[Exim] Puzzling RBL rejections

Page principale
Supprimer ce message
Répondre à ce message
Auteur: Jeff Green
Date:  
À: exim-users
Sujet: [Exim] Puzzling RBL rejections
I'm getting some troubling reject log entries that point to RBL rejections
and I'm not sure what's going on. System is Linux 2.4.19 (Debian) and Exim
4.20.

Log entry: (#=@)

2003-07-14 17:50:21 H=wsip-24-234-60-77.lv.lv.cox.net
(twmail.terrawest.com) [24.234.60.77] F=<PWood#TerraWest.com> rejected RCPT
<dpursiano#pursianolaw.com>: (ACL) RBL rejection

Configuration snippets:

hostlist rbl_hosts = !localhost : \
         !192.168.x.0/24 : \
         !24.234.x.x : \
         *
...
# Check recipient ACL
...
   deny    log_message = (ACL) RBL rejection
           message = Administrative prohibition: if you believe this is in
error please resend to postmaster
           dnslists = relays.ordb.org :\
                      orbs.dorkslayers.com :\
                      relays.osirusoft.org :\
                      sbl.spamhaus.org :\
                      opm.blitzed.org
           hosts = +rbl_hosts


   warn    log_message = (ACL) Dynamic/dialup RBL rejection
           message = X-Spam-Warning: $sender_host_address is listed at
$dnslist_domain
           dnslists = dynablock.easynet.nl :\
                      dialups.visi.com
           hosts = +rbl_hosts


   warn    message = X-Warning: $sender_host_address is listed at
$dnslist_domain
           dnslists = spews.relays.osirusoft.com
           hosts = +rbl_hosts



Pertinent output from 'exim -bh 24.234.60.77':

**** SMTP testing session as if from host 24.234.60.77
**** but without any ident (RFC 1413) callback.
**** This is not for real!

>>> host in host_lookup? yes (end of list)
>>> looking up host name for 24.234.60.77
>>> IP address lookup yielded wsip-24-234-60-77.lv.lv.cox.net

...
220-cm2.crockettandmyers.com ESMTP Exim 4.20 #1 Tue, 15 Jul 2003 09:34:20 -0700
ehlo twmail.terrawest.com
...
250-cm2.crockettandmyers.com Hello wsip-24-234-60-77.lv.lv.cox.net
[24.234.60.77]
...
mail from:<PWood@???>
250 OK
rcpt to:<dpursiano@???>
...
>>> check dnslists = relays.ordb.org :orbs.dorkslayers.com

:relays.osirusoft.org :sbl.spamhaus.org :opm.blitzed.org
>>> DNS list check: relays.ordb.org
>>> new DNS lookup for 77.60.234.24.relays.ordb.org
>>> DNS lookup for 77.60.234.24.relays.ordb.org failed
>>> => that means 24.234.60.77 is not listed at relays.ordb.org
>>> DNS list check: orbs.dorkslayers.com
>>> new DNS lookup for 77.60.234.24.orbs.dorkslayers.com
>>> DNS lookup for 77.60.234.24.orbs.dorkslayers.com failed
>>> => that means 24.234.60.77 is not listed at orbs.dorkslayers.com
>>> DNS list check: relays.osirusoft.org
>>> new DNS lookup for 77.60.234.24.relays.osirusoft.org
>>> DNS lookup for 77.60.234.24.relays.osirusoft.org failed
>>> => that means 24.234.60.77 is not listed at relays.osirusoft.org
>>> DNS list check: sbl.spamhaus.org
>>> new DNS lookup for 77.60.234.24.sbl.spamhaus.org
>>> DNS lookup for 77.60.234.24.sbl.spamhaus.org failed
>>> => that means 24.234.60.77 is not listed at sbl.spamhaus.org
>>> DNS list check: opm.blitzed.org
>>> new DNS lookup for 77.60.234.24.opm.blitzed.org
>>> DNS lookup for 77.60.234.24.opm.blitzed.org failed
>>> => that means 24.234.60.77 is not listed at opm.blitzed.org
>>> deny: condition test failed
>>> processing "warn"
>>> check dnslists = dynablock.easynet.nl :dialups.visi.com
>>> DNS list check: dynablock.easynet.nl
>>> new DNS lookup for 77.60.234.24.dynablock.easynet.nl
>>> DNS lookup for 77.60.234.24.dynablock.easynet.nl failed
>>> => that means 24.234.60.77 is not listed at dynablock.easynet.nl
>>> DNS list check: dialups.visi.com
>>> new DNS lookup for 77.60.234.24.dialups.visi.com
>>> DNS lookup for 77.60.234.24.dialups.visi.com failed
>>> => that means 24.234.60.77 is not listed at dialups.visi.com
>>> warn: condition test failed
>>> processing "warn"
>>> check dnslists = spews.relays.osirusoft.com
>>> DNS list check: spews.relays.osirusoft.com
>>> new DNS lookup for 77.60.234.24.spews.relays.osirusoft.com
>>> DNS lookup for 77.60.234.24.spews.relays.osirusoft.com failed
>>> => that means 24.234.60.77 is not listed at spews.relays.osirusoft.com
>>> warn: condition test failed

...
>>> calling lookuphost router
>>> 24.234.60.77 in "127.0.0.0/8 : 10.0.0.0/8 : 172.16.0.0/12 :

192.168.0.0/16"? no (end of list)
>>> routed by lookuphost router

...
250 Accepted

DNSBL testing seems to pass during SMTP testing, yet the log entry from
yesterday is bringing on some head scratching. I have since added more
verbose logging of these rejections using the $dnslist_ variables, but any
hints to what the problem might be would be greatly appreciated.


Jeffrey B. Green    Personal Computer Consultant - Las Vegas, Nevada
http://jbgreen.com    Networking Las Vegas Since 1986
ARS KC7PK        Linux, Windows and NetWare