hosted by liquidweb


Go Back   Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : exim mail queue filling up with bounces
Reply

Hosting Security and Technology Configuring and optimizing web hosting servers and operating systems, developing administration scripts, building servers, protecting against hackers, and general security (SSL certificates, etc.)
Forum Jump

exim mail queue filling up with bounces

Reply Post New Thread In Hosting Security and Technology Subscription
 
Send news tip View All Posts Thread Tools Search this Thread Display Modes
  #1  
Old 08-14-2006, 03:24 AM
papi papi is offline
Web Hosting Guru
 
Join Date: Jan 2004
Posts: 347

exim mail queue filling up with bounces


We use cpanel/centos servers with Exim and in the past few weeks I've noticed that the mail queue (WHM) is constantly filled with 1000's of emails most of which appear to be bounces .. ie.

1) some spammer sends mail to nonexistant local users but exim for some reason doesn't reject the email during the initial connection and instead tries to send back a bounce to an obviously faked return email and because it's fake, it's rejected by remote smtp server and so the bounce stays in my queue

2) some spammers send mail to email address hosted by us and SpamAssassin rejects it but sends a bounce to the fake sender return email and again .. the bounce stays in my mail queue

3) spammer sends mail to an email hosted by us but the user's mailbox or space quota is full and exim sends a bounce to faked return path and once again the bounce remains in my queue as it's not accepted by remote server

Has anyone here though of an elegant way of reducing mail queue sizes by ridding them of these bounces that aren't going anywhere ..? The only thing I can think of is to have a shell script written that inspects the mail queue and deletes mail that matches certain patterns and put it in cron ... But is there any better solution? Some way to tell Exim to stop being so damn stupid and sending bounces to faked return emails...

We use several RBLs and SA but still a lot of spam gets through..The option to not keep new mail for users whose quota has been reached in the queue is also enabled in WHM.

Reply With Quote


Sponsored Links
  #2  
Old 08-14-2006, 10:48 AM
SPaReK SPaReK is offline
Web Hosting Master
 
Join Date: Apr 2002
Posts: 644
Quote:
Originally Posted by papi
1) some spammer sends mail to nonexistant local users but exim for some reason doesn't reject the email during the initial connection and instead tries to send back a bounce to an obviously faked return email and because it's fake, it's rejected by remote smtp server and so the bounce stays in my queue
The only place I have seen this become an issue, is if you are using any type of exim ACL to always accept mail for a specific e-mail address. Specifically I remember seeing a post where you could configure exim to always accept postmaster@domain.com and abuse@domain.com for every domain on the server, and forward those to a specific e-mail address you as an administrator had set up. I have seen where this can cause problems where the message is rejected but remains in the queue. You see messages in the queue that will say "postmaster@domain.com rejected, user does not exist". Not sure if this describe your problem, but this is where I have seen this problem. If you've done this setup, you might try undoing those changes.

Quote:
Originally Posted by papi
3) spammer sends mail to an email hosted by us but the user's mailbox or space quota is full and exim sends a bounce to faked return path and once again the bounce remains in my queue as it's not accepted by remote server
There are some posts on the cpanel forums regarding a shell script that you put in cron that runs every 5 minutes and checks to see if an account is over its quota, and if it is, that domain is added to a list where exim denies mail for that domain at the RCPT TO stage. I am using this on most of our servers and it has worked pretty good. I think these are the posts:

http://forums.cpanel.net/showpost.ph...0&postcount=13
http://forums.cpanel.net/showpost.ph...2&postcount=19

Concerning when mailboxes are over quota, this has become one of my pet peeves. I cannot for the life of be think of a situation where mailbox quotas are necessary. When a user creates a mail account, they are either going to be checking that mail account or they are not going to be checking it. If they are checking it, then the mailbox quota is of no real use and unnecessary. If they are not checking the mailbox, then they shouldn't create it in the first place. If I see where an account's mailbox is over quota, I go into the account and remove the quota limit on that mailbox, so that it is unlimited, then if that mailbox continues to fill up mail, eventually the entire account will reach its quota limit and then the above exim deny will kick in. Then when the users write in saying they are not getting mail, then I will tell them that they shouldn't have the mailbox created if they are not going to be checking it for mail regularly.


Quote:
Originally Posted by papi
The only thing I can think of is to have a shell script written that inspects the mail queue and deletes mail that matches certain patterns and put it in cron ... But is there any better solution? Some way to tell Exim to stop being so damn stupid and sending bounces to faked return emails...
I have tried doing this before, but decided that it was best to find the underlying cause. For example, you could delete all of the bounce messages in your queue saying that a mailbox is full, but at the end of the day, the mailbox is still full and those bounce messages are still occurring. The best solution, in my book, has always been to find what the exact cause of the problem is and then focusing on that problem. If the mailbox is full, then attack that.

Hope this helps.

Reply With Quote
  #3  
Old 08-15-2006, 08:08 AM
papi papi is offline
Web Hosting Guru
 
Join Date: Jan 2004
Posts: 347
Quote:
Not sure if this describe your problem, but this is where I have seen this problem. If you've done this setup, you might try undoing those changes.
Yes I do have the postmaster/abuse ACL thingo but having looked through dozens of the messages in the queue - none of them were for abuse/postmaster so I don't believe this is the problem at all.

The problem is listed above .. well all 3 of them actually.

Quote:
There are some posts on the cpanel forums regarding a shell script that you put in cron that runs every 5 minutes and checks to see if an account is over its quota, and if it is, that domain is added to a list where exim denies mail for that domain at the RCPT TO stage. I am using this on most of our servers and it has worked pretty good. I think these are the posts:
Cool thanks, I'll give that a try.

Quote:
I cannot for the life of be think of a situation where mailbox quotas are necessary.
Not every account is owned/used by one single person ... What if a business user didn't want one of their user mailboxes to fill up their entire web hosting account and cause everyone elses mail to bounce ..? There's one good reason. The user in question could be AFK (ie sick leave) or leave copies of mail on the server or simply get mail bombed...

Reply With Quote
Sponsored Links
  #4  
Old 08-15-2006, 10:56 AM
SPaReK SPaReK is offline
Web Hosting Master
 
Join Date: Apr 2002
Posts: 644
Quote:
Originally Posted by papi
Not every account is owned/used by one single person ... What if a business user didn't want one of their user mailboxes to fill up their entire web hosting account and cause everyone elses mail to bounce ..? There's one good reason. The user in question could be AFK (ie sick leave) or leave copies of mail on the server or simply get mail bombed...
If the person that is associated with that account is checking the account regularly, then there wouldn't be a need for a mailbox quota. I will agree that setting a mailbox quota will prevent a single mailbox from taking over the entire quota limit on an account. But this is like masking the underlying problem. If you set up your mailboxes each with a 10MB mailbox quota, then when the mailbox reaches 10MB you will get these bounces. If it has reached the 10MB quota, then there's a good chance that the mailbox is not being checked, in which case you're just better to remove the mailbox.

I realize that some users will give out e-mail accounts to users. This may be a situation where a mailbox quota is necessary. But the user, the person that is paying for the webhosting account, needs to realize that it is their responsibility to monitor mailbox usage. If a mailbox goes over its quota or nears its quota, the user needs to make a deicision, either contact the individual and see why they are not checking the mailbox, or delete the mailbox so that it does not create the over quota messages.

This is not directed at papi, this is just meant in the general sense. It has been my experience that users want to see things changed, but they don't want to make any changes. In this particular case, to stop the mailbox over quota bounce messages, understand what is causing the bounce messages and then act accordingly. If you really want them to stop, then you may have to make some changes. Again, this is not a comment that is aimed at any one in particular, and it doesn't apply just for this situation, but for a handful of situations. I have had problems in the past where end users have wanted to reduce the amount of spam that they receive, but they did not want to make any changes to their account. You can't have it both way, you can't stop something without doing something to stop it.

<Steps off soapbox>

Reply With Quote
Reply

Related posts from TheWhir.com
Title Type Date Posted
Rackspace Cloud Tools Marketplace Adds Cloudant Database as a Service Web Hosting News 2012-12-14 14:41:05
A Look at the New WHM Interface in Version 11.34 of the cPanel Hosting Control Panel Web Hosting News 2012-11-12 12:57:03
Web Host SoftLayer Launches Message Queue Service for Scalable Software System Communication Web Hosting News 2012-09-13 17:26:30
Web Hosting Control Panel cPanel and WHM Version 11.32 Adds Features, Fixes Web Hosting News 2012-04-08 11:51:35
cPanel Launches Version 11.32 of Control Panel and Web Host Manager Web Hosting News 2012-02-15 12:46:33


Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes
Postbit Selector

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Forum Jump
Login:
Log in with your username and password
Username:
Password:



Forgot Password?
Advertisement:
Web Hosting News:



 

X

Welcome to WebHostingTalk.com

Create your username to jump into the discussion!

WebHostingTalk.com is the largest, most influentual web hosting community on the Internet. Join us by filling in the form below.


(4 digit year)

Already a member?