English is not my native language, so please excuse my mistakes.
I have the following problem: I have a homepage together with some friends with 5GB traffic inclusive each month. One day we had almost 10GB traffic through mail so the overall traffic for this month was 10.3GB and the host wants about 50¤ (~65$) for this traffic. Of course we do not want to pay, because we did not send 10GB...
The reason for this traffic could be find relatively easy. One of us sent a mail with an attachment of about 15MB to an adress formerly owned by a friend, but now owned by a dubious American firm.
Anyway, this does not really matter I think. Fact is that at the destination adress there was a server (one problem is, that the status changed; the domain is no longer reachable) with quite a strange behaviour.
After four hours a Mail from "Mail Delivery Subsystem" was received saying (I am not sure I may quote it originally, so I deleeted the domain):
----- Transcript of session follows -----
<Webmaster@*deleeted*.net>... Deferred: Connection timed out with *deleeted*.net.
Warning: message still undelivered after 4 hours
Will keep trying until message is 5 days old
After those five days another Mail was received which stated that the mail could not be delivered because the destination adress had "permanent fatal errors".
When we received the bill for the traffic I tested this several times, a mail with 1MB attachment send to this adress produced several hundred MB of traffic.
And the question I have to you - venerated reader - is: Can this happen with a "normally" configured server or is my host not willing or not able to configure it right?
The host says, his server only does what the other server told him and that we are lucky there were no autoresponders on both sides, which can lead to really much traffic.
Ok, this must be enough for the beginning, if you need more information, just ask.
Hope you can help me, I already asked several friends and friends of them, but no one knows how mail servers behave.
I can't see how if a message is deferred the attachment would bounce backwards and forwards ... once it's realised it's not going to get there it would normally drop the attachment, 10GB is a rather large amount of traffic for a 15MB e-mail too.
Out of interest, what control panel are they using? If it's, (yes you guessed it), cPanel, it might actually be wrong
█ Dan Kitchen | Technical Director | Razorblue
█ ddi: (+44) (0)1748 900 680 | e: [email protected]
█ UK Intensive Managed Hosting, Clusters and Colocation.
█ HP Servers, Cisco/Juniper Powered BGP Network (AS15692).
This is quite strange, iam not much aware of how would a mail server behave in such a situation, but what i know is the he's charging you allot for that banwidth, unless they have their servers at Rackspace
Intech, you say most people have such a setup... Is it that difficult to prevent such things or would it be negligible effort for a commercial host? I think this might be the deciding question for the judge if it comes that far. Fortunately I know a lawyer working for me for free.
Moreover I have access to a mail adress hosted at another host. I tested it with that adress and the result was a different "failure notice" without a visible peak in traffic. The question is: Does this host has a better-configured server or does he simply has a bad traffic-counting tool?
And what control pannel: I am not sure I talk about the right thing, but the traffic can be seen in "Confixx Professional". Moreover the host told us that he monitores the traffic with two seperate systems, both showing the same.
Finally the price: I recently read that 1GB is much more expensive in Europe (or at least Germany) than it is in the US. Of course, it will not cost him the ~10$ he charges us, but I think 3-5$ are realistic. [edit: Just informed myself... <-- this is NOT realistic, the 1.50$ are closer to reality.]
Further comments please?
Last edited by BlueTornado; 05-08-2005 at 08:12 AM.
If it was deferred it should never even have left your host, so there shouldn't have been any bandwidth used at all. It couldn't make a connection to the recipient's server, so it would be impossible to transfer any data to it.
That is, actually, an entirely possible situation when sending to a poorly-configured or broken MTA.
What I suspect is happening is that the sending server is transmitting the entire message to the recipient's server, which is responding normally to most SMTP commands. However, it is timing out at some point before the message is accepted and delivered locally. This can be because the remote server is out of disk space, has a damaged queue, is trying to do some sort of on-the-fly spam/virus scanning that's hanging on the big attachment, or any one of a number of other reasons. The sending server then keeps sending the same email over and over and over again, at 15/30/60-, or whatever, minute intervals, and over the course of a week it gobbles up quite a bit of bandwidth indeed.
Broken MTAs suck.
redpin.com - offering amazingly competent email, dns, and web hosting since 2002... because someone has to!
Because Simple Things Should Be Simple - YouCANHasDNS
Originally posted by Ankheg What I suspect is happening is that the sending server is transmitting the entire message to the recipient's server, which is responding normally to most SMTP commands. However, it is timing out at some point before the message is accepted and delivered locally.
Ah, interesting theory. I'd expect a different error message from the local MTA than "connection timed out" in that case, but I guess it's a possibility, and that would certainly explain what's going on here.
Just as was mentioned, Email was NOT designed to send 15mb attachments. 2mb should be the soft limit. Larger files should be placed in a folder and a link to them sent in the email. Save's bandwidth and this type of situation from occurring, not to mention the slowdown on the server.
Each time that got sent, it held up the mail from coming in or going out till it was set...only to be rejected.
And what's so dubious about the destinations new owner? Because they didn't accept the mail (most likely because that mailbox is no longer there and they don't have a catch all.)
@ArtieFishill: You can be sure NEXT TIME he will load it up and send a link, but without the FTP login data this was no alternative...
I called the new owner "dubious" because my antivir imediately catched a trojan when I visited ww."thedomain".net. Moreover the page looked in some way dubious for me.
Furthermore - forgot do mention this before, but might be important - a friend, I asked about the problem earlier, told me that a portscan showed that at this server only port 80 was used (for ww) and that no mailserver was running at all.
But a test with an other domain where the mailserver was disabled didn't cause the same result. Just as anyone would expect, a mail telling that the delivery failed was received within minutes.
One reason more to call it d...., lets call it strange.