Tons of emails bouncing back

[EL34]

The last week or so I have seen lots of emails boucing back
All the rejected emails are from the same source
postmaster@iisn406.opentransfer.com  

I am not sure what this means or why it is happening
Maybe some of the web geeks will know

Note that I blanked out the @ in the emails below
Every one is different msn, gmail, comcast, etc
Some of the bouncees are new forum members that will not get their forum log in info


If you are not getting any emails, this may be why

Date: Sun, 11 Dec 2011 10:39:38 -0600
From: postmaster@iisn406.opentransfer.com  
▼
 Subject: Delivery Status Notification (Failure)
To: hoffmanamps@zzzzzzzzzzz.net  
▼
        
Body: Open Reporting-MTA: dns;iisn406.opentransfer.com
Arrival-Date: Sun, 11 Dec 2011 11:39:38 -0500

Final-Recipient: rfc822;preid@rci.zzzzzz.edu
Action: failed
Status: 5.7.1
Diagnostic-Code: smtp;550 5.7.1 Client host rejected: cannot find your hostname, [76.163.252.136]

Attachment: message.rfc822 (2k bytes) Open
  
Date: Sun, 11 Dec 2011 16:39:38 -0000
From: "Hoffman Amplifiers"
Subject: A new member has joined
To: <preid@rci.zzzzzzzzz.edu>

  
--------------------------------------------


Date: Sun, 11 Dec 2011 16:39:38 -0000
From: "Hoffman Amplifiers" <hoffmanamps@zzzzzzzzzzzzz.net>
Subject: A new member has joined
To: <seluckey@zzzzzz.net>


--------------------------------------------


Date: Sun, 11 Dec 2011 18:21:27 -0000
From: "Hoffman Amplifiers" <hoffmanamps@zzzzzzzzz.net>
Subject: Topic reply: Silvertone 1484 - Tremolo Chirping / ticking
To: <djlurie@zzzzzzzzz.net>

---------------------------------------------------------


This is an automatically generated Delivery Status Notification.

Unable to deliver message to the following recipients, due to being unable to connect successfully to the destination mail server.

       pbman1953@zzzzzzzz.com


--------------------------------------------------------------

This is an automatically generated Delivery Status Notification.

Unable to deliver message to the following recipients, due to being unable to connect successfully to the destination mail server.

       adamaj@zzzzzz.com
--------------------------------------------------------------------
This is an automatically generated Delivery Status Notification.

Unable to deliver message to the following recipients, due to being unable to connect successfully to the destination mail server.

       jallenshaw@zzzzzzzz.com


 

[LooseChange]

Anyone know why this is happening or how to fix??
Thanks!

[EL34]

I'll PM PRR and Steve
They are in those emails also

When I PM'd you, the email bounced back to me right away, so the only way to know if you have a PM is when you log into the forum

This just started about a week ago
I am getting all my emails from the forum just fine

[sluckey]

Date: Sun, 11 Dec 2011 16:39:38 -0000
From: "Hoffman Amplifiers" <hoffmanamps@zzzzzzzzzzzzz.net>
Subject: A new member has joined
To: <seluckey@zzzzzz.net>

I've had a filter set up on my mail server for years to trap these specific messages and send them to a "SPAM" folder within my in box. The messages were never bounced before. Xfinity is now handling my comcast email. I'll keep a watch and if I don't see any 'new members joined' messages, I'll disable the filter and test again. I really don't suspect this filter as the problem though.

[LooseChange]

I have xfinity too. Its not your folder.

[EL34]

Not sure I understand what is going on???

[DummyLoad]

some jack-ass spammer is using your domain as a reply to for their bulk mail bounces. there are ways to configure your mailer daemon to reject those messages.

i highly recommend iron port if you're running your own SMTP server.

--pete

[PRR]

> All the rejected emails are from the same source
postmaster@iisn406.opentransfer.com ?

This seems to be a part of your hosting company, IX Web Hosting ?

i.e. the forum sends, via the MTA which IX includes with their service, and that MTA is barfing-back.

I'm 99% sure the emails are NOT getting as far as my ISP's mailbox; because they take ANYthing which is properly registered in reverse-DNS and is not high-blacklisted. (You sould see summa the crap I get.)

It may well be mis-registration in DNS (a common thing among spam-hosts). "76.163.252.136  has host name: rev.opentransfer.com", not iisn406.opentransfer.com

I suggest you open a ticket with IX.

[PRR]

> some jack-ass spammer

No.

Like sluckey, I've been filtering the "new member" notes to trash, and emptied my trash yesterday, so I'm not sure... but I think those notes are no longer getting to me. Certainly Doug's PM notification did not come through.

> Diagnostic-Code: smtp;550 5.7.1 Client host rejected: cannot find your hostname, [76.163.252.136]

I do know my school, when an MTA tries to deliver, does some back-checking on the data in the SMTP protocol. In particular if the claimed hostname and reverse-DNS on the hostname do not match, the host is assumed bogus and the SMTP connection refused.

Rejected From:
Description: Incoming mail rejected because of incorrect "FROM" information.
This error occurs when source of the email is NOT properly configured and not following standard. Example having invalid DNS records.

This used to be a real problem with HotMail. They have 197 servers and every time one re-booted, it came up mis-configured.

Compliance simply means conforming to the RFCs.... but a lot of srver admins miss this detail.

Most MTAs do not do this check, which is why most are not bouncing.

I understand that implementing this check has made a BIG difference in the load on my school's SMTP machines. That there is a vast amount of spam sent from individual PCs direct to a destination, and such PCs don't generally know their own right hostname. Dropping them on sight saves a lot of time. 99+% of legitimate mail travels through correctly configured MTAs.

[EL34]

there are ways to configure your mailer daemon to reject those messages.
i highly recommend iron port if you're running your own SMTP server.

I don't run my own smtp server
The SMF forum software sends this stuff out to members
There's nothing I can confige that I know of
The SMF forum software just uses the stock SMTP server at 127.0.0.1

It's only 4 forum members out of 1000's on the forum?
So what's up with that?

I am not having any problems getting emails from the forum

Not sure I understand what to ask IX in a ticket?

 

[DummyLoad]

Rejected From:
Description: Incoming mail rejected because of incorrect "FROM" information.
This error occurs when source of the email is NOT properly configured and not following standard. Example having invalid DNS records.

yes, MTA should be configured to reject based on FQDN match in 'from' and 'reply-to' fields. mail should only be forwarded based on reverse look-up sanity of MTA as well. doesn't seem to be the case here.

based on your added input it does seem that doug's provider may have mis-configured their MTA and used dougs domain. in other words, (somebody) is pointing their MTA bounces at dougs MX records. i am assuming this. without full headers this is difficult to shoot trouble on.

doug, when you open a ticket with IX send them one of the message with full headers and tell them you are getting rejected bulk mail.

the origins of the IP PRR posted are:

[pete@hub ~]$ whois 76.163.252.136
[Querying whois.arin.net]
[whois.arin.net]
#
# Query terms are ambiguous.  The query is assumed to be:
#     "n 76.163.252.136"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=76.163.252.136?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       76.162.0.0 - 76.163.255.255
CIDR:           76.162.0.0/15
OriginAS:       
NetName:        ECOMMERCE-HOSTING
NetHandle:      NET-76-162-0-0-1
Parent:         NET-76-0-0-0-0
NetType:        Direct Allocation
RegDate:        2006-11-09
Updated:        2007-04-02
Ref:            http://whois.arin.net/rest/net/NET-76-162-0-0-1

OrgName:        Ecommerce Corporation
OrgId:          ECOMM-5
Address:        1774 Dividend Dr
City:           Columbus
StateProv:      OH
PostalCode:     43228
Country:        US
RegDate:        2006-11-06
Updated:        2011-05-24
Ref:            http://whois.arin.net/rest/org/ECOMM-5

OrgNOCHandle: HNI1-ARIN
OrgNOCName:   eCommerce NOC
OrgNOCPhone:  +1-614-534-1960
OrgNOCEmail:  ipadmin@ecommerce.com
OrgNOCRef:    http://whois.arin.net/rest/poc/HNI1-ARIN

*** snip ***


that IP has no DNS records associated:

[pete@hub ~]$ dig -t MX 76.163.252.136

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-16.P1.el5_7.1 <<>> -t MX 76.163.252.136
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 1592
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;76.163.252.136.                        IN      MX

;; AUTHORITY SECTION:
.                       10751   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2011121200 1800 900 604800 86400

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Dec 12 08:21:39 2011
;; MSG SIZE  rcvd: 107

[pete@hub ~]$ dig -t PTR 76.163.252.136

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-16.P1.el5_7.1 <<>> -t PTR 76.163.252.136
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 41928
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;76.163.252.136.                        IN      PTR

;; AUTHORITY SECTION:
.                       10733   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2011121200 1800 900 604800 86400

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Dec 12 08:21:57 2011
;; MSG SIZE  rcvd: 107

[pete@hub ~]$ dig -t A 76.163.252.136

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-16.P1.el5_7.1 <<>> -t A 76.163.252.136
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 7978
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;76.163.252.136.                        IN      A

;; AUTHORITY SECTION:
.                       10716   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2011121200 1800 900 604800 86400

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Dec 12 08:22:14 2011
;; MSG SIZE  rcvd: 107

[EL34]

I just created a ticket and sent them 3 of the messages zipped up
I'll let you know when I hear back from IX

I did find the settings in the forum that turns off emails to moderators when a new member joins
I doubt you guys want to receive those emails?

Steve, turn off your filter and see if it is working ok?

[DummyLoad]

great. let me know if i can assist in any way. this is what i do for a living - indirectly anyway.

on another topic. recently i was bequeathed some original marshall documentation (2 schematics & volt chart) that i scanned in at 600dpi. i bundled them - or rather my scanner did. if you'd like them, let me know... 2.8MB pdf. very nice and clear scans - you'll likely want them.

1959 lead mk II - july 1970
volt chart for above.
1987 lead mk II - july 1970

thanks,

--pete

[EL34]

Thanks, sure, send em

[PRR]

> turns off emails to moderators when a new member joins
> I doubt you guys want to receive those emails?

AFAIK, only _you_ approve new members. (I didn't realize I could.... I won't touch this without your guidance.) The NewMember emails are pointless to me. But easier to filter-off than to complain.

I have no new NewMember notes in my Trash; and if you've turn them off that makes sense.

As noted in PM, the "Send this topic" mechanism did work, and seems to follow the same path (forum software emails to localhost, IX has localhost configured to send to some email aggomerater chain, which finally delivers to external mail hosts). And the last IX host in the emails which go through is different from the last host in the ones which bounce.

============================

> assist in any way. this is what i do for a living

I knew you would be helpful; but "my" school email server does a filtering which makes-sense but is not all that common. I forget what RFC supports it, but I think there are now enuff clues to lead IX to the problem.

[EL34]

but I think there are now enuff clues to lead IX to the problem

They do have some good people, but sometimes you have to get the ticket kicked up a notch to reach them.
Nothing yet back from them, so they must have found something
They usually solve issues fairly rapidly and get right back to me

They have been very good to me and I now have at least 10 products with them
Web hostings, SSL, domain names, etc

Way better service than all the other hosting idiots I have dealt with in the past (including Go-Duty, I mean Daddy)

[PRR]

Status?

[EL34]

Have not heard back on my ticket
Forgot all about it today
Been setting up a new 6 core PC the last two days

I'll check on it in the morning

[EL34]

Got this reply just a bit ago
Unfortunately your issue appeared more complicated then expected. We are still investigating it and will be glad to get back to you with a resolution shortly. We count on your patience and understanding.

Please feel free to contact us if you need further assistance. We are available 24/7.

Respectfully,
Technical Department
Stepan Radibog

[EL34]

The reply I got back finally was not to use SMTP on the forum, use PHP mail.

I just switched it to PHP mail and sent myself and email

It came through ok

Let me know if the PHP mail is working ok for you

[EL34]

Someone send me a PM so I can see if the PHP mail setting is ok

[EL34]

Ok, got an email from Steve about his PM, so I am getting emails from the forum

Anyone else having email issues?

[PRR]

(as reported in PM) SEND THIS TOPIC seems to hang.

I hit the button top-right of thread, fill-in a recipient and comment, hit Send. Browser 'progress bar' (pretty meaningless) starts, stalls, browser tab has the spinning-wheel, for over 10 minutes. Watching email, nothing came. Maybe it's slow (I'll wait until bed) but I think it's stuck.

UPDATE: 30 minutes, 'progress bar' and wheelspin gone, still on the Send page, no email arrived.

UP-UPDATE: hour later, "Internet Explorer cannot display the webpage"

This did work 11 Dec 2011.

May be a different setting in SMF than the PM Notify setting.

[EL34]

Hmm, well I got 6 emails from the forum overnight about PM's and replies to a couple topics, so I know that all works fine.
And I am not getting those annoying mail returned emails

Not sure about the send topic thing PRR
There are no setting in the software about specific actions.

There is just a pull down box to choose PHP mail or SMTP
If you choose SMTP there are a few boxes you can fill out
I was using 127.0.0.1 SMTP, now I have selected PHP

[PRR]

> not to use SMTP on the forum, use PHP mail

Then look at php.ini

http://php.net/manual/en/mail.configuration.php

The default is to use localhost (127.0.0.1) and the local sendmail program. Assuming you do have sendmail (dubious if Windows-hosted), then it goes through SMTP same as before.

One difference: straight to SMTP apparently bounces came back to you. PHP logs errors itself, and the default is NULL.... you never see them. You might point mail.log to a real place and look at it.

IAC, IMHO, especially if only a "few" specific people are bounced or lost: the real problem is the host sending out of IX/ecommerce is mis-configured so its DNS does not point back to itself.

[EL34]

This is a winders server

[LooseChange]

Still no emails getting to me. No PM's and no notifications.

[PRR]

Specifically for the bounces off "my" school email server (and some others)-----

"Common DNS misconfigurations are outlined in RFC 1912.... "Make sure your PTR and A records match." Those ISPs that will not or cannot configure reverse DNS will generate problems for hosts on their networks..... From a technical perspective reverse DNS is trivial to implement correctly... ISPs that cannot or will not provide reverse DNS ultimately will be limiting the ability of their client base to use internet services ....."

Common DNS misconfigurations are outlined in RFC 1912, of particular note is section 2.1 that states, under the heading "Inconsistent, Missing or Bad Data", "Make sure your PTR and A records match." Those ISPs that will not or cannot configure reverse DNS will generate problems for hosts on their networks, by virtue of RFCs being contravened when communicating with hosts that do follow the RFC guidelines. From a technical perspective reverse DNS is trivial to implement correctly and there is no reason not to implement it for hosts providing regular internet services. ISPs that cannot or will not provide reverse DNS ultimately will be limiting the ability of their client base to use internet services they provide effectively and securely.

...zombie computers infected with spambots will not be able to fake the reverse DNS to make it match. ....thus this check is very effective in controlling spam, underwritten and justified by supporting RFCs.
http://en.wikipedia.org/wiki/Forward-confirmed_reverse_DNS

[EL34]

The forum is set now to use PHP mail now
Nothing is bouncing back to me here like it was with SMTP mail

No one else has said they are having problems getting emails

I don't know why you are Dan

If it was 100's of forum members I would say there is a problem, but originally with SMTP mail it was 4 guys

What PRR said is greek to me 

[LooseChange]

I've got the same setup as Sluckey. Comcast.net.
Sluckey, are you getting emails?

[sluckey]

Sluckey, are you getting emails?

No. And that's the way I want it.   

[PRR]

> No one else has said they are having problems getting emails

We would not know we were missing emails except in rare instances.

[EL34]

Subscribing to a topic is probably how most people would know something was up.

I got 4 emails over night from the forum
3 new members and replies to this post

On the comcast thing
I have been getting emails bounce back to me off and on from people for a couple years
Way before this recent thing here

Sending customers paypal totals or sales receipts, etc
Not sure what it is about comcast
The best one is when comcast says that the user does not exist and I know that is their correct email address

[PRR]

I got an email from the forum! (New Member admin note)

Oddity:

"RDNS_NONE" --- means that the IP number of the last "your" machine to touch the mail does not reverse-lookup to any host.

Oddity: I thought "my" machine refused mail from misconfigured hosts.

Received: (from mail@localhost)
    by smh04.opentransfer.com (8.13.8/8.13.8/Submit) id q2CHeB8c017564
    for {{me@server.edu}}; Mon, 12 Mar 2012 13:40:11 -0400
X-Authentication-Warning: smh04.opentransfer.com: mail set sender to postmaster@el34world.com using -f
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on     smh04.opentransfer.com
X-Spam-Level:
X-Spam-Status: No, score=0.1 required=5.0 tests=RDNS_NONE autolearn=disabled     version=3.2.5
Received: from helper400.opentransfer.com (unknown [98.130.0.253])
    by smh04.opentransfer.com (Postfix) with ESMTP id DFF692A80E83
    for <{{me@server.edu}}>; Mon, 12 Mar 2012 13:40:11 -0400 (EDT)
Received: from iisn406.opentransfer.com (unknown [10.10.10.80])
    by helper400.opentransfer.com (Postfix) with ESMTP id 0C3BC3680068
    for <{{me@server.edu}}>; Mon, 12 Mar 2012 13:38:59 -0400 (EDT)
   
Another oddity: the From isn't EL34world or opentransfer or IXwebhosting but an outfit that starts with "compori..."

Also: I thought you turned-off New Member notes for us staff?

Not odd: the "warning" that the sender was -f set (I assume that's how a mass-SMTP machine must handle multiple localhosts)

[EL34]

The email address for me admin on the forum is hoffmanamps at comnporium dot net

I could not turn off emails just to mods
When I turned off staff emails, it turned mine off also

[kagliostro]

Hi Doug

I've tried a couple of times to send you (as sometime I do) an email with some schematics for the database of the forum

I received this message and I don't know how to send you the schematics

- These recipients of your message have been processed by the mail server:
info2@el34world.com; Failed; 5.1.2 (bad destination system address)

 Remote MTA mail62.ixwebhosting.com: network error


 - SMTP protocol diagnostic: 554-ironport4.opentransfer.com\r\n554 Your
 access to this mail system has been rejected due to the sending MTA's
 IP 82.57.200.119 poor reputation. Please consult with
http://prod.senderbase.org/senderbase_queries/detailip?search_string=82.57.
200.119 for this block reasons. If you believe that this failure is in
 error, please contact the intended recipient via alternate means or
 contact with postmaster@opentransfer.com

Many thanks

Franco

[EL34]

I'll PM you with another email address