Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Customer cannot receive email from certain domain

[hpprod]

Hey Ya'll -

I've got an ongoing issue where one of our customers cannot receive any email from only ONE specific outside domain ...

Our customer is hosted on our main shared IP, which is the IP for hundreds of customers. Nobody complains, and my customer can get email from EVERYBODY ELSE.

However, when someone emails him from @unitedpower.com, it never gets to us . They are not blacklisted - actually, we whitelisted them just to be sure ... the mail never gets through.

The unitedpower.com firewall vendor INSISTS it's not their firewall, although the only way they ever see the error message is in their firewall - below is the errors in the firewall:

I have my firewall vendor take another look at the problem with your mail. Here is his response. Maybe it could be helpful to your mail support.

I am connected to your server now. I will try to capture the port 25 traffic to their mail server to see why the server refused the mail service. The mail admin for mail.spectrumeng.net[67.18.104.4 would be the best to ask why. I suspect it is because you can send a limited amount of emails to them


From the tcp dump I see found following:
421 F-03426. Maximum proxy clients (20) re

Note: 67.18.104.4 is our main IP, but as I said, hundreds and hundreds of customers are receiving mail @ that Ip with no problem, and even this customer gets all mail EXCEPT mail from this one domain ..

ANY CLUES???


Thanks,
Fred

[Sillysoft]

If on linux check your mailllog. Can this person send to this domain?

Silly

[hpprod]

Hi -
Yes, the customer can SEND to this domain all day long. There is never a bounced message either - just something in their firewall that says "mail service refused on 67.18.104.4" ... but our mail service is running fine.

[Sillysoft]

What type of mail server you running? Sendmail, qmail, postfix? Do a traceroute from your server to the server he cant send email to.. Make sure you can bring up their mx records. Make sure the offending server can do a reverse ip lookup on your server

Silly

[hpprod]

Hey Silly -
We're using qmail. Actually - it's the other way around for us - we can send mail to them perfectly - they can't send to US. I'll ask him to do a traceroute ... I have no idea how to do the other things on "their" server - but will forward these items to them.

[Sillysoft]

Ahh qmail. You using badmailfrom file? If you dont know get on ssh, do a updatedb to update your file index and look for badmailfrom. If you have that file, vim it and search for that ip and or domain in that file. You running Spamassassin?

Silly

[Naes]

Originally posted by Sillysoft
Ahh qmail. You using badmailfrom file? If you dont know get on ssh, do a updatedb to update your file index and look for badmailfrom. If you have that file, vim it and search for that ip and or domain in that file. You running Spamassassin?

Silly

If Qmail was rejecting the message the sender would be getting a bounce back with the error code from Qmail. I don't believe this was the case.

If you are not in fact blocking them (verify your firewall) then have them try to connect to your mail server using telnet.

telnet server 25

If they don't get anything (ie it just sits there trying to connect) they need to look at their firewall more closely. Since they included this:

From the tcp dump I see found following:
421 F-03426. Maximum proxy clients (20) re

they might also only be allowed a max 20 connections through this firewall. Maybe the person in question is trying to be connection 21.

[Sillysoft]

Originally posted by Naes
If Qmail was rejecting the message the sender would be getting a bounce back with the error code from Qmail. I don't believe this was the case.

If you are not in fact blocking them (verify your firewall) then have them try to connect to your mail server using telnet.

telnet server 25

If they don't get anything (ie it just sits there trying to connect) they need to look at their firewall more closely. Since they included this:

From the tcp dump I see found following:
421 F-03426. Maximum proxy clients (20) re

they might also only be allowed a max 20 connections through this firewall. Maybe the person in question is trying to be connection 21.

You can setup badmailfrom for not sending back a bounce. But your right, defaulty it sends a bounce back.

Silly