Re: Website link for 207.173.187.220

Leisher, Doug пишет:

> Good news is I found yours.  Bad news is that there is no log for the
> 29th.
> 
> I was looking in the message tracking system of MSEx and the
> Application event logs as I turned on some diagnostic events.

I believe, now you have proper logging level for normal work. I don't 
recommend you to decrease it.

> Evidently I didn't have the SMTP Virtual Server log enabled on the
> 29th which is why I couldn't find it.

The next (and the last) proposal is to check once more all your content 
filters, if you have ones. Both antispam and antivirus. First of all, no 
any content filters should be applied to "Postmaster" and "abuse" 
e-mail, just because mail to these addresses may and should contain 
evidences of malware and spam activity related to your system. Second, 
all these filters have false positives, and it would be more safe to set 
the filter to "quarantine" all suspicious messages instead of delete 
them permanently. Or, even better, reject during the SMTP session, with 
"5xx content rejected" after DATA end.

If you do so, you'll have 100% chances to find new delisting message 
tomorrow either in your mailbox or in the quarantine area, and good 
chance to see any futire abuse reports in your mailbox before your 
system end in blacklists ;-)

I go offline, it is 11 pm here an I had enough exercises in English for 
today...
Bye.
Alexey

> 
> Doug. . .
> 
> -----Original Message----- From: Alexey Lobanov
> [mailto:[email protected]] Sent: Tuesday, December 05, 2006 2:42 PM 
> To: Leisher, Doug Cc: [email protected] Subject: Re: [DSBL-Contact]
> Website link for 207.173.187.220
> 
> Leisher, Doug пишет:
> 
>> Yes, I did receive your test email in my Postmaster inbox.
>> However, there was nothing in the "from" field.
> 
> Correct. You could see in the input session that there was really 
> nothing :-)
> 
> Now I ask you to locate the 
> <[email protected]> message receiving 
> event in your today's server logs, and then locate the very similar 
> event in your logs of Nov 29.
> 
> Alexey
> 
> 
>> Doug
>> 
>> -----Original Message----- From: Alexey Lobanov 
>> [mailto:[email protected]] Sent: Tuesday, December 05, 2006 2:32 PM
>>  To: Leisher, Doug Cc: [email protected] Subject: Re: [DSBL-Contact] 
>> Website link for 207.173.187.220
>> 
>> Leisher, Doug пишет:
>> 
>>> I don't see any messages in my log that specifically shows 
>>> "reject". All I see from your IP address are "EHLO" and "QUIT" 
>>> messages.  Near as I can tell, none of your messages have
>>> actually been received but I'm guessing they are not supposed to
>>> be.
>> Correct. Nothing has been accepted, and it is good that you see the
>>  events.
>> 
>> Next test: it WAS properly accepted.
>> 
>> ==== aal@gw:~$ telnet 207.173.187.220 25 220 mail.sfsd.k12.pa.us 
>> Microsoft ESMTP MAIL Service, Version: 5.0.2195.6713 ready at  Tue,
>> 5 Dec 2006 14:22:43 -0500 helo lobanov.sp.ru 250
>> mail.sfsd.k12.pa.us Hello [195.131.89.60] mail from:<> 250 2.1.0
>> <>....Sender OK rcpt to:<[email protected]> 250 2.1.5
>> [email protected] data 354 Start mail input; end with
>> <CRLF>.<CRLF> subject: just a test
>> 
>> test . 250 2.6.0 <[email protected]> 
>> Queued mail for delivery ============
>> 
>> 
>> Alexey
>> 
>