Magnus Holmgren wrote:
> On Thursday 26 July 2007 18:17, Tom Ray [Lists] wrote:
>
>> Basically this is what I am getting in my log:
>>
>> 2007-07-26 11:57:45 lowest numbered MX record points to local host:
>> mymsviews.com (while verifying <odyl@???> from host
>> (mail.fcpp.org) [64.201.170.253])
>> 2007-07-26 11:57:45 H=(mail.fcpp.org) [64.201.170.253] F=<> temporarily
>> rejected RCPT <odyl@???>: lowest numbered MX record points to
>> local host
>>
>
> Is mymsviews.com your domain? Is 63.215.161.143 your IP address?
>
> What happens here probably is that Exim reaches a verify = recipient condition
> in the RCPT ACL, even though mymsviews.com is not recognised as a local
> domain, nor is the remote host allowed to relay. A correctly configured Exim
> would return a permanent "Relaying prohibited" error. (Those would still be
> logged, of course, unless you arrange to feed the repeat offender IPs to
> iptables or something.) We'll have to look at your ACLs and routers to
> determine the exact cause.
>
>
Well it's a domain I host, and the IP is my IP address.
Here's the ACL section, I would gladly accept any advice on how to make
it better. I've removed the standard EXIM comments for space.
acl_check_rcpt:
# Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
# testing for an empty sending host field.
accept hosts = :
deny message = Restricted characters in address
domains = +local_domains
local_parts = ^[.] : ^.*[@%!/|]
deny message = Restricted characters in address
domains = !+local_domains
local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
#############################################################################
# Accept mail to postmaster in any local domain, regardless of the source,
# and without verifying the sender.
accept local_parts = postmaster
domains = +local_domains
# Deny unless the sender address can be verified.
require verify = recipient
require verify = sender
#############################################################################
# There are no checks on DNS "black" lists because the domains that
contain
# these lists are changing all the time. However, here are two examples of
# how you could get Exim to perform a DNS black list lookup at this point.
# The first one denies, while the second just warns.
#
# deny message = rejected because $sender_host_address is in
a black list at $dnslist_domain\n$dnslist_text
# dnslists = black.list.example
drop message = Your mail system is listed at $dnslist_domain.
Good-bye.
dnslists = dnsbl.njabl.org:bl.spamcop.net:sbl-xbl.spamhaus.org
drop message = Host is denied in recipient-controlled access
list. Contact recipient for details.
hosts = partial-lsearch;/etc/exim/blocked-hosts
hosts = +include_unknown:partial-lsearch;/etc/exim/blocked-hosts
drop message = Address is in recipient-controlled access list.
Contact recipient for details.
senders = /etc/exim/blocked-senders
drop message = Host (24) is denied in recipient-controlled access
list. Contact recipient for details.
hosts = net24-lsearch;/etc/exim/blocked-hosts :
net-lsearch;/etc/exim/blocked-hosts
hosts = +include_unknown:net24-lsearch;/etc/exim/blocked-hosts
#
# warn message = X-Warning: $sender_host_address is in a
black list at $dnslist_domain
# log_message = found in $dnslist_domain
# dnslists = black.list.example
#############################################################################
# Accept if the address is in a local domain, but only if the
recipient can
# be verified. Otherwise deny. The "endpass" line is the border between
# passing on to the next ACL statement (if tests above it fail) or denying
# access (if tests below it fail).
accept domains = +local_domains
endpass
verify = recipient
# Accept if the address is in a domain for which we are relaying, but
again,
# only if the recipient can be verified.
accept domains = +relay_to_domains
endpass
verify = recipient
# If control reaches this point, the domain is neither in +local_domains
# nor in +relay_to_domains.
# Accept if the message comes from one of the hosts for which we are an
# outgoing relay. Recipient verification is omitted here, because in many
# cases the clients are dumb MUAs that don't cope well with SMTP error
# responses. If you are actually relaying out from MTAs, you should
probably
# add recipient verification here.
accept hosts = +relay_from_hosts
# Accept if the message arrived over an authenticated connection, from
# any host. Again, these messages are usually from MUAs, so recipient
# verification is omitted.
accept authenticated = *
# Reaching the end of the ACL causes a "deny", but we might as well give
# an explicit message.
deny message = relay not permitted
