OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Timeout after EHLO

From: Ace Suares (listssuares.an)
Date: Thu Dec 14 2006 - 07:31:12 CST


On Wednesday 13 December 2006 10:48, Wietse Venema wrote:

> If that does make the difference then you know what to do.

Apparently, it did not make much of a difference. Today, I started probing
those pesky servers with telnet some more. And, the results are
flabbergasting:

First try: see if I can connect to the server.

220 mx2.mail.omroep.nl ESMTP Postfix MTA - Publieke Omroep Internet
Services (2.3.5)
EHLO myserver
250-mx2.mail.omroep.nl
250-PIPELINING
250-SIZE 32768000
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
MAIL FROM:<aceace.an>
250 2.1.0 Ok
RCPT TO:<blabla.com>
554 5.1.8 <aceace.an>: Sender address rejected: Domain not found
QUIT

Nice! (The 'Sender address rejected' is expected).

Now try with the address that all te mail from the mailinglist is actually
coming from:

220 mx2.mail.omroep.nl ESMTP Postfix MTA - Publieke Omroep Internet
Services (2.3.5)
EHLO milhous.suares.nl
250-mx2.mail.omroep.nl
250-PIPELINING
250-SIZE 32768000
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
MAIL FROM:<listaddress-bouncesmailing.thishere.domain>

... and we get not a single TCP packet back! The server is stalling on us.
In tcpdump, we see a lot of retransmissions from our site but nothing
coming back from theirs. Of course, timeout after some time.

Hm. Just trying with another address at the same domain (in a new session,
abbreviated here):

mail from:<acemailing.thishere.domain>
250 2.1.0 Ok

My conclusion till so far: for some reason, this server is
blacklisting/tarpitting the 'from' address for the mailinglist. Probably
a misguided anti-spam measure.

I am going to test theory this now with the other servers that are
stalling and giving timeouts. In the meantime, I'd like to hear your
opinion(s).

I would also be interested as to with *what* tools they can do that. Is
that a postfix thing or some third-party tool ?

Cheers,
Ace

>
> Wietse