:25: Accepting SMTP connection from [64.98.42.187:44069] to 
[113.11.130.172:25]
Tue 2015-09-01 04:14:25: --> 220 mx.saranainstrument.com ESMTP MDaemon 13.6.2; 
Tue, 01 Sep 2015 04:14:25 +0700
Tue 2015-09-01 04:14:25: <-- EHLO smtprelay.b.hostedemail.com
Tue 2015-09-01 04:14:25: --> 250-mx.saranainstrument.com Hello 
smtprelay.b.hostedemail.com, pleased to meet you
Tue 2015-09-01 04:14:25: --> 250-ETRN
Tue 2015-09-01 04:14:25: --> 250-AUTH LOGIN CRAM-MD5 PLAIN
Tue 2015-09-01 04:14:25: --> 250-8BITMIME
Tue 2015-09-01 04:14:25: --> 250-STARTTLS
Tue 2015-09-01 04:14:25: --> 250 SIZE 1536
Tue 2015-09-01 04:14:25: <-- MAIL FROM: SIZE=73361
Tue 2015-09-01 04:14:25: Performing PTR lookup (187.42.98.64.IN-ADDR.ARPA)
Tue 2015-09-01 04:14:25: *  D=187.42.98.64.IN-ADDR.ARPA TTL=(60) 
PTR=[smtprelay0187.b.hostedemail.com]
Tue 2015-09-01 04:14:25: *  D=187.42.98.64.IN-ADDR.ARPA TTL=(1440) 
PTR=[smtprelay0187.b.hostedemail.com]
Tue 2015-09-01 04:14:25: *  Gathering A records...
Tue 2015-09-01 04:14:26: *  D=smtprelay0187.b.hostedemail.com TTL=(60) 
A=[64.98.42.187]
Tue 2015-09-01 04:14:26: *  D=smtprelay0187.b.hostedemail.com TTL=(60) 
A=[64.98.42.187]
Tue 2015-09-01 04:14:26:  End PTR results
Tue 2015-09-01 04:14:26: Performing IP lookup (smtprelay.b.hostedemail.com)
Tue 2015-09-01 04:14:26: *  D=smtprelay.b.hostedemail.com TTL=(60) 
A=[64.98.36.5]
Tue 2015-09-01 04:14:26:  End IP lookup results
Tue 2015-09-01 04:14:26: Performing IP lookup (honeyvell.com)
Tue 2015-09-01 04:14:27: *  D=honeyvell.com TTL=(5) A=[54.247.176.36]
Tue 2015-09-01 04:14:27: *  P=010 S=000 D=honeyvell.com TTL=(30) 
MX=[mx.honeyvell.com.cust.b.hostedemail.com]
Tue 2015-09-01 04:14:27: *  D=honeyvell.com TTL=(5) A=[54.247.176.36]
Tue 2015-09-01 04:14:27:  End IP lookup results
Tue 2015-09-01 04:14:27: Performing SPF lookup (honeyvell.com / 64.98.42.187)
Tue 2015-09-01 04:14:35: *  Result: none; no SPF record in DNS
Tue 2015-09-01 04:14:35:  End SPF results
Tue 2015-09-01 04:14:35: --> 250 , Sender ok
Tue 2015-09-01 04:14:35: <-- RCPT TO:
Tue 2015-09-01 04:14:35: --> 250 , Recipient ok
Tue 2015-09-01 04:14:36: <-- RCPT TO:
Tue 2015-09-01 04:14:36: --> 250 , Recipient ok
Tue 2015-09-01 04:14:36: <-- RCPT TO:
Tue 2015-09-01 04:14:36: --> 250 , Recipient ok
Tue 2015-09-01 04:14:36: <-- RCPT TO:
Tue 2015-09-01 04:14:36: --> 250 , Recipient ok
Tue 2015-09-01 04:14:37: <-- DATA
Tue 2015-09-01 04:14:37: Creating temp file (SMTP): 
d:\mdaemon\queues\temp\md5211443.tmp
Tue 2015-09-01 04:14:37: --> 354 Enter mail, end with .
Tue 2015-09-01 04:14:38: Message size: 73349 bytes
Tue 2015-09-01 04:14:38: Performing DKIM lookup
Tue 2015-09-01 04:14:38: *  File: d:\mdaemon\queues\temp\md5211443.tmp
Tue 2015-09-01 04:14:38: *  Message-ID: 
178a1dfa6b63e443aa7bf01dbdb70...@honeyvell.com
Tue 2015-09-01 04:14:43: *  Result: neutral
Tue 2015-09-01 04:14:43:  End DKIM results
Tue 2015-09-01 04:14:43: Performing DomainKeys lookup (Sender: 
sor.pheng.c...@honeyvell.com)
Tue 2015-09-01 04:14:43: *  File: d:\mdaemon\queues\temp\md5211443.tmp
Tue 2015-09-01 04:14:43: *  Message-ID: 
178a1dfa6b63e443aa7bf01dbdb70...@honeyvell.com
Tue 2015-09-01 04:14:43: *  Querying for policy: honeyvell.com
Tue 2015-09-01 04:14:43: *Querying: _domainkey.honeyvell.com ...
Tue 2015-09-01 04:14:50: *DNS: *  The name server reports that it is having 
technical problems
Tue 2015-09-01 04:14:50: *  Result: neutral
Tue 2015-09-01 04:14:50:  End DomainKeys results
Tue 2015-09-01 04:14:50: Passing message through AntiVirus (Size: 73349)...
Tue 2015-09-01 04:14:50: *  Message is clean (no viruses found)
Tue 2015-09-01 04:14:50:  End AntiVirus results
Tue 2015-09-01 04:14:50: Passing message through Spam Filter (Size: 73349)...
Tue 2015-09-01 04:14:56: *  0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query 
to URIBL was blocked.
Tue 2015-09-01 04:14:56: *   See 
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
Tue 2015-09-01 04:14:56: *  for more information.
Tue 2015-09-01 04:14:56: *  [URIs: saranainstrument.com]
Tue 2015-09-01 04:14:56: * -4.7 BAYES_00 BODY: Bayes spam probability is 0 to 1%
Tue 2015-09-01 04:14:56: *  [score: 0.]
Tue 2015-09-01 04:14:56: *  0.0 HTML_MESSAGE BODY: HTML included in message
Tue 2015-09-01 04:14:56: *  0.0 LOTS_OF_MONEY Huge... sums of money
Tue 

[MDaemon-L] analisa LOG E-mail

[fernando]

Dear pak syahrill,

 

saya mau tanya kalau terima e-mail dari domain lain misalnya gmail dan yahoo


terima e-mailnya bisa lama sekali

 

mohon pencerahannya

 

berikut log 

 

Wed 2015-09-02 14:38:33.549: 02: <-- MAIL FROM:
SIZE=1813

Wed 2015-09-02 14:38:33.551: 05: Performing PTR lookup
(195.223.85.209.IN-ADDR.ARPA)

Wed 2015-09-02 14:38:33.551: 05: *  D=195.223.85.209.in-addr.arpa TTL=(1413)
PTR=[mail-io0-f195.google.com]

Wed 2015-09-02 14:38:33.552: 05: *  D=mail-io0-f195.google.com TTL=(1413)
A=[209.85.223.195]

Wed 2015-09-02 14:38:33.552: 05:  End PTR results

Wed 2015-09-02 14:38:33.554: 05: Performing IP lookup
(mail-io0-f195.google.com)

Wed 2015-09-02 14:38:33.555: 05: *  D=mail-io0-f195.google.com TTL=(1413)
A=[209.85.223.195]

Wed 2015-09-02 14:38:33.555: 05:  End IP lookup results

Wed 2015-09-02 14:38:33.557: 05: Performing IP lookup (gmail.com)

Wed 2015-09-02 14:38:35.568: 05: *  D=gmail.com TTL=(1) A=[74.125.200.83]

Wed 2015-09-02 14:38:35.568: 05: *  D=gmail.com TTL=(1) A=[74.125.200.17]

Wed 2015-09-02 14:38:35.568: 05: *  D=gmail.com TTL=(1) A=[74.125.200.18]

Wed 2015-09-02 14:38:35.568: 05: *  D=gmail.com TTL=(1) A=[74.125.200.19]

Wed 2015-09-02 14:38:35.569: 05: *  P=005 S=004 D=gmail.com TTL=(41)
MX=[gmail-smtp-in.l.google.com]

Wed 2015-09-02 14:38:35.569: 05: *  P=010 S=000 D=gmail.com TTL=(41)
MX=[alt1.gmail-smtp-in.l.google.com]

Wed 2015-09-02 14:38:35.569: 05: *  P=020 S=001 D=gmail.com TTL=(41)
MX=[alt2.gmail-smtp-in.l.google.com]

Wed 2015-09-02 14:38:35.569: 05: *  P=030 S=002 D=gmail.com TTL=(41)
MX=[alt3.gmail-smtp-in.l.google.com]

Wed 2015-09-02 14:38:35.569: 05: *  P=040 S=003 D=gmail.com TTL=(41)
MX=[alt4.gmail-smtp-in.l.google.com]

Wed 2015-09-02 14:38:35.598: 05: *  D=gmail-smtp-in.l.google.com TTL=(5)
A=[74.125.130.27]

Wed 2015-09-02 14:38:35.617: 05: *  D=alt1.gmail-smtp-in.l.google.com
TTL=(5) A=[173.194.72.27]

Wed 2015-09-02 14:38:35.657: 05: *  D=alt2.gmail-smtp-in.l.google.com
TTL=(1) A=[74.125.25.27]

Wed 2015-09-02 14:38:35.662: 05: *  D=alt3.gmail-smtp-in.l.google.com
TTL=(1) A=[173.194.64.26]

Wed 2015-09-02 14:38:35.698: 05: *  D=alt4.gmail-smtp-in.l.google.com
TTL=(5) A=[74.125.207.27]

Wed 2015-09-02 14:38:35.698: 05:  End IP lookup results

Wed 2015-09-02 14:38:35.699: 09: Performing SPF lookup (gmail.com /
209.85.223.195)

Wed 2015-09-02 14:38:35.774: 09: *  Policy: v=spf1 redirect=_spf.google.com

Wed 2015-09-02 14:38:35.774: 09: *  Evaluating redirect=_spf.google.com: 

Wed 2015-09-02 14:38:35.774: 09: *  Evaluating redirect=_spf.google.com:
performing lookup

Wed 2015-09-02 14:38:35.790: 09: *Policy: v=spf1
include:_netblocks.google.com include:_netblocks2.google.com
include:_netblocks3.google.com ~all

Wed 2015-09-02 14:38:35.790: 09: *Evaluating
include:_netblocks.google.com: performing lookup

Wed 2015-09-02 14:38:35.790: 09: *  Policy (cache): v=spf1
ip4:64.18.0.0/20 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20
ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16
ip4:207.126.144.0/20 ip4:209.85.128.0/17 ip4:216.58.192.0/19
ip4:216.239.32.0

Wed 2015-09-02 14:38:35.790: 09: *  Evaluating ip4:64.18.0.0/20: no
match

Wed 2015-09-02 14:38:35.790: 09: *  Evaluating ip4:64.233.160.0/19: no
match

Wed 2015-09-02 14:38:35.790: 09: *  Evaluating ip4:66.102.0.0/20: no
match

Wed 2015-09-02 14:38:35.790: 09: *  Evaluating ip4:66.249.80.0/20: no
match

Wed 2015-09-02 14:38:35.790: 09: *  Evaluating ip4:72.14.192.0/18: no
match

Wed 2015-09-02 14:38:35.790: 09: *  Evaluating ip4:74.125.0.0/16: no
match

Wed 2015-09-02 14:38:35.790: 09: *  Evaluating ip4:108.177.8.0/21: no
match

Wed 2015-09-02 14:38:35.790: 09: *  Evaluating ip4:173.194.0.0/16: no
match

Wed 2015-09-02 14:38:35.790: 09: *  Evaluating ip4:207.126.144.0/20: no
match

Wed 2015-09-02 14:38:35.790: 09: *  Evaluating ip4:209.85.128.0/17:
match

Wed 2015-09-02 14:38:35.790: 09: *Evaluating
include:_netblocks.google.com: match

Wed 2015-09-02 14:38:35.790: 09: *  Result: pass

Wed 2015-09-02 14:38:35.790: 09:  End SPF results

Wed 2015-09-02 14:38:35.790: 03: --> 250 2.1.0 Sender OK

Wed 2015-09-02 14:38:36.000: 02: <-- RCPT TO:

Wed 2015-09-02 14:38:36.002: 03: --> 451 4.3.0 Greylisting enabled, try
again in 15 minutes   --> mksdnya ini apa yach?

Wed 2015-09-02 14:38:36.211: 02: <-- QUIT

Wed 2015-09-02 14:38:36.211: 03: --> 221 2.0.0 See ya in cyberspace

Wed 2015-09-02 14:38:36.211: 04: SMTP session terminated (Bytes in/out:
760/1647)


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] 

[MDaemon-L] analisa LOG E-mail

[Syafril Hermansyah]

On 02/09/15 16:06, fernando wrote:
> saya mau tanya kalau terima e-mail dari domain lain misalnya gmail dan
> yahoo
> 
> terima e-mailnya bisa lama sekali

Itu karena Anda tangannya jail, mengubah setting MDaemon :-)

> Wed 2015-09-02 14:38:36.002: 03: --> 451 4.3.0 Greylisting enabled, try again 
> in 15 minutes

Ini yang jadi penyebab mail lama masuk, akibat Anda mengaktifkan
greylisting.

http://mdaemon.dutaint.co.id/mdaemon/15.0/index.html?security--greylisting.htm

kalau mengaktifkan greylisting pertama kali memang akan lama terimanya,
nanti setelah beberapa hari (+/- 10 hari) barulah mail masuk akan lebih
cepat walau tidak secepat normal.

lihat keuntungan/kerugian lebih lengkap disini

https://en.wikipedia.org/wiki/Greylisting




-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, MDaemon 15.5-64 Beta RC3, SP 4.5.1-64
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.

Cara utk membuat masa depan bermakna adalah dg mengelolanya, bukan
bertindak reaktif terhadapnya
-- Charles Handy


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.0.3, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2

[MDaemon-L] Analisa Log

[Syafril Hermansyah]

On 24/08/15 09:03, Ivan wrote:
 Pak beberapa user saya ada menerima email spt berikut ini,
 Apakakah si sender
 
 maleo.kadinindonesia.org: authenticated_id: suprayi...@kadin-indonesia.or.id
 
 kena virus/hijack ?

Ya.

 ada problem di sisi MD saya ?

Tidak ada.

-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, MDaemon 15.5-64 Beta RC1, SP 4.5.1-64
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.

Orang rasional menanggapi dunia, orang tdk rasional berusaha membuat
dunia menanggapinya
-- Bernard Shaw


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 15.0.3, SP 4.5.1, BES 2.0.2, OC 3.5, SG 3.0.2

[MDaemon-L] Analisa Log SMTP Out

[Yudis]

Pak Syafril,
Mohon bantuannya menganalisa log dibawah ini :

Fri 2014-10-03 14:27:27: [446661] Session 446661; child 0001
Fri 2014-10-03 14:27:27: [446661] Parsing message 
d:\mdaemon\queues\remote\pd35000196929.msg

Fri 2014-10-03 14:27:27: [446661] *  From: fi...@saranainstrument.com
Fri 2014-10-03 14:27:27: [446661] *  To: to...@ciptaniagagas.com
Fri 2014-10-03 14:27:27: [446661] *  Subject: Test Email
Fri 2014-10-03 14:27:27: [446661] *  Size (bytes): 5233
Fri 2014-10-03 14:27:27: [446661] *  Message-ID: 
004601cfdedb$a31cc710$e9565530$@com
Fri 2014-10-03 14:27:27: [446661] Attempting SMTP connection to 
[ciptaniagagas.com]
Fri 2014-10-03 14:27:27: [446661] Resolving MX records for 
[ciptaniagagas.com] (DNS Server: 209.244.0.3)...
Fri 2014-10-03 14:27:27: [446661] *  P=000 S=000 D=ciptaniagagas.com 
TTL=(240) MX=[ciptaniagagas.com]
Fri 2014-10-03 14:27:27: [446661] Attempting SMTP connection to 
[ciptaniagagas.com:25]
Fri 2014-10-03 14:27:27: [446661] Resolving A record for 
[ciptaniagagas.com] (DNS Server: 209.244.0.3)...
Fri 2014-10-03 14:27:28: [446661] *  D=ciptaniagagas.com TTL=(240) 
A=[203.123.240.43]
Fri 2014-10-03 14:27:28: [446661] Attempting SMTP connection to 
[203.123.240.43:25]

Fri 2014-10-03 14:27:28: [446661] Waiting for socket connection...
Fri 2014-10-03 14:27:28: [446661] *  Connection established 
(113.11.130.172:63816 - 203.123.240.43:25)

Fri 2014-10-03 14:27:28: [446661] Waiting for protocol to start...
Fri 2014-10-03 14:27:28: [446661] -- 220-MasterY.CPanelOnline.net ESMTP 
Exim 4.69 #1 Fri, 03 Oct 2014 14:28:41 +0700
Fri 2014-10-03 14:27:28: [446661] -- 220-We do not authorize the use of 
this system to transport unsolicited,

Fri 2014-10-03 14:27:28: [446661] -- 220 and/or bulk e-mail.
Fri 2014-10-03 14:27:28: [446661] -- EHLO mx.saranainstrument.com
Fri 2014-10-03 14:27:28: [446661] -- 250-MasterY.CPanelOnline.net Hello 
mx.saranainstrument.com [113.11.130.172]

Fri 2014-10-03 14:27:28: [446661] -- 250-SIZE 52428800
Fri 2014-10-03 14:27:28: [446661] -- 250-PIPELINING
Fri 2014-10-03 14:27:28: [446661] -- 250-AUTH PLAIN LOGIN
Fri 2014-10-03 14:27:28: [446661] -- 250-STARTTLS
Fri 2014-10-03 14:27:28: [446661] -- 250 HELP
Fri 2014-10-03 14:27:28: [446661] -- STARTTLS
Fri 2014-10-03 14:27:28: [446661] -- 220 TLS go ahead
Fri 2014-10-03 14:27:29: [446661] SSL negotiation successful (TLS 1.0, 
1024 bit key exchange, 128 bit AES encryption)

Fri 2014-10-03 14:27:29: [446661] -- EHLO mx.saranainstrument.com
Fri 2014-10-03 14:27:29: [446661] -- 250-MasterY.CPanelOnline.net Hello 
mx.saranainstrument.com [113.11.130.172]

Fri 2014-10-03 14:27:29: [446661] -- 250-SIZE 52428800
Fri 2014-10-03 14:27:29: [446661] -- 250-PIPELINING
Fri 2014-10-03 14:27:29: [446661] -- 250-AUTH PLAIN LOGIN
Fri 2014-10-03 14:27:29: [446661] -- 250 HELP
Fri 2014-10-03 14:27:29: [446661] -- MAIL 
From:prvs=1353ed5061=fi...@saranainstrument.com SIZE=5233

Fri 2014-10-03 14:27:29: [446661] -- 250 OK
Fri 2014-10-03 14:27:29: [446661] -- RCPT To:to...@ciptaniagagas.com
Fri 2014-10-03 14:27:30: [446661] -- 550-Callback setup failed while 
verifying prvs=1353ed5061=fi...@saranainstrument.com

Fri 2014-10-03 14:27:30: [446661] -- 550-Called: 113.11.130.172
Fri 2014-10-03 14:27:30: [446661] -- 550-Sent: MAIL FROM:
Fri 2014-10-03 14:27:30: [446661] -- 550-Response: 501 Domain must resolve
Fri 2014-10-03 14:27:30: [446661] -- 550-The initial connection, or a 
HELO or MAIL FROM: command was
Fri 2014-10-03 14:27:30: [446661] -- 550-rejected. Refusing MAIL 
FROM: does not help fight spam, disregards
Fri 2014-10-03 14:27:30: [446661] -- 550-RFC requirements, and stops 
you from receiving standard bounce
Fri 2014-10-03 14:27:30: [446661] -- 550-messages. This host does not 
accept mail from domains whose servers

Fri 2014-10-03 14:27:30: [446661] -- 550-refuse bounces.
Fri 2014-10-03 14:27:30: [446661] -- 550 Sender verify failed
Fri 2014-10-03 14:27:30: [446661] -- QUIT
Fri 2014-10-03 14:27:30: [446661] Attempting to send message to smart host
Fri 2014-10-03 14:27:30: [446661] Attempting SMTP connection to 
[mailman.prima.net.id:25]
Fri 2014-10-03 14:27:30: [446661] Resolving A record for 
[mailman.prima.net.id] (DNS Server: 209.244.0.3)...
Fri 2014-10-03 14:27:31: [446661] *  D=mailman.prima.net.id TTL=(1440) 
A=[113.11.128.2]
Fri 2014-10-03 14:27:31: [446661] Attempting SMTP connection to 
[113.11.128.2:25]

Fri 2014-10-03 14:27:31: [446661] Waiting for socket connection...
Fri 2014-10-03 14:27:31: [446661] *  Connection established 
(113.11.130.172:63817 - 113.11.128.2:25)

Fri 2014-10-03 14:27:31: [446661] Waiting for protocol to start...
Fri 2014-10-03 14:27:31: [446661] -- 220 mailman.prima.net.id ESMTP 
Postfix (PrimaSMTP)

Fri 2014-10-03 14:27:31: [446661] -- EHLO mx.saranainstrument.com
Fri 2014-10-03 14:27:31: [446661] -- 250-mailman.prima.net.id
Fri 2014-10-03 14:27:31: [446661] -- 250-PIPELINING
Fri 2014-10-03 14:27:31: [446661] -- 250-SIZE 1024
Fri 2014-10-03 14:27:31: [446661] -- 250-VRFY
Fri 

[MDaemon-L] Analisa Log SMTP Out

[Syafril Hermansyah]

On 2014-10-03 14:42, Yudis wrote:
 Mohon bantuannya menganalisa log dibawah ini :

 Fri 2014-10-03 14:27:30: [446661] -- 550-Callback setup failed while 
 verifying prvs=1353ed5061=fi...@saranainstrument.com
 Fri 2014-10-03 14:27:30: [446661] -- 550-Called:   113.11.130.172
 Fri 2014-10-03 14:27:30: [446661] -- 550-Sent: MAIL FROM:
 Fri 2014-10-03 14:27:30: [446661] -- 550-Response: 501 Domain must resolve
 Fri 2014-10-03 14:27:30: [446661] -- 550-The initial connection, or a HELO 
 or MAIL FROM: command was
 Fri 2014-10-03 14:27:30: [446661] -- 550-rejected. Refusing MAIL FROM: 
 does not help fight spam, disregards
 Fri 2014-10-03 14:27:30: [446661] -- 550-RFC requirements, and stops you 
 from receiving standard bounce
 Fri 2014-10-03 14:27:30: [446661] -- 550-messages. This host does not accept 
 mail from domains whose servers
 Fri 2014-10-03 14:27:30: [446661] -- 550-refuse bounces.
 Fri 2014-10-03 14:27:30: [446661] -- 550 Sender verify failed

Receiver menerapkan antispam kuno (populer di tahun 2007 yl) yang
namanya Sender Address Verification.
Protocol itu jarang dipakai orang saat ini karena menghabiskan bandwidth
dengan melakukan koneksi backscatter ke MX sender domain dan sebenarnya
gampang di spoof (dibohongin).

SAV itu salah satu musuhnya adalah anti backscatter.
Jadi kalau Anda mengktifkan anti backscatter (BATV) maka masukkan IP
receiver tersebut (203.123.240.43) kedalam backscatter whitelist.

http://mdaemon.dutaint.co.id/14.0.1/security--backscatter_protection_dialog.htm

-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, running MDaemon 14.5.0 Beta RC4 SP 4.5.0 Beta B
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.

Experience is a hard teacher because she gives the test first, the
lesson afterwards.
--- Vernon Saunders Law









-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 14.0.3, SP 4.1.5, BES 2.0.2, OC 2.3.3, SG 3.0.1

[MDaemon-L] Analisa Log SMTP Out

[Yudis]

On 10/3/2014 2:57 PM, Syafril Hermansyah wrote:

On 2014-10-03 14:42, Yudis wrote:

Mohon bantuannya menganalisa log dibawah ini :
Fri 2014-10-03 14:27:30: [446661] -- 550-Callback setup failed while verifying 
prvs=1353ed5061=fi...@saranainstrument.com
Fri 2014-10-03 14:27:30: [446661] -- 550-Called:   113.11.130.172
Fri 2014-10-03 14:27:30: [446661] -- 550-Sent: MAIL FROM:
Fri 2014-10-03 14:27:30: [446661] -- 550-Response: 501 Domain must resolve
Fri 2014-10-03 14:27:30: [446661] -- 550-The initial connection, or a HELO or MAIL 
FROM: command was
Fri 2014-10-03 14:27:30: [446661] -- 550-rejected. Refusing MAIL FROM: does 
not help fight spam, disregards
Fri 2014-10-03 14:27:30: [446661] -- 550-RFC requirements, and stops you from 
receiving standard bounce
Fri 2014-10-03 14:27:30: [446661] -- 550-messages. This host does not accept 
mail from domains whose servers
Fri 2014-10-03 14:27:30: [446661] -- 550-refuse bounces.
Fri 2014-10-03 14:27:30: [446661] -- 550 Sender verify failed

Receiver menerapkan antispam kuno (populer di tahun 2007 yl) yang
namanya Sender Address Verification.
Protocol itu jarang dipakai orang saat ini karena menghabiskan bandwidth
dengan melakukan koneksi backscatter ke MX sender domain dan sebenarnya
gampang di spoof (dibohongin).


Klo begitu, bagaimana email kami bisa masuk ke mereka Pak ?
Apakah saya harus minta ke mereka untuk daftarkan IP kami di server mereka ?

Mohon petunjuk jika saya salah menyimpulkan.



SAV itu salah satu musuhnya adalah anti backscatter.
Jadi kalau Anda mengktifkan anti backscatter (BATV) maka masukkan IP
receiver tersebut (203.123.240.43) kedalam backscatter whitelist.

http://mdaemon.dutaint.co.id/14.0.1/security--backscatter_protection_dialog.htm



Benar Pak, settingan MD kami mengaktifkan anti backscatter. Saya sudah 
masukkan IP mereka kedalam backscatter whitelist.
Apakah harus restart service MD Pak setelah memasukkan IP ke dalam 
whitelist backscatter ?


Regards,
*Yudis*
*IT Officer*
+62-21-5347855
Ext.321

--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 14.0.3, SP 4.1.5, BES 2.0.2, OC 2.3.3, SG 3.0.1

[MDaemon-L] Analisa Log SMTP Out

[Syafril Hermansyah]

On 2014-10-03 15:15, Yudis wrote:
 Klo begitu, bagaimana email kami bisa masuk ke mereka Pak ?

SAV itu terkadang disebut juga dengan nama SMTP Callback.
Jika ada mail yang masuk ke server dia, maka server itu akan melakukan
callback ke sender domain.
Karena sendernya adalah domain Anda (saranainstrument.com) maka dia
check balik ke server mx.saranainstrument.com.

Bayangkan kalau yang kirim mail ke server dia adalah PC yang terkena
worm virus yang broadcast terus-2x an :-)
Ini alasan lengkapnya kenapa tidak ada lagi orang yang mengerti internet
mail tidak lagi memakainya

http://www.circleid.com/posts/sender_address_verification/

http://taint.org/2007/03/16/134743a.html

 Apakah harus restart service MD Pak setelah memasukkan IP ke dalam
 whitelist backscatter ?

Tidak usah, langsung effektif kok.
Di test saja kirim mail ke recipient itu.

-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, running MDaemon 14.5.0 Beta RC4 SP 4.5.0 Beta B
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.

Learn from yesterday, live for today, hope for tomorrow. The important
thing is not to stop questioning.
--- Albert Einstein


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 14.0.3, SP 4.1.5, BES 2.0.2, OC 2.3.3, SG 3.0.1

[MDaemon-L] Analisa Log SMTP Out

[Yudis]

On 10/3/2014 3:27 PM, Syafril Hermansyah wrote:

SAV itu terkadang disebut juga dengan nama SMTP Callback.
Jika ada mail yang masuk ke server dia, maka server itu akan melakukan
callback ke sender domain.
Karena sendernya adalah domain Anda (saranainstrument.com) maka dia
check balik ke server mx.saranainstrument.com.

Bayangkan kalau yang kirim mail ke server dia adalah PC yang terkena
worm virus yang broadcast terus-2x an :-)
Ini alasan lengkapnya kenapa tidak ada lagi orang yang mengerti internet
mail tidak lagi memakainya

http://www.circleid.com/posts/sender_address_verification/

http://taint.org/2007/03/16/134743a.html


Jelas sekali Pak.
Terima kasih atas penjelasannya Pak.


Tidak usah, langsung effektif kok.
Di test saja kirim mail ke recipient itu.



Saya sdh test email ke mereka dan saya cek sdh tidak muncul error lagi.

Regards,
*Yudis*
*IT Officer*
+62-21-5347855
Ext.321


--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 14.0.3, SP 4.1.5, BES 2.0.2, OC 2.3.3, SG 3.0.1

[MDaemon-L] Analisa Log SMTP-Out

[Yudis]

On 7/22/2014 9:33 AM, Syafril Hermansyah wrote:


Sudah sesuai dengan log awal dari MDaemon saat direct delivery.

Sebaiknya di bagian delivery di aktifkan menu

http://mdaemon.dutaint.co.id/14.0.1/default-domain-and-servers_delivery.htm

[x] Bounce message on first 5XX error from any of receiving domain's MX
hosts

agar mail tidak perlu dikirim ke smarthost kalau memang sudah di reject
oleh salah satu MX host.
Tetapi mungkin ada bug di versi MDaemon dibawah 14.0.3 sehingga perlu
upgrade ke MD 14.0.3



Pak Syafril,
Terima kasih atas penjelasannya.
Nanti saya akan upgrade dan tambah settingannya.

Regards,
Yudis


--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 14.0.3, SP 4.1.5, BES 2.0.2, OC 2.3.3, SG 3.0.1

[MDaemon-L] Analisa Log SMTP-Out

[Yudis]

Pagi Pak Syafril,
Mohon bantuan analisa log dibawah ini :

Mon 2014-07-21 15:32:48: [528299] Session 528299; child 0001
Mon 2014-07-21 15:32:48: [528299] Parsing message 
d:\mdaemon\queues\remote\pd3592501.msg

Mon 2014-07-21 15:32:48: [528299] *  From: grac...@sasinternasional.com
Mon 2014-07-21 15:32:48: [528299] *  To: klar...@marsol.biz
Mon 2014-07-21 15:32:48: [528299] *  Subject: Re: Chevron  Marsol Support
Mon 2014-07-21 15:32:48: [528299] *  Size (bytes): 21527
Mon 2014-07-21 15:32:48: [528299] *  Message-ID: 
53ccd039.5030...@sasinternasional.com

Mon 2014-07-21 15:32:48: [528299] Attempting SMTP connection to [marsol.biz]
Mon 2014-07-21 15:32:48: [528299] Resolving MX records for [marsol.biz] 
(DNS Server: 202.57.0.8)...
Mon 2014-07-21 15:32:48: [528299] *  P=000 S=002 D=marsol.biz TTL=(16) 
MX=[mx0.ik2.com]
Mon 2014-07-21 15:32:48: [528299] *  P=010 S=003 D=marsol.biz TTL=(16) 
MX=[mx1.ik2.com]
Mon 2014-07-21 15:32:48: [528299] *  P=020 S=004 D=marsol.biz TTL=(16) 
MX=[mx2.ik2.com]
Mon 2014-07-21 15:32:48: [528299] *  P=030 S=001 D=marsol.biz TTL=(16) 
MX=[mx2.mailhop.org]
Mon 2014-07-21 15:32:48: [528299] *  P=040 S=000 D=marsol.biz TTL=(16) 
MX=[mx3.ik2.com]
Mon 2014-07-21 15:32:48: [528299] Attempting SMTP connection to 
[mx0.ik2.com:25]
Mon 2014-07-21 15:32:48: [528299] Resolving A record for [mx0.ik2.com] 
(DNS Server: 202.57.0.8)...
Mon 2014-07-21 15:32:58: [528299] *  The name server reports that it is 
having technical problems
Mon 2014-07-21 15:32:58: [528299] Attempting SMTP connection to 
[mx0.ik2.com:25]
Mon 2014-07-21 15:32:58: [528299] Resolving A record for [mx0.ik2.com] 
(DNS Server: 202.57.0.5)...
Mon 2014-07-21 15:32:58: [528299] *  D=mx0.ik2.com TTL=(119) 
A=[198.15.91.28]
Mon 2014-07-21 15:32:58: [528299] Attempting SMTP connection to 
[198.15.91.28:25]

Mon 2014-07-21 15:32:58: [528299] Waiting for socket connection...
Mon 2014-07-21 15:33:19: [528299] *  Winsock Error 10060
Mon 2014-07-21 15:33:19: [528299] *  198.15.91.28 added to connection 
failure cache for 5 minutes
Mon 2014-07-21 15:33:19: [528299] Attempting SMTP connection to 
[mx1.ik2.com:25]
Mon 2014-07-21 15:33:19: [528299] Resolving A record for [mx1.ik2.com] 
(DNS Server: 202.57.0.5)...
Mon 2014-07-21 15:33:19: [528299] *  D=mx1.ik2.com TTL=(17) 
A=[122.103.250.12]
Mon 2014-07-21 15:33:19: [528299] Attempting SMTP connection to 
[122.103.250.12:25]

Mon 2014-07-21 15:33:19: [528299] Waiting for socket connection...
Mon 2014-07-21 15:33:19: [528299] *  Connection established 
(113.11.130.173:57324 - 122.103.250.12:25)

Mon 2014-07-21 15:33:19: [528299] Waiting for protocol to start...
Mon 2014-07-21 15:33:19: [528299] -- 220 s81a.ik2.com --- IK2 SMTP Server
Mon 2014-07-21 15:33:19: [528299] -- EHLO mx.sasinternasional.com
Mon 2014-07-21 15:33:19: [528299] -- 250-Hello mx.sasinternasional.com
Mon 2014-07-21 15:33:19: [528299] -- 250-AUTH LOGIN
Mon 2014-07-21 15:33:19: [528299] -- 250-ENHANCEDSTATUSCODES
Mon 2014-07-21 15:33:19: [528299] -- 250-SIZE 35883008
Mon 2014-07-21 15:33:19: [528299] -- 250-STARTTLS
Mon 2014-07-21 15:33:19: [528299] -- 250-8BITMIME
Mon 2014-07-21 15:33:19: [528299] -- 250 BINARYMIME
Mon 2014-07-21 15:33:19: [528299] -- STARTTLS
Mon 2014-07-21 15:33:19: [528299] -- 220 2.0.0 Ready to start TLS
Mon 2014-07-21 15:33:19: [528299] SSL negotiation failed, error code 
0x80090331
Mon 2014-07-21 15:33:19: [528299] Attempting SMTP connection to 
[mx2.ik2.com:25]
Mon 2014-07-21 15:33:19: [528299] Resolving A record for [mx2.ik2.com] 
(DNS Server: 202.57.0.5)...
Mon 2014-07-21 15:33:29: [528299] *  D=mx2.ik2.com TTL=(60) 
A=[198.143.169.250]
Mon 2014-07-21 15:33:29: [528299] Attempting SMTP connection to 
[198.143.169.250:25]

Mon 2014-07-21 15:33:29: [528299] Waiting for socket connection...
Mon 2014-07-21 15:33:30: [528299] *  Connection established 
(113.11.130.173:57326 - 198.143.169.250:25)

Mon 2014-07-21 15:33:30: [528299] Waiting for protocol to start...
Mon 2014-07-21 15:33:30: [528299] -- 220 s707a.ik2.com --- IK2 SMTP Server
Mon 2014-07-21 15:33:30: [528299] -- EHLO mx.sasinternasional.com
Mon 2014-07-21 15:33:30: [528299] -- 250-Hello mx.sasinternasional.com
Mon 2014-07-21 15:33:30: [528299] -- 250-AUTH LOGIN
Mon 2014-07-21 15:33:30: [528299] -- 250-ENHANCEDSTATUSCODES
Mon 2014-07-21 15:33:30: [528299] -- 250-SIZE 35883008
Mon 2014-07-21 15:33:30: [528299] -- 250-STARTTLS
Mon 2014-07-21 15:33:30: [528299] -- 250-8BITMIME
Mon 2014-07-21 15:33:30: [528299] -- 250 BINARYMIME
Mon 2014-07-21 15:33:30: [528299] -- STARTTLS
Mon 2014-07-21 15:33:30: [528299] -- 220 2.0.0 Ready to start TLS
Mon 2014-07-21 15:33:31: [528299] SSL negotiation successful (TLS 1.0, 
1024 bit key exchange, 128 bit AES encryption)

Mon 2014-07-21 15:33:31: [528299] -- EHLO mx.sasinternasional.com
Mon 2014-07-21 15:33:31: [528299] -- 250-Hello mx.sasinternasional.com
Mon 2014-07-21 15:33:31: [528299] -- 250-AUTH LOGIN
Mon 2014-07-21 15:33:31: [528299] -- 250-ENHANCEDSTATUSCODES
Mon 2014-07-21 15:33:31: [528299] -- 

[MDaemon-L] Analisa Log SMTP-Out

[Syafril Hermansyah]

On 2014-07-22 09:01, Yudis wrote:
 Mon 2014-07-21 15:33:31: [528299] -- 250 2.1.0
 grac...@sasinternasional.com Address Okay
 Mon 2014-07-21 15:33:31: [528299] -- RCPT To:klar...@marsol.biz
 Mon 2014-07-21 15:33:32: [528299] -- 557 Email address is not available
 here.  Disconnecting...

 Mon 2014-07-21 15:34:32: [528299] Attempting to send message to smart host
 Mon 2014-07-21 15:34:32: [528299] Attempting SMTP connection to 
 [mailman.prima.net.id:25]

 Mon 2014-07-21 15:34:32: [528299] Transfer Complete
 Mon 2014-07-21 15:34:32: [528299] -- 250 2.0.0 Ok: queued as 1B93C81147

 Apakah email terkirim ke klar...@marsol.biz ?

Belum tentu, dari log diatas terlihat hanya sukses terkirim ke smarthost.

 Karena si pengirim menerima email pentalan sbb :

 
 klar...@marsol.biz: host mx1.ik2.com[122.103.250.12] said: 557 Email address
 - klar...@marsol.biz - is not available here.  Disconnecting... (in reply
 to RCPT TO command)

Sudah sesuai dengan log awal dari MDaemon saat direct delivery.

Sebaiknya di bagian delivery di aktifkan menu

http://mdaemon.dutaint.co.id/14.0.1/default-domain-and-servers_delivery.htm

[x] Bounce message on first 5XX error from any of receiving domain's MX
hosts

agar mail tidak perlu dikirim ke smarthost kalau memang sudah di reject
oleh salah satu MX host.
Tetapi mungkin ada bug di versi MDaemon dibawah 14.0.3 sehingga perlu
upgrade ke MD 14.0.3

-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, running MDaemon 14.0.3 SP 4.5.0 Beta B
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.

-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 14.0.3, SP 4.1.5, BES 2.0.2, OC 2.3.3, SG 3.0.1

[MDaemon-L] Analisa log SMTP Out

[Yudis]

Pagi Pak Syafril,
Mohon bantuan analisa dari log dibawah ini.

Wed 2014-06-11 17:20:03: [608242] Session 608242; child 0001
Wed 2014-06-11 17:20:03: [608242] Parsing message 
d:\mdaemon\queues\remote\pd35000177516.msg

Wed 2014-06-11 17:20:03: [608242] *  From: an...@saranainstrument.com
Wed 2014-06-11 17:20:03: [608242] *  To: chris.ant...@ksb.co.id
Wed 2014-06-11 17:20:03: [608242] *  Subject: RE: Centrifugal Pump for 
Halliburton

Wed 2014-06-11 17:20:03: [608242] *  Size (bytes): 22907
Wed 2014-06-11 17:20:03: [608242] *  Message-ID: 
001701cf855e$a4dab390$ee901ab0$@saranainstrument.com

Wed 2014-06-11 17:20:03: [608242] *  Route slip host: ksb.co.id
Wed 2014-06-11 17:20:03: [608242] *  Route slip port: 25
Wed 2014-06-11 17:20:03: [608242] Attempting SMTP connection to [ksb.co.id]
Wed 2014-06-11 17:20:03: [608242] Resolving MX records for [ksb.co.id] 
(DNS Server: 202.57.0.8)...
Wed 2014-06-11 17:20:03: [608242] *  P=010 S=001 D=ksb.co.id TTL=(109) 
MX=[mail1.ksb.co.id]
Wed 2014-06-11 17:20:03: [608242] *  P=020 S=000 D=ksb.co.id TTL=(109) 
MX=[mail2.ksb.co.id]
Wed 2014-06-11 17:20:03: [608242] Attempting SMTP connection to 
[mail1.ksb.co.id:25]
Wed 2014-06-11 17:20:03: [608242] Resolving A record for 
[mail1.ksb.co.id] (DNS Server: 202.57.0.8)...
Wed 2014-06-11 17:20:03: [608242] *  D=mail1.ksb.co.id TTL=(239) 
A=[114.4.110.227]
Wed 2014-06-11 17:20:03: [608242] Attempting SMTP connection to 
[114.4.110.227:25]

Wed 2014-06-11 17:20:03: [608242] Waiting for socket connection...
Wed 2014-06-11 17:20:03: [608242] *  Connection established 
(113.11.130.172:49583 - 114.4.110.227:25)

Wed 2014-06-11 17:20:03: [608242] Waiting for protocol to start...
Wed 2014-06-11 17:20:44: [608242] -- 220 XEON.KSB.CO.ID ESMTP Service 
(Lotus Domino Release 8.5.2FP4 HF60) ready at Wed, 11 Jun 2014 17:20:49 
+0700

Wed 2014-06-11 17:20:44: [608242] -- EHLO mx.saranainstrument.com
Wed 2014-06-11 17:20:44: [608242] -- 250-XEON.KSB.CO.ID Hello 
mx.saranainstrument.com ([113.11.130.172]), pleased to meet you

Wed 2014-06-11 17:20:44: [608242] -- 250-HELP
Wed 2014-06-11 17:20:44: [608242] -- 250-AUTH LOGIN
Wed 2014-06-11 17:20:44: [608242] -- 250-SIZE 2048
Wed 2014-06-11 17:20:44: [608242] -- 250 PIPELINING
Wed 2014-06-11 17:20:44: [608242] -- MAIL 
From:an...@saranainstrument.com SIZE=22907
Wed 2014-06-11 17:21:05: [608242] -- 451 Unable to complete command, 
DNS not available or timed out

Wed 2014-06-11 17:21:05: [608242] -- QUIT
Wed 2014-06-11 17:21:05: [608242] Attempting SMTP connection to 
[mail2.ksb.co.id:25]
Wed 2014-06-11 17:21:05: [608242] Resolving A record for 
[mail2.ksb.co.id] (DNS Server: 202.57.0.8)...
Wed 2014-06-11 17:21:05: [608242] *  D=mail2.ksb.co.id TTL=(239) 
A=[114.30.80.100]
Wed 2014-06-11 17:21:05: [608242] Attempting SMTP connection to 
[114.30.80.100:25]

Wed 2014-06-11 17:21:05: [608242] Waiting for socket connection...
Wed 2014-06-11 17:21:05: [608242] *  Connection established 
(113.11.130.172:49584 - 114.30.80.100:25)

Wed 2014-06-11 17:21:05: [608242] Waiting for protocol to start...
Wed 2014-06-11 17:21:08: [608242] -- 220 deva.ksb.co.id ESMTP Service 
(IBM Domino Release 9.0.1 HF28) ready at Wed, 11 Jun 2014 17:21:18 +0700

Wed 2014-06-11 17:21:08: [608242] -- EHLO mx.saranainstrument.com
Wed 2014-06-11 17:21:08: [608242] -- 250-deva.ksb.co.id Hello 
mx.saranainstrument.com ([113.11.130.172]), pleased to meet you

Wed 2014-06-11 17:21:08: [608242] -- 250-HELP
Wed 2014-06-11 17:21:08: [608242] -- 250-AUTH LOGIN
Wed 2014-06-11 17:21:08: [608242] -- 250-SIZE 5120
Wed 2014-06-11 17:21:08: [608242] -- 250 PIPELINING
Wed 2014-06-11 17:21:08: [608242] -- MAIL 
From:an...@saranainstrument.com SIZE=22907
Wed 2014-06-11 17:21:09: [608242] -- 250 an...@saranainstrument.com... 
Sender OK

Wed 2014-06-11 17:21:09: [608242] -- RCPT To:chris.ant...@ksb.co.id
Wed 2014-06-11 17:21:09: [608242] -- 554 Mail for 
chris.ant...@ksb.co.id rejected for policy reasons.

Wed 2014-06-11 17:21:09: [608242] -- RCPT To:melia.katre...@ksb.co.id
Wed 2014-06-11 17:21:09: [608242] -- 554 Mail for 
melia.katre...@ksb.co.id rejected for policy reasons.

Wed 2014-06-11 17:21:09: [608242] -- QUIT
Wed 2014-06-11 17:21:09: [608242] Attempting to send message to smart host
Wed 2014-06-11 17:21:09: [608242] Attempting SMTP connection to 
[mailman.prima.net.id:25]
Wed 2014-06-11 17:21:09: [608242] Resolving A record for 
[mailman.prima.net.id] (DNS Server: 202.57.0.8)...
Wed 2014-06-11 17:21:09: [608242] *  D=mailman.prima.net.id TTL=(1440) 
A=[113.11.128.2]
Wed 2014-06-11 17:21:09: [608242] Attempting SMTP connection to 
[113.11.128.2:25]

Wed 2014-06-11 17:21:09: [608242] Waiting for socket connection...
Wed 2014-06-11 17:21:09: [608242] *  Connection established 
(113.11.130.172:49585 - 113.11.128.2:25)

Wed 2014-06-11 17:21:09: [608242] Waiting for protocol to start...
Wed 2014-06-11 17:21:09: [608242] -- 220 mailman.prima.net.id ESMTP 
Postfix (PrimaSMTP)

Wed 2014-06-11 17:21:09: [608242] -- EHLO 

[MDaemon-L] Analisa log SMTP Out

[Syafril Hermansyah]

On 2014-06-12 08:44, Yudis wrote:

 User kami mendapatkan email pentalan sbb :
 
 -Original Message-
 From: Mail Delivery System [mailto:mailer-dae...@smtp2.prima.net.id] 
 Sent: Wednesday, June 11, 2014 5:22 PM
 To: an...@saranainstrument.com
 Subject: Undelivered Mail Returned to Sender
 
 This is the mail system at host smtp2.prima.net.id.
 
 chris.ant...@ksb.co.id: host mail2.ksb.co.id[114.30.80.100] said: 554 Mail
 for chris.ant...@ksb.co.id rejected for policy reasons. (in reply to
 RCPT
 TO command)
 
 melia.katre...@ksb.co.id: host mail2.ksb.co.id[114.30.80.100] said: 554
 Mail
 for melia.katre...@ksb.co.id rejected for policy reasons. (in reply to
 RCPT
 TO command)

 Apakah email tsb terkirim ke tujuan ?

Tidak.
Mail yang diteruskan smarhost ditolak oleh MX backup domain penerima.
Lihat dibawah ini alasan lebih rincinya.

 Wed 2014-06-11 17:20:03: [608242] *  P=010 S=001 D=ksb.co.id 
 TTL=(109) MX=[mail1.ksb.co.id] Wed 2014-06-11 17:20:03: [608242] * 
 P=020 S=000 D=ksb.co.id TTL=(109) MX=[mail2.ksb.co.id]
...

 Wed 2014-06-11 17:20:44: [608242] -- 220 XEON.KSB.CO.ID ESMTP 
 Service (Lotus Domino Release 8.5.2FP4 HF60) ready at Wed, 11 Jun 
 2014 17:20:49 +0700
...
 Wed 2014-06-11 17:21:05: [608242] -- 451 Unable to complete command,
 DNS not available or timed out

Server ini adalah masalah DNS resolver sehingga menolak terima mail.

 Wed 2014-06-11 17:21:08: [608242] -- 220 deva.ksb.co.id ESMTP 
 Service (IBM Domino Release 9.0.1 HF28) ready at Wed, 11 Jun 2014 
 17:21:18 +0700
...
 Wed 2014-06-11 17:21:09: [608242] -- 554 Mail for 
 chris.ant...@ksb.co.id rejected for policy reasons. Wed 2014-06-11 
 17:21:09: [608242] -- RCPT To:melia.katre...@ksb.co.id Wed 
 2014-06-11 17:21:09: [608242] -- 554 Mail for 
 melia.katre...@ksb.co.id rejected for policy reasons.

Mail ditolak karena alasan internal di server itu, tidak dijelaskan
persisnya tetapi mungkin masalah tidak bisa mengkonfirmasi bahwa
recipient itu terdaftar sebagai valid user karena primary MX tidak
meresponse.

 Wed 2014-06-11 17:21:09: [608242] Attempting to send message to
 smart host Wed 2014-06-11 17:21:09: [608242] Attempting SMTP
 connection to [mailman.prima.net.id:25]
...
 Wed 2014-06-11 17:21:09: [608242] -- MAIL
 From:an...@saranainstrument.com SIZE=22907
 Wed 2014-06-11 17:21:09: [608242] -- RCPT
 To:chris.ant...@ksb.co.id
 Wed 2014-06-11 17:21:09: [608242] -- RCPT
 To:melia.katre...@ksb.co.id
 Wed 2014-06-11 17:21:09: [608242] Transfer Complete
 Wed 2014-06-11 17:21:09: [608242] -- 250 2.0.0 Ok: queued as
 0635C81092

Mail terkirim ke smarthost dengan sukses.


-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, running MDaemon 14.0.2 SecurityPlus 4.5.0 Beta A
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 14.0.2, SP 4.1.5, BES 2.0.2, OC 2.3.3, SG 3.0

[MDaemon-L] Analisa log SMTP Out

[Yudis]

On 6/12/2014 9:23 AM, Syafril Hermansyah wrote:


Server ini adalah masalah DNS resolver sehingga menolak terima mail.



Mail ditolak karena alasan internal di server itu, tidak dijelaskan
persisnya tetapi mungkin masalah tidak bisa mengkonfirmasi bahwa
recipient itu terdaftar sebagai valid user karena primary MX tidak
meresponse.


Pak Syafril,
Saya sdh email ke postmas...@ksb.co.id dan mereka sdh mereply email saya.
Memang benar ada masalah dimereka. Dan sekarang sdh normal kembali.

Terima kasih atas penjelasannya.

BR,
Yudis

--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 14.0.2, SP 4.1.5, BES 2.0.2, OC 2.3.3, SG 3.0

[MDaemon-L] Analisa log SMTP-Out

[Yudis]

Pak Syafril,
Mohon analisa untuk log dibawah ini :

Wed 2014-01-08 15:21:16: --
Wed 2014-01-08 15:26:19: [157214:1] Session 157214; child 1
Wed 2014-01-08 15:26:19: [157214:1] Parsing message 
d:\mdaemon\queues\remote\pd35000152812.msg

Wed 2014-01-08 15:26:19: [157214:1] *  From: rasi...@promecprima.com
Wed 2014-01-08 15:26:19: [157214:1] *  To: 
lahcene.belkho...@acieries-bonpertuis.fr
Wed 2014-01-08 15:26:19: [157214:1] *  Subject: Cooperation for 
Indonesia Market

Wed 2014-01-08 15:26:19: [157214:1] *  Size (bytes): 2208980
Wed 2014-01-08 15:26:19: [157214:1] *  Message-ID: 
52cd0ba3.5090...@promecprima.com
Wed 2014-01-08 15:26:19: [157214:1] Attempting SMTP connection to 
[acieries-bonpertuis.fr]
Wed 2014-01-08 15:26:19: [157214:1] Resolving MX records for 
[acieries-bonpertuis.fr] (DNS Server: 202.57.0.8)...
Wed 2014-01-08 15:26:19: [157214:1] *  P=005 S=000 
D=acieries-bonpertuis.fr TTL=(60) MX=[srvproxy.experton-revollier.fr]
Wed 2014-01-08 15:26:19: [157214:1] Attempting SMTP connection to 
[srvproxy.experton-revollier.fr:25]
Wed 2014-01-08 15:26:19: [157214:1] Resolving A record for 
[srvproxy.experton-revollier.fr] (DNS Server: 202.57.0.8)...
Wed 2014-01-08 15:26:20: [157214:1] * D=srvproxy.experton-revollier.fr 
TTL=(360) A=[213.30.140.251]
Wed 2014-01-08 15:26:20: [157214:1] Attempting SMTP connection to 
[213.30.140.251:25]

Wed 2014-01-08 15:26:20: [157214:1] Waiting for socket connection...
Wed 2014-01-08 15:26:20: [157214:1] *  Connection established 
(113.11.130.172:65117 - 213.30.140.251:25)

Wed 2014-01-08 15:26:20: [157214:1] Waiting for protocol to start...
Wed 2014-01-08 15:26:21: [157214:1] -- 220 
srvproxy.experton-revollier.fr ESMTP ready.

Wed 2014-01-08 15:26:21: [157214:1] -- EHLO mail.promecprima.com
Wed 2014-01-08 15:26:21: [157214:1] -- 
250-srvproxy.experton-revollier.fr Hello mx.saranainstrument.com 
[113.11.130.172]

Wed 2014-01-08 15:26:21: [157214:1] -- 250-SIZE 20971520
Wed 2014-01-08 15:26:21: [157214:1] -- 250-PIPELINING
Wed 2014-01-08 15:26:21: [157214:1] -- 250-STARTTLS
Wed 2014-01-08 15:26:21: [157214:1] -- 250 HELP
Wed 2014-01-08 15:26:21: [157214:1] -- STARTTLS
Wed 2014-01-08 15:26:22: [157214:1] -- 220 TLS go ahead
Wed 2014-01-08 15:26:22: [157214:1] SSL negotiation successful (TLS 1.0, 
1024 bit key exchange, 128 bit  encryption)

Wed 2014-01-08 15:26:22: [157214:1] -- EHLO mail.promecprima.com
Wed 2014-01-08 15:26:23: [157214:1] -- 
250-srvproxy.experton-revollier.fr Hello mx.saranainstrument.com 
[113.11.130.172]

Wed 2014-01-08 15:26:23: [157214:1] -- 250-SIZE 20971520
Wed 2014-01-08 15:26:23: [157214:1] -- 250-PIPELINING
Wed 2014-01-08 15:26:23: [157214:1] -- 250 HELP
Wed 2014-01-08 15:26:23: [157214:1] -- MAIL 
From:rasi...@promecprima.com SIZE=2208980

Wed 2014-01-08 15:26:23: [157214:1] -- 250 OK
Wed 2014-01-08 15:26:23: [157214:1] -- RCPT 
To:lahcene.belkho...@acieries-bonpertuis.fr

Wed 2014-01-08 15:26:23: [157214:1] -- 250 Accepted
Wed 2014-01-08 15:26:23: [157214:1] -- DATA
Wed 2014-01-08 15:26:24: [157214:1] -- 354 Enter message, ending with 
. on a line by itself
Wed 2014-01-08 15:26:24: [157214:1] Sending 
d:\mdaemon\queues\remote\pd35000152812.msg to [213.30.140.251]

Wed 2014-01-08 15:28:49: [157214:1] *  Winsock Error 10054
Wed 2014-01-08 15:28:49: [157214:1] Error writing to socket
Wed 2014-01-08 15:28:49: [157214:1] Socket connection closed by the 
other side (how rude!)

Wed 2014-01-08 15:28:49: [157214:1] *  Winsock Error 10053
Wed 2014-01-08 15:28:49: [157214:1] Connection closed
Wed 2014-01-08 15:29:52: --
Wed 2014-01-08 15:29:05: [157371:1] Session 157371; child 1
Wed 2014-01-08 15:29:05: [157371:1] Parsing message 
d:\mdaemon\queues\remote\pd35000152812.msg

Wed 2014-01-08 15:29:05: [157371:1] *  From: rasi...@promecprima.com
Wed 2014-01-08 15:29:05: [157371:1] *  To: 
lahcene.belkho...@acieries-bonpertuis.fr
Wed 2014-01-08 15:29:05: [157371:1] *  Subject: Cooperation for 
Indonesia Market

Wed 2014-01-08 15:29:05: [157371:1] *  Size (bytes): 2208980
Wed 2014-01-08 15:29:05: [157371:1] *  Message-ID: 
52cd0ba3.5090...@promecprima.com
Wed 2014-01-08 15:29:05: [157371:1] Attempting SMTP connection to 
[acieries-bonpertuis.fr]
Wed 2014-01-08 15:29:05: [157371:1] Resolving MX records for 
[acieries-bonpertuis.fr] (DNS Server: 202.57.0.8)...
Wed 2014-01-08 15:29:05: [157371:1] *  P=005 S=000 
D=acieries-bonpertuis.fr TTL=(57) MX=[srvproxy.experton-revollier.fr]
Wed 2014-01-08 15:29:05: [157371:1] Attempting SMTP connection to 
[srvproxy.experton-revollier.fr:25]
Wed 2014-01-08 15:29:05: [157371:1] Resolving A record for 
[srvproxy.experton-revollier.fr] (DNS Server: 202.57.0.8)...
Wed 2014-01-08 15:29:05: [157371:1] * D=srvproxy.experton-revollier.fr 
TTL=(357) A=[213.30.140.251]
Wed 2014-01-08 15:29:05: [157371:1] Attempting SMTP connection to 
[213.30.140.251:25]

Wed 2014-01-08 15:29:05: [157371:1] Waiting for socket connection...
Wed 2014-01-08 15:29:06: [157371:1] *  Connection established 
(113.11.130.172:65123 - 

[MDaemon-L] Analisa log SMTP-Out

[Syafril Hermansyah]

On 2014-01-08 17:42, Yudis wrote:
 Jika saya lihat untuk log yg pertama sepertinya gagal dan yang ke dua
 berhasil terkirim.

Ya benar begitu.

 Untuk yang log pertama gagal itu masalah dimana ya Pak ?

 Wed 2014-01-08 15:26:24: [157214:1] Sending 
 d:\mdaemon\queues\remote\pd35000152812.msg to [213.30.140.251]
 Wed 2014-01-08 15:28:49: [157214:1] *  Winsock Error 10054
 Wed 2014-01-08 15:28:49: [157214:1] Error writing to socket   
 Wed 2014-01-08 15:28:49: [157214:1] Socket connection closed by the other 
 side (how rude!)
 Wed 2014-01-08 15:28:49: [157214:1] *  Winsock Error 10053 

Saat kirim DATA koneksinya lambat sehingga terjadi time out dan receiver
memutuskan koneksi.

http://www.altn.com/Support/KnowledgeBase/KnowledgeBaseResults/?Number=KBA-01196

---
WSAECONNRESET (10054) Connection reset by peer

A connection was forcibly closed by a peer. This normally results from a
loss of the connection on the remote socket due to a timeout or a reboot.

User suggestions: Some network systems have commands to report
statistics. In this case, it might be possible to check the count of TCP
RST packets received, or ICMP Port Unreachable packets. See other
suggestions under WSAECONNABORTED.
---


WSAECONNABORTED (10053) Software caused connection abort

A connection abort was caused internal to your host machine. The
software caused a connection abort because there is no space on the
socket's queue and the socket cannot receive further connections.

WinSock description: The error can occur when the local network system
aborts a connection. This would occur if WinSock aborts an established
connection after data retransmission fails (receiver never acknowledges
data sent on a datastream socket).

TCP/IP scenario: A connection will timeout if the local system doesn't
receive an (ACK)nowledgement for data sent. It would also timeout if a
(FIN)ish TCP packet is not ACK'd (and even if the FIN is ACK'd, it will
eventually timeout if a FIN is not returned).
---

-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, running MDaemon 13.6.1 SecurityPlus 4.1.5
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 13.6.1, SP 4.1.5, BES 2.0.2, OC 2.3.3, SG 2.1.2, PP 2.0.1

[MDaemon-L] Analisa log SMTP-Out

[Yudis]

On 1/8/2014 6:01 PM, Syafril Hermansyah wrote:

Wed 2014-01-08 15:26:24: [157214:1] Sending 
d:\mdaemon\queues\remote\pd35000152812.msg to [213.30.140.251]
Wed 2014-01-08 15:28:49: [157214:1] *  Winsock Error 10054
Wed 2014-01-08 15:28:49: [157214:1] Error writing to socket
Wed 2014-01-08 15:28:49: [157214:1] Socket connection closed by the other side 
(how rude!)
Wed 2014-01-08 15:28:49: [157214:1] *  Winsock Error 10053

Saat kirim DATA koneksinya lambat sehingga terjadi time out dan receiver
memutuskan koneksi.



Pak Syafril,
Error seperti ini karena koneksi lambat apakah berasal dari koneksi 
server kami yang lambat atau ISP kami ?

Sekedar informasi delivery option settingan MD kami :
[x] Send all email directly first, and then to the 'Server' if they are 
problems



--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 13.6.1, SP 4.1.5, BES 2.0.2, OC 2.3.3, SG 2.1.2, PP 2.0.1

[MDaemon-L] Analisa log SMTP-Out

[Syafril Hermansyah]

On 2014-01-09 09:38, Yudis wrote:
 Error seperti ini karena koneksi lambat apakah berasal dari koneksi
 server kami yang lambat atau ISP kami ?

Koneksi itu sbb:
MDaemon Anda --- ISP Anda --- ISP penerima -- server penerima

harus diperiksa satu persatu kecepatan koneksinya.
Kalau memang sering terjadi problem seperti kemarin ini saat kirim mail
ke domain yang sama, bisa dikonsultasikan dengan ISP.

Kalau saat itu Anda berada didepan layar MDaemon, maka di session screen
MDconfig akan terlihat berapa besar transfer rate saat kirim mail tersebut.

 Sekedar informasi delivery option settingan MD kami :
 [x] Send all email directly first, and then to the 'Server' if they are
 problems

Sudah baik seperti itu, hanya saja kalau koneksi terputus setelah/saat
DATA transfer dengan direct delivery maka mail tidak otomatis re route
ke smarthost.


-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, running MDaemon 13.6.1 SecurityPlus 4.1.5
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 13.6.1, SP 4.1.5, BES 2.0.2, OC 2.3.3, SG 2.1.2, PP 2.0.1

[MDaemon-L] Analisa log SMTP-Out

[Yudis]

On 1/9/2014 10:01 AM, Syafril Hermansyah wrote:

On 2014-01-09 09:38, Yudis wrote:

Error seperti ini karena koneksi lambat apakah berasal dari koneksi
server kami yang lambat atau ISP kami ?

Koneksi itu sbb:
MDaemon Anda --- ISP Anda --- ISP penerima -- server penerima

harus diperiksa satu persatu kecepatan koneksinya.
Kalau memang sering terjadi problem seperti kemarin ini saat kirim mail
ke domain yang sama, bisa dikonsultasikan dengan ISP.

Kalau saat itu Anda berada didepan layar MDaemon, maka di session screen
MDconfig akan terlihat berapa besar transfer rate saat kirim mail tersebut.


Problem ini jarang terjadi Pak.
Tapi saya akan pantau terus apakah kirim email ke domain ini saja atau 
domain lain juga.

Dan saya coba pantau transfer rate saat kirim email.



Sekedar informasi delivery option settingan MD kami :
[x] Send all email directly first, and then to the 'Server' if they are
problems

Sudah baik seperti itu, hanya saja kalau koneksi terputus setelah/saat
DATA transfer dengan direct delivery maka mail tidak otomatis re route
ke smarthost.




Terima kasih atas penjelasannya Pak.



--
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 13.6.1, SP 4.1.5, BES 2.0.2, OC 2.3.3, SG 2.1.2, PP 2.0.1

[MDaemon-L] Analisa Log

[Albert Suwandhi]

2013/7/30 Syafril Hermansyah syaf...@dutaint.co.id



 Belum bisa di versi yang sekarang, masih dalam daftar wishlist.


Mari kita tunggu :)



 Tetapi dalam kasus ini

  Tue 2013-07-30 07:41:56: Passing message through AntiVirus (Size:
 140550)...
  Tue 2013-07-30 07:41:56: *  AntiVirus is disabled for recipient's domain
 or gateway

 receiving domain (pnaeromic.com) bypass antivirus scanning.


Lagi check mengapa bisa terdisable, tapi sudah dienable balik.



 Kalau menu berikut aktif

 [x] ...send 501 and close connection if no PTR record exists (caution)

 maka mail ini akan direject di level smtp.


Sudah dienable, hari itu saya juga enable Forgery, ada email dari customer
tidak bisa masuk.



  Tue 2013-07-30 07:41:52: Performing DNS-BL lookup (124.124.98.77 -
 connecting IP)
  Tue 2013-07-30 07:41:52: *  zen.spamhaus.org - failed - 127.0.0.4
  Tue 2013-07-30 07:41:52:  End DNS-BL results

 Begitu juga dengan DNS-BL check.
 Kalau menu berikut aktif

 http://mdaemon.dutaint.co.id/13.5/index.html?dns_bl_options.htm

 [x] SMTP server should refuse mail from black-listed IPs

 maka mail tersebut akan ditolak.

 Sudah saya check menu tersebut barusan. btw, kenapa bisa returned
127.0.0.4 artinya apa ya pak?

Thanks,
Albert

-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 13.5.1, SP 4.1.5, BES 2.0.2, OC 2.3.2, SG 2.1.2, PP 2.0.1

[MDaemon-L] Analisa Log

[Syafril Hermansyah]

On 2013-07-30 15:04, Albert Suwandhi wrote:
 
 Belum bisa di versi yang sekarang, masih dalam daftar wishlist.
 
 
 Mari kita tunggu :)

Kalau mau cepat, sampaikan ke

http://feedback.altn.com/

 kenapa bisa returned 127.0.0.4 artinya apa ya pak?

Artinya sender host termasuk dalam kategori Trojans Host.

http://www.spamhaus.org/zen/



-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, running MDaemon 13.5.2 Beta C SecurityPlus 4.1.5
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 13.5.1, SP 4.1.5, BES 2.0.2, OC 2.3.2, SG 2.1.2, PP 2.0.1

[MDaemon-L] Analisa Log

[Albert Suwandhi]

On Tue, Jul 30, 2013 at 10:29 PM, Syafril Hermansyah
syaf...@dutaint.co.idwrote:


 Sebagai work around disable Send restricted attachment notification
 message to recipient

 http://mdaemon.dutaint.co.id/13.5/index.html?cf_notifications.htm


 Thanks Pak Syafril atas masukannya.

Salam,
Albert

-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 13.5.1, SP 4.1.5, BES 2.0.2, OC 2.3.2, SG 2.1.2, PP 2.0.1

[MDaemon-L] Analisa Log

[Albert Suwandhi]

Dear all,

Saya menerima email Spam seperti ini, kebetulan pas SpamFilter lagi off.
Mohon bantuannya, saya lihat dia beberapa test fail, namun kenapa email
masih bisa sampai di Mailbox user (Content Filter sudah remove
attachmentnya). IP domain asal pengirim saya lihat kok bisa berubah2 ya?
Mohon petunjuknya. Thanks

Received: from [124.124.98.73] ([124.124.98.77])
by smtp.hinhingroup.com (smtp.hinhingroup.com)
(MDaemon PRO v13.0.0)
with ESMTP id md5261058.msg
for administra...@hinhingroup.com; Tue, 30 Jul 2013 07:41:59 +0800
Authentication-Results: smtp.hinhingroup.com
spf=pass smtp.mail=commutati...@ponyexpress.net;
x-ip-ptr=hardfail ip=124.124.98.77 (no PTR records found);
x-ip-helo=hardfail smtp.helo=[124.124.98.73] (does not match 124.124.98.77);
x-ip-mail=hardfail smtp.mail=commutati...@ponyexpress.net (does not match
124.124.98.77);
x-vbr=hardfail header.vbr-info=ponyexpress.net (domain not recognized)
Received-SPF: pass (smtp.hinhingroup.com: domain of
commutati...@ponyexpress.net
designates 124.124.98.77 as permitted sender)
x-spf-client=MDaemon.PRO.v13.0.0
receiver=smtp.hinhingroup.com
client-ip=124.124.98.77
envelope-from=commutati...@ponyexpress.net
helo=[124.124.98.73]
X-Spam-Processed: smtp.hinhingroup.com, Tue, 30 Jul 2013 07:41:59 +0800
(not processed: domain hinhingroup.com is excluded from spam filtering)
X-MDPtrLookup-Result: hardfail ip=124.124.98.77 (no PTR records found) (
smtp.hinhingroup.com)
X-MDHeloLookup-Result: hardfail smtp.helo=[124.124.98.73] (does not match
124.124.98.77) (smtp.hinhingroup.com)
X-MDMailLookup-Result: hardfail
smtp.mail=commutati...@ponyexpress.net(does not match 124.124.98.77) (
smtp.hinhingroup.com)
X-MDDK-Result: neutral (smtp.hinhingroup.com)
X-MDDKIM-Result: neutral (smtp.hinhingroup.com)
X-MDVBR-Result: not certified (smtp.hinhingroup.com)
X-MDSPF-Result: unapproved (smtp.hinhingroup.com)
X-MDDNSBL-Result: smtp.hinhingroup.com, Tue, 30 Jul 2013 07:41:59 +0800
zen.spamhaus.org returned result of 127.0.0.4
X-Rcpt-To: administra...@pnaeromic.com
X-MDRcpt-To: administra...@pnaeromic.com
X-MDRemoteIP: 124.124.98.77
X-Envelope-From: commutati...@ponyexpress.net
Received: from [100.186.109.98] (helo=avvcwxm.lovnts.biz)
by  with esmtpa (Exim 4.69)
(envelope-from )
id 1MMG2T-2749uf-GG
for administra...@pnaeromic.com; Tue, 30 Jul 2013 05:12:15 +0530
From: edwardola...@westernunion.com edwardola...@westernunion.com
To: administra...@pnaeromic.com
Subject: Western Union Critical Update
Date: Tue, 30 Jul 2013 05:12:15 +0530
MIME-Version: 1.0
X-Priority: 3
X-Mailer: elaouxaon.40
Message-ID: 7382626722.4pcl0rst302...@xzapp.wqswdqtlwj.ru
Content-Type: multipart/mixed;
  boundary==a__lxfjknry_32_29_40
X-MDRedirect: 1
X-MDRedirect_From: administra...@hinhingroup.com
X-Return-Path: edwardola...@westernunion.com
X-MDaemon-Deliver-To: alber...@pnaeromic.com

Regards,
Albert

-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 13.5.1, SP 4.1.5, BES 2.0.2, OC 2.3.2, SG 2.1.2, PP 2.0.1

[MDaemon-L] Analisa Log

[Syafril Hermansyah]

On 2013-07-30 08:54, Albert Suwandhi wrote:
 Saya menerima email Spam seperti ini, kebetulan pas SpamFilter lagi 
 off.

Yang ini namanya mail header bukan mail log.

 , saya lihat dia beberapa test fail,

Dia itu maksudnya siapa? Spammerkah?
Darimana tahu testnya fail?

 namun kenapa email masih bisa sampai di Mailbox user (Content Filter
 sudah remove attachmentnya).

Kalau mail tidak ditolak bukankah sudah benar akan sampai ke final
recipient?

 IP domain asal pengirim saya lihat kok bisa berubah2 ya?

Spammer itu umumnya kirim spam mail secara hit and run, salah satunya
dengan pakai cara dynamic IP (IP nya berubah-ubah) agar tidak mudah di
block.



-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, running MDaemon 13.5.2 Beta C SecurityPlus 4.1.5
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 13.5.1, SP 4.1.5, BES 2.0.2, OC 2.3.2, SG 2.1.2, PP 2.0.1

[MDaemon-L] Analisa Log

[Albert Suwandhi]

2013/7/30 Syafril Hermansyah syaf...@dutaint.co.id

 Dia itu maksudnya siapa? Spammerkah?
 Darimana tahu testnya fail?

 Sorry salah ketik, maksudnya di beberapa test fail, seperti PTR dan SPF
ada kata fail.



 Kalau mail tidak ditolak bukankah sudah benar akan sampai ke final
 recipient?


Jika ada attachment yang mencurigakan apakah selain diremove bisa sekalian
emailnya jgn kasih lolos?


 Spammer itu umumnya kirim spam mail secara hit and run, salah satunya
 dengan pakai cara dynamic IP (IP nya berubah-ubah) agar tidak mudah di
 block.


bagaimana cara yang lebih baik utk antisipasi pak? Kalau IP berubah, apakah
pas check PTR and SPF tidak bs deteksi?

Terima kasih, maklum masih newbie di MDaemon :)

Salam,
Albert

-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 13.5.1, SP 4.1.5, BES 2.0.2, OC 2.3.2, SG 2.1.2, PP 2.0.1

[MDaemon-L] Analisa Log

[Syafril Hermansyah]

On 2013-07-30 10:53, Albert Suwandhi wrote:
 Dia itu maksudnya siapa? Spammerkah? Darimana tahu testnya fail?
 
 Sorry salah ketik, maksudnya di beberapa test fail, seperti PTR dan 
 SPF ada kata fail.

Bisa diperlihatkan transaksinya dari smtp-in log.

 Kalau mail tidak ditolak bukankah sudah benar akan sampai ke final 
 recipient?
 
 
 Jika ada attachment yang mencurigakan apakah selain diremove bisa 
 sekalian emailnya jgn kasih lolos?

Mencurigakan itu maksudnya bagaimana persisnya?

Kalau mail/attachment bervirus memang direkomendasikan di tolak di level
smtp, dalam hal ini sudah pasti keseluruhan mail ditolak dan pasti
tolakkannya tidak akan salah arah.
Kalau baru tahap curiga, belum pasti, maka lebih baik di karantina
saja agar bisa diperiksa lebih teliti saat sempat.

 bagaimana cara yang lebih baik utk antisipasi pak? Kalau IP berubah,
 apakah pas check PTR and SPF tidak bs deteksi?

SPF check itu optional, gampang dikelabuhi spammer.
PTR record lebih susah dikelabuhi, kecuali ISPnya memang mau diajak
kerjasama oleh spammer.

http://mdaemon.dutaint.co.id/13.5/index.html?security__reverse_lookup.htm




-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, running MDaemon 13.5.2 Beta C SecurityPlus 4.1.5
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 13.5.1, SP 4.1.5, BES 2.0.2, OC 2.3.2, SG 2.1.2, PP 2.0.1

[MDaemon-L] Analisa Log

[Albert Suwandhi]

 Bisa diperlihatkan transaksinya dari smtp-in log.


 Tue 2013-07-30 07:41:48: --
Tue 2013-07-30 07:41:52: Session 80520; child 1
Tue 2013-07-30 07:41:52: Accepting SMTP connection from [124.124.98.77:41140]
to [192.168.0.3:25]
Tue 2013-07-30 07:41:52: -- 220 smtp.hinhingroup.com ESMTP MDaemon 13.0.0;
Tue, 30 Jul 2013 07:41:52 +0800
Tue 2013-07-30 07:41:52: -- EHLO [124.124.98.73]
Tue 2013-07-30 07:41:52: -- 250-smtp.hinhingroup.com Hello
[124.124.98.73], pleased to meet you
Tue 2013-07-30 07:41:52: -- 250-ETRN
Tue 2013-07-30 07:41:52: -- 250-AUTH LOGIN CRAM-MD5 PLAIN
Tue 2013-07-30 07:41:52: -- 250-8BITMIME
Tue 2013-07-30 07:41:52: -- 250-STARTTLS
Tue 2013-07-30 07:41:52: -- 250 SIZE 1000
Tue 2013-07-30 07:41:52: -- MAIL FROM: commutati...@ponyexpress.net
BODY=7BIT
Tue 2013-07-30 07:41:52: Performing PTR lookup (77.98.124.124.IN-ADDR.ARPA)
Tue 2013-07-30 07:41:52: *  Error: *  Name server reports domain name
unknown
Tue 2013-07-30 07:41:52: *  No PTR records found
Tue 2013-07-30 07:41:52:  End PTR results
Tue 2013-07-30 07:41:52: Performing IP lookup (ponyexpress.net)
Tue 2013-07-30 07:41:52: *  D=ponyexpress.net TTL=(5) A=[207.192.213.10]
Tue 2013-07-30 07:41:52: *  P=010 S=000 D=ponyexpress.net TTL=(4) MX=[
mail.suddenlinkmail.com]
Tue 2013-07-30 07:41:52: *  D=ponyexpress.net TTL=(5) A=[207.192.213.10]
Tue 2013-07-30 07:41:52:  End IP lookup results
Tue 2013-07-30 07:41:52: Performing SPF lookup (ponyexpress.net /
124.124.98.77)
Tue 2013-07-30 07:41:52: *  Policy: v=spf1 +all
Tue 2013-07-30 07:41:52: *  Evaluating +all: match
Tue 2013-07-30 07:41:52: *  Result: pass
Tue 2013-07-30 07:41:52:  End SPF results
Tue 2013-07-30 07:41:52: -- 250 commutati...@ponyexpress.net, Sender ok
Tue 2013-07-30 07:41:52: -- RCPT TO:administra...@pnaeromic.com
Tue 2013-07-30 07:41:52: administra...@pnaeromic.com is an alias for
administra...@hinhingroup.com
Tue 2013-07-30 07:41:52: Performing DNS-BL lookup (124.124.98.77 -
connecting IP)
Tue 2013-07-30 07:41:52: *  zen.spamhaus.org - failed - 127.0.0.4
Tue 2013-07-30 07:41:52:  End DNS-BL results
Tue 2013-07-30 07:41:52: -- 250 administra...@pnaeromic.com, Recipient ok
Tue 2013-07-30 07:41:52: -- DATA
Tue 2013-07-30 07:41:52: Creating temp file (SMTP):
d:\mdaemon\queues\temp\md5052653.tmp
Tue 2013-07-30 07:41:52: -- 354 Enter mail, end with CRLF.CRLF
Tue 2013-07-30 07:41:55: Message size: 140550 bytes
Tue 2013-07-30 07:41:55: Performing VBR certification (Domain:
ponyexpress.net, Auth: SPF)
Tue 2013-07-30 07:41:55: *  File: d:\mdaemon\queues\temp\md5052653.tmp
Tue 2013-07-30 07:41:55: *  Message-ID: 
7382626722.4pcl0rst302...@xzapp.wqswdqtlwj.ru
Tue 2013-07-30 07:41:55: *  Certifier (trusted): vbr.emailcertification.org...
Tue 2013-07-30 07:41:55: *Querying: ponyexpress.net._
vouch.vbr.emailcertification.org ...
Tue 2013-07-30 07:41:56: *Certifier does not recognize that domain
Tue 2013-07-30 07:41:56: *  Certification result: message not certified
Tue 2013-07-30 07:41:56:  End VBR results
Tue 2013-07-30 07:41:56: Performing DKIM lookup
Tue 2013-07-30 07:41:56: *  File: d:\mdaemon\queues\temp\md5052653.tmp
Tue 2013-07-30 07:41:56: *  Message-ID:
7382626722.4pcl0rst302...@xzapp.wqswdqtlwj.ru
Tue 2013-07-30 07:41:56: *  Result: neutral
Tue 2013-07-30 07:41:56:  End DKIM results
Tue 2013-07-30 07:41:56: Performing DomainKeys lookup (Sender:
edwardola...@westernunion.com)
Tue 2013-07-30 07:41:56: *  File: d:\mdaemon\queues\temp\md5052653.tmp
Tue 2013-07-30 07:41:56: *  Message-ID:
7382626722.4pcl0rst302...@xzapp.wqswdqtlwj.ru
Tue 2013-07-30 07:41:56: *  Querying for policy: westernunion.com
Tue 2013-07-30 07:41:56: *Querying: _domainkey.westernunion.com ...
Tue 2013-07-30 07:41:56: *DNS: *  Name server has no valid records of
the requested type for that domain
Tue 2013-07-30 07:41:56: *  Result: neutral
Tue 2013-07-30 07:41:56:  End DomainKeys results
Tue 2013-07-30 07:41:56: Passing message through AntiVirus (Size: 140550)...
Tue 2013-07-30 07:41:56: *  AntiVirus is disabled for recipient's domain or
gateway
Tue 2013-07-30 07:41:56:  End AntiVirus results
Tue 2013-07-30 07:41:56: Message creation successful:
d:\mdaemon\queues\inbound\md5261058.msg
Tue 2013-07-30 07:41:56: -- 250 Ok, message saved Message-ID:
7382626722.4pcl0rst302...@xzapp.wqswdqtlwj.ru
Tue 2013-07-30 07:41:56: -- QUIT
Tue 2013-07-30 07:41:56: -- 221 See ya in cyberspace
Tue 2013-07-30 07:41:56: SMTP session successful (Bytes in/out: 140679/482)
Tue 2013-07-30 07:41:56: --


 Mencurigakan itu maksudnya bagaimana persisnya?

 Kalau mail/attachment bervirus memang direkomendasikan di tolak di level
 smtp, dalam hal ini sudah pasti keseluruhan mail ditolak dan pasti
 tolakkannya tidak akan salah arah.
 Kalau baru tahap curiga, belum pasti, maka lebih baik di karantina
 saja agar bisa diperiksa lebih teliti saat sempat.


Ada attachment zip yang menyamar jadi EXE, terdeteksi MDaemon, attachment
diremove, namun mail sampai 

[MDaemon-L] Analisa Log

[Syafril Hermansyah]

On 2013-07-30 11:35, Albert Suwandhi wrote:
 Ada attachment zip yang menyamar jadi EXE, terdeteksi MDaemon,
 attachment diremove, namun mail sampai ke user, apakah bisa langsung
 message juga diremove sekalian?

Belum bisa di versi yang sekarang, masih dalam daftar wishlist.

 Kalau direject di level SMTP diset
 dimana pak Syafril?

Di antivirus (MDaemon securityplus).

http://mdaemon.dutaint.co.id/13.5/index.html?antivirus.htm

[x] Refuse to accept messages that are infected with viruses

Tetapi dalam kasus ini

 Tue 2013-07-30 07:41:56: Passing message through AntiVirus (Size: 140550)...
 Tue 2013-07-30 07:41:56: *  AntiVirus is disabled for recipient's domain or 
 gateway

receiving domain (pnaeromic.com) bypass antivirus scanning.

 PTR check dah diaktifkan, namun seperti log diatas sepertinya lolos ya.

Karena action nya tidak dispesifikasi.

 Tue 2013-07-30 07:41:52: Performing PTR lookup (77.98.124.124.IN-ADDR.ARPA)
 Tue 2013-07-30 07:41:52: *  Error: *  Name server reports domain name unknown
 Tue 2013-07-30 07:41:52: *  No PTR records found

Kalau menu berikut aktif

[x] ...send 501 and close connection if no PTR record exists (caution)

maka mail ini akan direject di level smtp.

 Tue 2013-07-30 07:41:52: Performing DNS-BL lookup (124.124.98.77 - connecting 
 IP)
 Tue 2013-07-30 07:41:52: *  zen.spamhaus.org - failed - 127.0.0.4
 Tue 2013-07-30 07:41:52:  End DNS-BL results

Begitu juga dengan DNS-BL check.
Kalau menu berikut aktif

http://mdaemon.dutaint.co.id/13.5/index.html?dns_bl_options.htm

[x] SMTP server should refuse mail from black-listed IPs

maka mail tersebut akan ditolak.




-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, running MDaemon 13.5.2 Beta C SecurityPlus 4.1.5
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.


-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.

Netiket: http://www.netmeister.org/news/learn2quote
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Henti Langgan: Kirim mail ke MDaemon-L-unsubscribe [at] dutaint.com
Berlangganan: kirim mail ke MDaemon-L-subscribe [at] dutaint.com
Versi terakhir MD 13.5.1, SP 4.1.5, BES 2.0.2, OC 2.3.2, SG 2.1.2, PP 2.0.1

[mdaemon-l] Analisa Log SMTP(Out)

[Suzy Ariyani]

Pagi Pak Syafril,

pak kalo aku punya log spt di bawah ini, ada kata 250 Ok: queued as
10FC56344F tapi dibawah juga tertulis SMTP session successful (Bytes
in/out: 235/1806) it doesn't mean that the email was send successfully to
recepient's mailbox?
Karena si recepient merasa tidak terima email tsb., bgmana cara kita
memastikan bahwa email tsb. sudah masuk ke recepient's mailbox?

thanks
Suzy

Wed 2008-02-20 13:38:55: --
Wed 2008-02-20 13:39:38: [3533:1] Session 3533; child 1
Wed 2008-02-20 13:39:37: [3533:1] Parsing message
d:\mdaemon\remoteq\pd1029614.msg
Wed 2008-02-20 13:39:37: [3533:1] *  From: [EMAIL PROTECTED]
Wed 2008-02-20 13:39:37: [3533:1] *  To: [EMAIL PROTECTED]
Wed 2008-02-20 13:39:37: [3533:1] *  Subject: Harga Tambak
Wed 2008-02-20 13:39:37: [3533:1] *  Message-ID:
[EMAIL PROTECTED]
Wed 2008-02-20 13:39:37: [3533:1] Attempting SMTP connection to
[indo.net.id]
Wed 2008-02-20 13:39:37: [3533:1] Resolving MX records for [indo.net.id]
(DNS Server: 202.148.11.48)...
Wed 2008-02-20 13:39:37: [3533:1] *  P=010 S=000 D=indo.net.id TTL=(1199)
MX=[mx-2.indo.net.id] {202.159.32.37}
Wed 2008-02-20 13:39:37: [3533:1] *  P=010 S=001 D=indo.net.id TTL=(1199)
MX=[mx-1.indo.net.id] {202.159.32.36}
Wed 2008-02-20 13:39:37: [3533:1] Attempting SMTP connection to
[202.159.32.37:25]
Wed 2008-02-20 13:39:37: [3533:1] Waiting for socket connection...
Wed 2008-02-20 13:39:37: [3533:1] *  Connection established
(172.16.0.6:1162 - 202.159.32.37:25)
Wed 2008-02-20 13:39:37: [3533:1] Waiting for protocol to start...
Wed 2008-02-20 13:39:37: [3533:1] -- 220 IndoInternet Mail System =- NO UCE
!! -= ESMTP
Wed 2008-02-20 13:39:37: [3533:1] -- EHLO ptbmi.com
Wed 2008-02-20 13:39:37: [3533:1] -- 250-mx-2.indo.net.id
Wed 2008-02-20 13:39:37: [3533:1] -- 250-PIPELINING
Wed 2008-02-20 13:39:37: [3533:1] -- 250-SIZE 1024
Wed 2008-02-20 13:39:37: [3533:1] -- 250-VRFY
Wed 2008-02-20 13:39:37: [3533:1] -- 250-ETRN
Wed 2008-02-20 13:39:37: [3533:1] -- 250 8BITMIME
Wed 2008-02-20 13:39:37: [3533:1] -- MAIL From:[EMAIL PROTECTED] SIZE=1701
Wed 2008-02-20 13:39:37: [3533:1] -- 250 Ok
Wed 2008-02-20 13:39:37: [3533:1] -- RCPT To:[EMAIL PROTECTED]
Wed 2008-02-20 13:39:37: [3533:1] -- 250 Ok
Wed 2008-02-20 13:39:37: [3533:1] -- DATA
Wed 2008-02-20 13:39:37: [3533:1] -- 354 End data with CRLF.CRLF
Wed 2008-02-20 13:39:37: [3533:1] Sending
d:\mdaemon\remoteq\pd1029614.msg to [202.159.32.37]
Wed 2008-02-20 13:39:37: [3533:1] Transfer Complete
Wed 2008-02-20 13:39:38: [3533:1] -- 250 Ok: queued as 10FC56344F
Wed 2008-02-20 13:39:38: [3533:1] -- QUIT
Wed 2008-02-20 13:39:38: [3533:1] -- 221 Bye
Wed 2008-02-20 13:39:38: [3533:1] SMTP session successful (Bytes in/out:
235/1806)
Wed 2008-02-20 13:39:38: --



-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.
Mohon tidak posting dengan format HTML, pastikan selalu menggunakan Format 
Plain-text

Arsip  : http://mdaemon-l.dutaint.com
Henti Langgan  : mailto:[EMAIL PROTECTED]
Berlangganan   : mailto:[EMAIL PROTECTED]
Versi Terakhir : MD 9.6.4, MDSP 3.0.6, MOC 2.1.6

[mdaemon-l] Analisa Log SMTP(Out)

[Syafril Hermansyah]

On 21/02/08 08:41 +07:00 Suzy Ariyani wrote:
 pak kalo aku punya log spt di bawah ini, ada kata 250 Ok: queued as
 10FC56344F tapi dibawah juga tertulis SMTP session successful (Bytes
 in/out: 235/1806) it doesn't mean that the email was send successfully to
 recepient's mailbox?

Tidak.
Itu baru sampai ke level MTA (SMTP Server) recipient, usermailbox
lokasinya di POP/IMAP server.

Email flow sbb :
MUA -- MTA  MTA -- MDA -- MUA

MUA = Mail User Agent, Email client (webmail)
MTA = Mail Transport Agent, SMTP Server
MDA = Mail Delivery Agent, POP/IMAP server

 Karena si recepient merasa tidak terima email tsb., bgmana cara kita
 memastikan bahwa email tsb. sudah masuk ke recepient's mailbox?

Itu menjadi tanggung jawab SMTP receiver bukan lagi menjadi tugas SMTP
Sender, orang yg bertanggung jawab secara teknis disini adalah
[EMAIL PROTECTED] atau [EMAIL PROTECTED]


-- 
syafril
---
Syafril Hermansyah
MDaemon-L Moderators, MDaemon 9.6.4 under WinXP
Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.

-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.
Mohon tidak posting dengan format HTML, pastikan selalu menggunakan Format 
Plain-text

Arsip  : http://mdaemon-l.dutaint.com
Henti Langgan  : mailto:[EMAIL PROTECTED]
Berlangganan   : mailto:[EMAIL PROTECTED]
Versi Terakhir : MD 9.6.4, MDSP 3.0.6, MOC 2.1.6

[mdaemon-l] Analisa Log SMTP(Out) OOT

[PT.BMI]

Tq pak buat jawabannya..

Suzy
- Original Message -
From: Syafril Hermansyah [EMAIL PROTECTED]
To: mdaemon-l@dutaint.com
Sent: Thursday, February 21, 2008 08:56 AM
Subject: [mdaemon-l] Analisa Log SMTP(Out)


 On 21/02/08 08:41 +07:00 Suzy Ariyani wrote:
  pak kalo aku punya log spt di bawah ini, ada kata 250 Ok: queued as
  10FC56344F tapi dibawah juga tertulis SMTP session successful (Bytes
  in/out: 235/1806) it doesn't mean that the email was send successfully
to
  recepient's mailbox?

 Tidak.
 Itu baru sampai ke level MTA (SMTP Server) recipient, usermailbox
 lokasinya di POP/IMAP server.

 Email flow sbb :
 MUA -- MTA  MTA -- MDA -- MUA

 MUA = Mail User Agent, Email client (webmail)
 MTA = Mail Transport Agent, SMTP Server
 MDA = Mail Delivery Agent, POP/IMAP server

  Karena si recepient merasa tidak terima email tsb., bgmana cara kita
  memastikan bahwa email tsb. sudah masuk ke recepient's mailbox?

 Itu menjadi tanggung jawab SMTP receiver bukan lagi menjadi tugas SMTP
 Sender, orang yg bertanggung jawab secara teknis disini adalah
 [EMAIL PROTECTED] atau [EMAIL PROTECTED]


 --
 syafril
 ---
 Syafril Hermansyah
 MDaemon-L Moderators, MDaemon 9.6.4 under WinXP
 Harap tidak cc: atau kirim ke private mail untuk masalah MDaemon.

 --
 --[MDaemon-L]
 Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.
 Mohon tidak posting dengan format HTML, pastikan selalu menggunakan Format
Plain-text

 Arsip  : http://mdaemon-l.dutaint.com
 Henti Langgan  : mailto:[EMAIL PROTECTED]
 Berlangganan   : mailto:[EMAIL PROTECTED]
 Versi Terakhir : MD 9.6.4, MDSP 3.0.6, MOC 2.1.6



-- 
--[MDaemon-L]
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server.
Mohon tidak posting dengan format HTML, pastikan selalu menggunakan Format 
Plain-text

Arsip  : http://mdaemon-l.dutaint.com
Henti Langgan  : mailto:[EMAIL PROTECTED]
Berlangganan   : mailto:[EMAIL PROTECTED]
Versi Terakhir : MD 9.6.4, MDSP 3.0.6, MOC 2.1.6