OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Server blacklisted, need help

From: Tim O (white.list.megmail.com)
Date: Thu Feb 02 2006 - 09:33:05 CST


Hello, im doing some work for a organization who has recently been
placed on several RBL's most notably was http://cbl.abuseat.org/. upon
looking
at the mail server ive noticed the following. Please tell me if this is
normal behavior for a postfix server, I only know qmail. Also the
system has a internal IP which you will see coming up, and is going
thru a PIX

Telnet session:

OK, connected to <external IP>...
< 220 *0***0*2**************
> HELO edit.dnsvr.com
< 250 10.1.0.2
> MAIL FROM:<toot...<http://groups.google.com/groups/unlock?msg=3fd993af51f8ac4e&_done=/group/mailing.postfix.users/browse_thread/thread/a2d0e6ec3a6017c0>
lks.com>
< 250 Ok
> RCPT TO:<white.list...<http://groups.google.com/groups/unlock?msg=3fd993af51f8ac4e&_done=/group/mailing.postfix.users/browse_thread/thread/a2d0e6ec3a6017c0>
gmail.com>

< 554 <white.list...<http://groups.google.com/groups/unlock?msg=3fd993af51f8ac4e&_done=/group/mailing.postfix.users/browse_thread/thread/a2d0e6ec3a6017c0>
gmail.com>: Relay access denied

bounce back message header:

This is the Postfix program at host 10.1.0.2.

I'm sorry to have to inform you that the message returned
below could not be delivered to one or more destinations.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the message returned below.

                        The Postfix program

<ADDRESS>: host:<REPLY HOST>[REPLY HOST IP] said: 550 5.7.1
    This message from <MAIL SERVER EXTERNAL IP> has been blocked by
sbl-xbl.spamhaus.org
    if you reach this in error, please forward a copy of this message
to:
    <INTERNAL ADDRESS> thank you (in reply to RCPT TO command)
Reporting-MTA: dns; 10.1.0.2
Arrival-Date: Fri, 27 Jan 2006 13:38:41 -0500 (EST)
Any Ideas?