On Mon, 26 Jul 2004, Bill Moseley wrote:
> Sorry to be running this into the ground, but just want to make sure
> there's not a bug in Exim that might be causing this.
I now worked out that the bug I was dimly remembering was in 4.31,
fixed in 4.32.
> Digging better into my logs I'm seeing a few failures from apache.org
> that include details of a SMTP callout rejection. All are "503 MAIL
> first":
>
> rejectlog.12.gz:2004-07-14 23:38:54 H=(minotaur.apache.org)
> [209.237.227.194] sender verify fail for
> <dev-return-8076-apmail-moseley=apache.org@???>:
> response to "HELO hank.org" from mail.apache.org [209.237.227.199]
> was: 503 MAIL first
Hmmm, we've got just one example of that symptom, in all the last ~ 10
weeks of archived logs. It wasn't apache.org, though.
2004-07-01 12:31:18 H=(manage.24online) [61.16.155.194] sender verify
fail for <DRLTYAQVZVM@???>: response to "HELO
othello.physics.gla.ac.uk" from m3.inbox.net [209.123.16.36] was: 503
MAIL first
and here's the related callout cache entry for the domain:
01-Jul-2004 12:30:49 geography.net callout=reject postmaster=unknown random=unknown
^^^^^^^^^^^^^^
Sounds as if that could fit the symptoms which you described, no?
As luck would have it, we've not had any subsequent mail offered with
an envelope-sender in /that/ domain that wasn't rejected for DNSrbl
or other reasons which are tested earlier than actually trying a
callout, but it's my hunch that it would reject such a callout on the
basis of that cached record, just as you had seen.
> But I have no detailed reject logs for the *specific* addresses that
> are failing
I did not get the impression that it was a problem with a specific
address; exim has somehow remembered that the *whole domain* responded
negatively to callout, and doesn't want to try again.
> I.e. I'm not seeing the original SMTP logging of the callout failure
I could believe that.
> even though Exim is reporting "result of an earlier callout reused".
But this leaves the question, where did it get the earlier result
from, if not from the callout cache database?
> The callout cache should be checking for exact addresses, not just
> domains, right?
The callout cache definitely *also* has a record for the domain
itself, as you see.
Interesting. Maybe these hints need timing-out or clearing-out more
aggressively.
