Print Page | Close Window

no forwarding

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6149
Printed Date: 02 April 2025 at 12:42am


Topic: no forwarding
Posted By: Vince
Subject: no forwarding
Date Posted: 17 July 2007 at 2:27pm

Hi, I have a problem with an email reception. As you see here, the number 12624 is accepted but never forwarding. The sender tries many times but always the same problem.  

v.3.5.4.692

07/10/07 18:14:46:765 -- (12624) Connection from: 66.235.211.153  -  Originating country : United States

07/10/07 18:14:51:578 -- (12624) - SPF analysis for mainehh.com done: - none

07/10/07 18:14:51:578 -- (12624) Mail from: john@mainehh.com

07/10/07 18:14:53:968 -- (12624) - MAPS search done...

07/10/07 18:14:53:968 -- (12624) RCPT TO: JRLADOUCEUR@BAINULTRA.COM accepted


Replies:
Posted By: Desperado
Date Posted: 17 July 2007 at 3:22pm

Vince,

You do not see anything like the below:

07/10/07 18:14:53::xxx -- (12624) Checking SURBL
07/10/07 18:14:53::xxx -- (12624) Start virus scan
07/10/07 18:14:53::xxx -- (12624) Starting queueing procedures
07/10/07 18:14:53::xxx -- (12624) EMail from mailto:john@mainehh.com - john@mainehh.com to mailto:JRLADOUCEUR@BAINULTRA.COM - JRLADOUCEUR@BAINULTRA.COM was queued. Size: 5 KB, 5120 bytes

07/10/07 18:14:53::xxx -- (12624) Sending email from mailto:john@mainehh.com - john@mainehh.com to mailto:JRLADOUCEUR@BAINULTRA.COM - JRLADOUCEUR@BAINULTRA.COM --

07/10/07 18:14:53::xxx -- (12624) Disconnect



-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Posted By: Vince
Date Posted: 17 July 2007 at 4:57pm

I only see what I post before. Here are more line in the logfile...

07/10/07 18:14:40:250 -- (10404) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
07/10/07 18:14:40:250 -- (10404) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
07/10/07 18:14:40:250 -- (10828) Blacklist cache - starting cleanup
07/10/07 18:14:40:265 -- (10828) Blacklist cache - removed IP 62.139.252.202 from cache during cleanup
07/10/07 18:14:44:921 -- (10692) Connection from: 83.4.90.220  -  Originating country : Poland
07/10/07 18:14:46:765 -- (12624) Connection from: 66.235.211.153  -  Originating country : United States
07/10/07 18:14:49:515 -- (10692) - IP address is from a blacklisted country...
07/10/07 18:14:49:531 -- (10692) 83.4.90.220 - Mail from: mailto:bwarestroom@compassinvest.net - bwarestroom@compassinvest.net To: mailto:wjetjqnqtucnb@bainsultra.com - wjetjqnqtucnb@bainsultra.com will be rejected
07/10/07 18:14:50:734 -- (10556) Connection from: 201.43.67.236  -  Originating country : Brazil
07/10/07 18:14:50:968 -- (10556) No Data Received
07/10/07 18:14:50:968 -- (10556) Disconnect
07/10/07 18:14:51:578 -- (12624) - SPF analysis for mainehh.com done: - none
07/10/07 18:14:51:578 -- (12624) Mail from: mailto:john@mainehh.com - john@mainehh.com
07/10/07 18:14:53:968 -- (12624) - MAPS search done...
07/10/07 18:14:53:968 -- (12624) RCPT TO: mailto:JRLADOUCEUR@BAINULTRA.COM - JRLADOUCEUR@BAINULTRA.COM accepted
07/10/07 18:14:56:593 -- (10692) Starting quarantine procedures
07/10/07 18:14:56:609 -- (10692) Created thread (10556) to add email to quarantine
07/10/07 18:14:57:046 -- (10556) EMail from mailto:bwarestroom@compassinvest.net - bwarestroom@compassinvest.net to mailto:wjetjqnqtucnb@bainsultra.com - wjetjqnqtucnb@bainsultra.com was received and quarantined. Size: 9 KB, 9216 bytes
07/10/07 18:14:59:937 -- (10692) Blacklist cache - Added 83.4.90.220 to limbo
07/10/07 18:15:00:125 -- (10692) SFDB - Added 83.4.90.220 - Response: Error=0
07/10/07 18:15:00:125 -- (10692) Disconnect
07/10/07 18:15:04:812 -- (10692) Connection from: 85.242.226.137  -  Originating country : Portugal
07/10/07 18:15:06:546 -- (10692) - IP address is from a blacklisted country...
07/10/07 18:15:06:546 -- (10692) 85.242.226.137 - Mail from: mailto:xpburr@yehey.com - xpburr@yehey.com To: mailto:duncan@bainsultra.com - duncan@bainsultra.com will be rejected
07/10/07 18:15:08:062 -- (10692) Starting quarantine procedures
07/10/07 18:15:08:078 -- (10692) Created thread (10556) to add email to quarantine
07/10/07 18:15:08:140 -- (10556) EMail from mailto:xpburr@yehey.com - xpburr@yehey.com to mailto:duncan@bainsultra.com - duncan@bainsultra.com was received and quarantined. Size: 4 KB, 4096 bytes
07/10/07 18:15:08:250 -- (10692) Blacklist cache - Added 85.242.226.137 to limbo
07/10/07 18:15:08:437 -- (10692) SFDB - Added 85.242.226.137 - Response: Error=0
07/10/07 18:15:08:437 -- (10692) Disconnect
07/10/07 18:15:40:265 -- (10556) Running TTerminateIdleThreads - SFTC=1 - SFFC=1
07/10/07 18:15:40:281 -- (10556) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=1
07/10/07 18:15:40:281 -- (10436) Blacklist cache - starting cleanup
07/10/07 18:15:40:296 -- (10436) Blacklist cache - removed IP 168.226.12.97 from cache during cleanup
07/10/07 18:15:40:296 -- (10436) Blacklist cache - removed IP 85.103.39.2 from limbo during cleanup
07/10/07 18:15:44:062 -- (10372) Connection from: 24.115.128.87  -  Originating country : United States
07/10/07 18:15:45:609 -- (10372) - SPF analysis for feedroom.com done: - none
07/10/07 18:15:45:609 -- (10372) Mail from: mailto:Derekguidancesyntheses@feedroom.com - Derekguidancesyntheses@feedroom.com
07/10/07 18:15:45:781 -- (10372) - MAPS search done... 521 The IP 24.115.128.87 is Blacklisted by bl.spamcop.net. Blocked - see http://www.spamcop.net/bl.shtml?24.115.128.87 - http://www.spamcop.net/bl.shtml?24.115.128.87 --
07/10/07 18:15:45:781 -- (10372) 24.115.128.87 - Mail from: mailto:Derekguidancesyntheses@feedroom.com - Derekguidancesyntheses@feedroom.com To: mailto:arenaud@bainsultra.com - arenaud@bainsultra.com will be rejected
07/10/07 18:15:46:437 -- (10372) Starting quarantine procedures
07/10/07 18:15:46:437 -- (10372) Created thread (10692) to add email to quarantine
07/10/07 18:15:46:562 -- (10692) EMail from mailto:Derekguidancesyntheses@feedroom.com - Derekguidancesyntheses@feedroom.com to mailto:arenaud@bainsultra.com - arenaud@bainsultra.com was received and quarantined. Size: 1 KB, 1024 bytes
07/10/07 18:15:46:875 -- (10372) Blacklist cache - Added 24.115.128.87 to limbo
07/10/07 18:15:47:062 -- (10372) SFDB - Added 24.115.128.87 - Response: Error=0
07/10/07 18:15:47:062 -- (10372) Disconnect
07/10/07 18:15:50:375 -- (10372) Connection from: 81.172.124.242  -  Originating country : Spain
07/10/07 18:15:55:671 -- (12624) Disconnect

Posted By: Desperado
Date Posted: 17 July 2007 at 5:16pm

Vince,

The last line:07/10/07 18:15:55:671 -- (12624) Disconnect
is very close to 60 seconds after the first connection line:
07/10/07 18:14:46:765 -- (12624) Connection from: 66.235.211.153  -  Originating country : United States.
Could the server you are forwarding to be timing out? Can you try the following in your INI File:
ReadTimeout=120
ReadTimeoutOutgoing=120

I may be barking up the wrong tree but ...



-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Posted By: LogSat
Date Posted: 17 July 2007 at 10:01pm
Vince,

Desperado should be correct. We received your log via FTP, and we came to the same explanation.

SpamFilter has a 60-second built-in timeout, and if no data is received during that time, the connection will be dropped.

It's possible for example, that there is a firewall/virus scanning software intercepting the email before SpamFilter (this can be on the receiving or the sender's end). The firewall/antivirus is intercepting all of the packets sent after the DATA command, and only after the whole email is processed, the firewall proceeds to forward the data to SpamFilter. Normally this was not a problem, but when large attachments arrived, and/or the internet connection is slow, the firewall could "stall" SpamFilter, while the attachment is being received. Since SpamFilter is not receiving any packets, after 60 seconds SpamFilter drops the connection thinking it is a spammer.


Increasing the ReadTimeout value in the SpamFilter.ini file to a higher value, like 120 or 300 seconds should solve the issue.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Print Page | Close Window