Skip site navigation (1)Skip section navigation (2) 
Date:      Sun, 14 Jan 2001 11:36:58 +0100
From:      "Leif Neland" <leifn@neland.dk>
To:        "Kal Torak" <kaltorak@quake.com.au>, =?Windows-1252?Q?Michael_Lyngb=F8l?= <michael@lyngbol.dk>
Cc:        "J & C Frazier" <admin@csocs.com>, <freebsd-isp@FreeBSD.ORG>
Subject:   Re: Problems with sendmail and NSI
Message-ID:  <004201c07e33$a3495d60$0e00a8c0@neland.dk>
References:  <3A60EE08.3C9CD7AF@csocs.com> <20010114100939.A81339@tigerdyr.lyngbol.dk> <3A61755C.DD1690A4@quake.com.au>
index | next in thread | previous in thread | raw e-mail 

[-- Attachment #1 --]
I don't recommend running dnsbl unattended.
I have created this awk-script, which I run every hour. It creates a webpage which list reason, server, sender and recipient for rejected messages.

BEGIN {OFS="|"};
/check_rcpt/ || /Check_Subject/ {
  gsub("<",""); 
  gsub(">,",""); 
  rcpt[$6]=substr($8,6);relay[$6]=substr($9,7);
  gsub("/"," ");
  reas=$(NF);
#  for (m=10;m<=NF;m++) {if ($(m)~"@") {$(m)="xxx";print $0,"<br>"} };
  n=index($0,"... ");
  reason1=substr($0,n+4);
  match(reason1," [^ ]+@[^ ]+ ");
  reason[$6]=reason1;
  if (RSTART) {
  reason[$6]=substr(reason1,1,RSTART) " " substr(reason1,RSTART+RLENGTH);
  }
  if ($0~"check MX") reason[$6]="Kan ikke kontrollere MX for modtageren";
  if ($7~"Subject") reason[$6]="I LOVE YOU";
}
$6 in rcpt && $7~"from=" {
  gsub("\+","-");gsub("<",""); gsub(">,","");
  fr=$7;gsub("@"," @ ",fr);
from[$6]=substr(fr,6);
print reason[$6],relay[$6],from[$6],rcpt[$6]>"/tmp/filter.tmp"}

END {
system("sort /tmp/filter.tmp|uniq -c >/tmp/filter.tmp2");
FS="|";
OFS="";
print "<html><head><title>Spamfilter</title>";
print "</head>";
print "<body bgcolor=\"#ffffcc\">";
print "<center><h1>Breve stoppet i spamfilter<br>"DAG"</h1></center>";
print "<table width=100% border=1><tr><th>Antal</th><th>Server</th><th>Afsender</th><th>Modtager</th></tr>";
while (getline<"/tmp/filter.tmp2">0)
{ ant=substr($1,1,8);newreason=substr($1,9);
  if (newreason!=oldreason) {oldreason=newreason;
p++;
print "<tr><th colspan=4 bgcolor=\"#",(p%2)?"ccaaaa":"aaccaa","\">";
if (newreason=="blocked.html") {print "Serveren er blokeret af ORBS fordi den videresender spam"}
else { 
  if (newreason=="rss") {print "Serveren er blokeret af mail-abuse.org fordi den videresender spam"}
  else {
    if (newreason=="rbl") {print "Serveren er blokeret af mail-abuse.org fordi den SELV sender spam"}
    else {
      if (newreason=="enduser.htm") {print "En fremmed modemopkobling m&aring; ikke sende post direkte"}
      else {
        if (newreason=="denied") {print "Relaying denied: Modtager er ikke kunde her, eller afsender benytter ikke vores modems"}
        else
          if (newreason=="exist") {print "Domainet findes ikke"}
          else {
            if (newreason=="resolve") {print "Domainet kan ikke sl&aring;s op"}
            else {
              print newreason
            }
          }
        }
      }
    }
  }
print "</th></tr>";
}

color=(p%2)?"ccaaaa":"aaccaa";
printf "<tr bgcolor=\"#%s\"><td align=right>%s</td><td>%s</td><td>%s</td><td>%s</td></tr>\n",color,ant,$2,$3,$4}

print "</table></body><html>"
}
      Antal Server Afsender Modtager 
      (orbs)Your mailserver is not allowed to send because it is an open spam-relay:call+45 33119898 ext 2 or see http: www.orbs.org blocked.html  
      1  hard.yesnet.net.au root @ hard.hornymail.net jvhansen@ 
      1  knut.kumoh.ac.kr FreeTV8 @ eagle.aegsp.br desitek@ 
      (rss)Your mailserver is not allowed to send to us because it is an open spam-relay;call+45 33119898 ext 2 or see http: mail-abuse.org rss  
      1  IDENT:root@[200.33.248.34], FreeTV2 @ eagle.aegsp.br autzen@ 
      1  IDENT:root@[211.100.6.56], info1 @ networkshosts.com bogus@ 
      1  [151.38.23.207], beckyhinds @ ozemail.com.au ingeman@ 
      1  [194.72.206.130], menchoal @ ecompare.com funnel@ 
      1  [210.121.58.77], 0085T1GyP @ mail.com oestergaard@ 
      1  [210.204.190.4], PleasureSex @ dicc.co.kr kemotron@ 
      1  [212.43.169.189], investor2210 @ hotmail.com bo-ren@ 
      1  ns.tran.co.jp dyzno @ ircnet.ee johnla@ 
      1  vistula.wis.pk.edu.pl bm21 @ prodigy.com humle@ 
      1  wpgateway.valleyhealth.org healthalert2001 @ yahoo.com ole_chr@ 
      Relaying denied  
      1  cm-206-128-72-145.coralsprings.ispchannel.com butch1 @ thedoghousemail.com jez@magic.powernet.co.uk 
      1  rsvp-208-187-113-223.ac07.rcrd.eli.net fruitcake @ a.mx.innet.be, internet6999@netzero.net 


Btw. all recievers on this list are expired users.
I have put all my expired users as SPAMHATER in access, because I run avpkeeper, and therfore
expired users are not rejected at reception, but after scanning. Then the sender is often long gone and unreachable.

----- Original Message ----- 
From: "Kal Torak" <kaltorak@quake.com.au>
To: "Michael Lyngbøl" <michael@lyngbol.dk>
Cc: "J & C Frazier" <admin@csocs.com>; <freebsd-isp@FreeBSD.ORG>
Sent: Sunday, January 14, 2001 10:46 AM
Subject: Re: Problems with sendmail and NSI


> Michael Lyngbøl wrote:
> > 
> > On Sat, Jan 13, 2001 at 05:08:40PM -0700, J & C Frazier wrote:
> > > I recently tried to make some domain modifications with Network
> > > Solutions.
> > > I complete the process successfully and it states it has sent the form
> > > to the
> > > e-mail address I've specified.  Unfortunately I don't get the mail.
> > 
> > Your're not using ORBS (relays.orbs.org) in your sendmail configuration?
> > 
> > I've had the same problem and found out that NSI was listen in ORBS.
> > 
> > /Michael
> 
> Personally I would recommend against orbs, since they are a little too
> pro-active when it comes to finding relays.. They will black list a server
> and never send mail to the server informing them of it or anything...

As far as I can see, theý send to postmaster@listed.dom and postmaster@server.listed.dom
They also list on their page if that message bounced.
As RFCsomething requires all domains to have a postmaster, if you don't you only have yourself to blame.
Also, the bounce messages should tell you why you are listed.



> 
> Also what orbs consider to be an open relay is not exactly what everyone
> else thinks one is, I wont go into any more details, but I think RBL is
> a better service, my personal experience is that orbs ends up blocking more
> legitimate mail than spam...
> 
orbs not only lists spam relays, it also lists spam sources.


[-- Attachment #2 --]
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<META content="MSHTML 5.50.4522.1800" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY>
<DIV><FONT face=Arial size=2>I don't recommend running dnsbl 
unattended.</FONT></DIV>
<DIV><FONT face=Arial size=2>I have created this awk-script, which I run every 
hour. It creates a webpage which list reason, server, sender and recipient for 
rejected messages.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV>BEGIN {OFS="|"};<BR>/check_rcpt/ || /Check_Subject/ {<BR>&nbsp; 
gsub("&lt;",""); <BR>&nbsp; gsub("&gt;,",""); <BR>&nbsp; 
rcpt[$6]=substr($8,6);relay[$6]=substr($9,7);<BR>&nbsp; gsub("/"," ");<BR>&nbsp; 
reas=$(NF);<BR>#&nbsp; for (m=10;m&lt;=NF;m++) {if ($(m)~"@") {$(m)="xxx";print 
$0,"&lt;br&gt;"} };<BR>&nbsp; n=index($0,"... ");<BR>&nbsp; 
reason1=substr($0,n+4);<BR>&nbsp; match(reason1," [^ ]+@[^ ]+ ");<BR>&nbsp; 
reason[$6]=reason1;<BR>&nbsp; if (RSTART) {<BR>&nbsp; 
reason[$6]=substr(reason1,1,RSTART) " " 
substr(reason1,RSTART+RLENGTH);<BR>&nbsp; }<BR>&nbsp; if ($0~"check MX") 
reason[$6]="Kan ikke kontrollere MX for modtageren";<BR>&nbsp; if ($7~"Subject") 
reason[$6]="I LOVE YOU";<BR>}<BR>$6 in rcpt &amp;&amp; $7~"from=" {<BR>&nbsp; 
gsub("\+","-");gsub("&lt;",""); gsub("&gt;,","");<BR>&nbsp; fr=$7;gsub("@"," @ 
",fr);<BR>from[$6]=substr(fr,6);<BR>print 
reason[$6],relay[$6],from[$6],rcpt[$6]&gt;"/tmp/filter.tmp"}<BR><BR>END 
{<BR>system("sort /tmp/filter.tmp|uniq -c 
&gt;/tmp/filter.tmp2");<BR>FS="|";<BR>OFS="";<BR>print 
"&lt;html&gt;&lt;head&gt;&lt;title&gt;Spamfilter&lt;/title&gt;";<BR>print 
"&lt;/head&gt;";<BR>print "&lt;body bgcolor=\"#ffffcc\"&gt;";<BR>print 
"&lt;center&gt;&lt;h1&gt;Breve stoppet i 
spamfilter&lt;br&gt;"DAG"&lt;/h1&gt;&lt;/center&gt;";<BR>print "&lt;table 
width=100% 
border=1&gt;&lt;tr&gt;&lt;th&gt;Antal&lt;/th&gt;&lt;th&gt;Server&lt;/th&gt;&lt;th&gt;Afsender&lt;/th&gt;&lt;th&gt;Modtager&lt;/th&gt;&lt;/tr&gt;";<BR>while 
(getline&lt;"/tmp/filter.tmp2"&gt;0)<BR>{ 
ant=substr($1,1,8);newreason=substr($1,9);<BR>&nbsp; if (newreason!=oldreason) 
{oldreason=newreason;<BR>p++;<BR>print "&lt;tr&gt;&lt;th colspan=4 
bgcolor=\"#",(p%2)?"ccaaaa":"aaccaa","\"&gt;";<BR>if (newreason=="blocked.html") 
{print "Serveren er blokeret af ORBS fordi den videresender spam"}<BR>else { 
<BR>&nbsp; if (newreason=="rss") {print "Serveren er blokeret af mail-abuse.org 
fordi den videresender spam"}<BR>&nbsp; else {<BR>&nbsp;&nbsp;&nbsp; if 
(newreason=="rbl") {print "Serveren er blokeret af mail-abuse.org fordi den SELV 
sender spam"}<BR>&nbsp;&nbsp;&nbsp; else {<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if 
(newreason=="enduser.htm") {print "En fremmed modemopkobling m&amp;aring; ikke 
sende post direkte"}<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; else 
{<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (newreason=="denied") {print 
"Relaying denied: Modtager er ikke kunde her, eller afsender benytter ikke vores 
modems"}<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
else<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if 
(newreason=="exist") {print "Domainet findes 
ikke"}<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; else 
{<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if 
(newreason=="resolve") {print "Domainet kan ikke sl&amp;aring;s 
op"}<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; else 
{<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
print 
newreason<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
}<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
}<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
}<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<BR>&nbsp;&nbsp;&nbsp; }<BR>&nbsp; 
}<BR>print 
"&lt;/th&gt;&lt;/tr&gt;";<BR>}<BR><BR>color=(p%2)?"ccaaaa":"aaccaa";<BR>printf 
"&lt;tr bgcolor=\"#%s\"&gt;&lt;td 
align=right&gt;%s&lt;/td&gt;&lt;td&gt;%s&lt;/td&gt;&lt;td&gt;%s&lt;/td&gt;&lt;td&gt;%s&lt;/td&gt;&lt;/tr&gt;\n",color,ant,$2,$3,$4}<BR><BR>print 
"&lt;/table&gt;&lt;/body&gt;&lt;html&gt;"<BR>}<BR>
<TABLE width="100%" border=1>
  <TBODY>
  <TR>
    <TH>Antal</TH>
    <TH>Server</TH>
    <TH>Afsender</TH>
    <TH>Modtager</TH></TR>
  <TR>
    <TH bgColor=#ccaaaa colSpan=4>(orbs)Your mailserver is not allowed to send 
      because it is an open spam-relay:call+45 33119898 ext 2 or see http: 
      www.orbs.org blocked.html </TH></TR>
  <TR bgColor=#ccaaaa>
    <TD align=right>1 </TD>
    <TD>hard.yesnet.net.au</TD>
    <TD>root @ hard.hornymail.net</TD>
    <TD>jvhansen@</TD></TR>
  <TR bgColor=#ccaaaa>
    <TD align=right>1 </TD>
    <TD>knut.kumoh.ac.kr</TD>
    <TD>FreeTV8 @ eagle.aegsp.br</TD>
    <TD>desitek@</TD></TR>
  <TR>
    <TH bgColor=#aaccaa colSpan=4>(rss)Your mailserver is not allowed to send 
      to us because it is an open spam-relay;call+45 33119898 ext 2 or see http: 
      mail-abuse.org rss </TH></TR>
  <TR bgColor=#aaccaa>
    <TD align=right>1 </TD>
    <TD>IDENT:root@[200.33.248.34],</TD>
    <TD>FreeTV2 @ eagle.aegsp.br</TD>
    <TD>autzen@</TD></TR>
  <TR bgColor=#aaccaa>
    <TD align=right>1 </TD>
    <TD>IDENT:root@[211.100.6.56],</TD>
    <TD>info1 @ networkshosts.com</TD>
    <TD>bogus@</TD></TR>
  <TR bgColor=#aaccaa>
    <TD align=right>1 </TD>
    <TD>[151.38.23.207],</TD>
    <TD>beckyhinds @ ozemail.com.au</TD>
    <TD>ingeman@</TD></TR>
  <TR bgColor=#aaccaa>
    <TD align=right>1 </TD>
    <TD>[194.72.206.130],</TD>
    <TD>menchoal @ ecompare.com</TD>
    <TD>funnel@</TD></TR>
  <TR bgColor=#aaccaa>
    <TD align=right>1 </TD>
    <TD>[210.121.58.77],</TD>
    <TD>0085T1GyP @ mail.com</TD>
    <TD>oestergaard@</TD></TR>
  <TR bgColor=#aaccaa>
    <TD align=right>1 </TD>
    <TD>[210.204.190.4],</TD>
    <TD>PleasureSex @ dicc.co.kr</TD>
    <TD>kemotron@</TD></TR>
  <TR bgColor=#aaccaa>
    <TD align=right>1 </TD>
    <TD>[212.43.169.189],</TD>
    <TD>investor2210 @ hotmail.com</TD>
    <TD>bo-ren@</TD></TR>
  <TR bgColor=#aaccaa>
    <TD align=right>1 </TD>
    <TD>ns.tran.co.jp</TD>
    <TD>dyzno @ ircnet.ee</TD>
    <TD>johnla@</TD></TR>
  <TR bgColor=#aaccaa>
    <TD align=right>1 </TD>
    <TD>vistula.wis.pk.edu.pl</TD>
    <TD>bm21 @ prodigy.com</TD>
    <TD>humle@</TD></TR>
  <TR bgColor=#aaccaa>
    <TD align=right>1 </TD>
    <TD>wpgateway.valleyhealth.org</TD>
    <TD>healthalert2001 @ yahoo.com</TD>
    <TD>ole_chr@</TD></TR>
  <TR>
    <TH bgColor=#ccaaaa colSpan=4>Relaying denied </TH></TR>
  <TR bgColor=#ccaaaa>
    <TD align=right>1 </TD>
    <TD>cm-206-128-72-145.coralsprings.ispchannel.com</TD>
    <TD>butch1 @ thedoghousemail.com</TD>
    <TD>jez@magic.powernet.co.uk</TD></TR>
  <TR bgColor=#ccaaaa>
    <TD align=right>1 </TD>
    <TD>rsvp-208-187-113-223.ac07.rcrd.eli.net</TD>
    <TD>fruitcake @ a.mx.innet.be,</TD>
    <TD>internet6999@netzero.net</TD></TR></TBODY></TABLE></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>Btw. all recievers on this list are expired 
users.</FONT></DIV>
<DIV><FONT face=Arial size=2>I have put all my expired users as SPAMHATER in 
access, because I run avpkeeper, and therfore</FONT></DIV>
<DIV><FONT face=Arial size=2>expired users are not rejected at reception, but 
after scanning. Then the sender is often long gone and unreachable.</FONT></DIV>
<DIV>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>----- Original Message ----- </FONT></DIV>
<DIV><FONT face=Arial size=2>From: "Kal Torak" &lt;</FONT><A 
href="mailto:kaltorak@quake.com.au"><FONT face=Arial 
size=2>kaltorak@quake.com.au</FONT></A><FONT face=Arial size=2>&gt;</FONT></DIV>
<DIV><FONT face=Arial size=2>To: "Michael Lyngbøl" &lt;</FONT><A 
href="mailto:michael@lyngbol.dk"><FONT face=Arial 
size=2>michael@lyngbol.dk</FONT></A><FONT face=Arial size=2>&gt;</FONT></DIV>
<DIV><FONT face=Arial size=2>Cc: "J &amp; C Frazier" &lt;</FONT><A 
href="mailto:admin@csocs.com"><FONT face=Arial 
size=2>admin@csocs.com</FONT></A><FONT face=Arial size=2>&gt;; &lt;</FONT><A 
href="mailto:freebsd-isp@FreeBSD.ORG"><FONT face=Arial 
size=2>freebsd-isp@FreeBSD.ORG</FONT></A><FONT face=Arial 
size=2>&gt;</FONT></DIV>
<DIV><FONT face=Arial size=2>Sent: Sunday, January 14, 2001 10:46 
AM</FONT></DIV>
<DIV><FONT face=Arial size=2>Subject: Re: Problems with sendmail and 
NSI</FONT></DIV>
<DIV><FONT face=Arial><BR><FONT size=2></FONT></FONT></DIV>
<DIV><FONT face=Arial size=2>&gt; Michael Lyngbøl wrote:<BR>&gt; &gt; <BR>&gt; 
&gt; On Sat, Jan 13, 2001 at 05:08:40PM -0700, J &amp; C Frazier wrote:<BR>&gt; 
&gt; &gt; I recently tried to make some domain modifications with 
Network<BR>&gt; &gt; &gt; Solutions.<BR>&gt; &gt; &gt; I complete the process 
successfully and it states it has sent the form<BR>&gt; &gt; &gt; to the<BR>&gt; 
&gt; &gt; e-mail address I've specified.&nbsp; Unfortunately I don't get the 
mail.<BR>&gt; &gt; <BR>&gt; &gt; Your're not using ORBS (relays.orbs.org) in 
your sendmail configuration?<BR>&gt; &gt; <BR>&gt; &gt; I've had the same 
problem and found out that NSI was listen in ORBS.<BR>&gt; &gt; <BR>&gt; &gt; 
/Michael<BR>&gt; <BR>&gt; Personally I would recommend against orbs, since they 
are a little too<BR>&gt; pro-active when it comes to finding relays.. They will 
black list a server<BR>&gt; and never send mail to the server informing them of 
it or anything...</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>As far as I can see, theý send to <A 
href="mailto:postmaster@listed.dom">postmaster@listed.dom</A> and <A 
href="mailto:postmaster@server.listed.dom">postmaster@server.listed.dom</A></FONT></DIV>
<DIV><FONT face=Arial size=2>They also list on their page if that message 
bounced.</FONT></DIV>
<DIV><FONT face=Arial size=2>As RFCsomething requires all domains to have a 
postmaster, if you don't you only have yourself to blame.</FONT></DIV>
<DIV><FONT face=Arial size=2>Also, the bounce messages should tell you why you 
are listed.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>&nbsp;</DIV>
<DIV><BR>&gt; <BR>&gt; Also what orbs consider to be an open relay is not 
exactly what everyone<BR>&gt; else thinks one is, I wont go into any more 
details, but I think RBL is<BR>&gt; a better service, my personal experience is 
that orbs ends up blocking more<BR>&gt; legitimate mail than spam...<BR>&gt; 
<BR>orbs not only lists spam relays, it also lists spam sources.</DIV>
<DIV></FONT>&nbsp;</DIV></BODY></HTML>
help

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?004201c07e33$a3495d60$0e00a8c0>