[cobalt-users] Re: RaQ3 Mail Delivery Problem

[Chae <chae@xxxxxxxxxxxx>]

Hi Yah,

Jale replied:

That was actually my first thought ... is there any possibility that the 
headers are being changed in the forward, just enough, that the ISP spam 
blockers are kicking in? Have you spoken to them to check their logs? I was 
not getting my domain renewals from Bulk Register because of my ISP's spam 
blocking - took 2 months to figure out.

The ISP is the largest in NZ and laughed when I asked them to check the 
logs - so I guess that ones out :(

Now the problem seems to be with any domain on the server :( I got their 
mailserver to do a test message to another domain set-up with email 
forwarding and nothing has been delivered. The issue has also taken on a 
wee twist...

Email from their bulk mailers hit the server but don't get processed or 
forwarded on:

Sep 23 15:46:27 ns sendmail[10396]: PAA10396: 
from=<C4842456083.989.2@xxxxxxxxxxxxxxxxxxxxxxxx>, size=2030, class=0, 
pri=32030, nrcpts=1, msgid=<200209230349.XAA05355@xxxxxxxxxxxxxxxxxxxxxxx>, 
proto=ESMTP, relay=hector.emailfactory.com [66.28.35.5]
Sep 23 15:13:49 ns sendmail[7858]: PAA07858: 
from=<C4236850283.989.2@xxxxxxxxxxxxxxxxxxxxxxxx>, size=2028, class=0, 
pri=32028, nrcpts=1, msgid=<200209230316.XAA17567@xxxxxxxxxxxxxxxxxxxxxxx>, 
proto=ESMTP, relay=hector.emailfactory.com [66.28.35.5]
Sep 23 14:37:05 ns sendmail[5218]: OAA05218: 
from=<C1203379283.989.2@xxxxxxxxxxxxxxxxxxxxxxxx>, size=2016, class=0, 
pri=32016, nrcpts=1, msgid=<200209230240.WAA29647@xxxxxxxxxxxxxxxxxxxxxxx>, 
proto=ESMTP, relay=hector.emailfactory.com [66.28.35.5]
Sep 23 13:46:02 ns sendmail[1794]: NAA01794: 
from=<C6320209883.989.2@xxxxxxxxxxxxxxxxxxxxxxxx>, size=1866, class=0, 
pri=31866, nrcpts=1, msgid=<200209230149.VAA22159@xxxxxxxxxxxxxxxxxxxxxxx>, 
proto=ESMTP, relay=hector.emailfactory.com [66.28.35.5]
Sep 23 13:46:03 ns sendmail[1809]: NAA01809: 
from=<C6320209883.989.2@xxxxxxxxxxxxxxxxxxxxxxxx>, size=1145, class=0, 
pri=31145, nrcpts=1, msgid=<200209230149.VAA22170@xxxxxxxxxxxxxxxxxxxxxxx>, 
proto=ESMTP, relay=hector.emailfactory.com [66.28.35.5]

But if the owner of the web site send an email to my customer it gets 
processed and forwarded as should be:

Sep 23 21:41:56 ns sendmail[32160]: VAA32160: from=<info@xxxxxxxxxxxxxxxx>, 
size=6776, class=0, pri=36776, nrcpts=1, 
msgid=<200209230941.VAA32160@xxxxxxxxxxxxxxxxxxxxxxx>, proto=ESMTP, 
relay=notch.newc.com [208.37.4.28]
Sep 23 21:42:21 ns mailscanner[20378]: Scanning 1 messages, 7276 bytes
Sep 23 21:42:25 ns mailscanner[20378]: Scanned 1 messages, 7276 bytes in 1 
seconds
Sep 23 21:42:29 ns sendmail[32185]: VAA32160: to=customersname@xxxxxxxxxx, 
delay=00:00:34, xdelay=00:00:03, mailer=esmtp, relay=mta.xtra.co.nz. 
[203.96.92.132], stat=Sent (Message received: 
20020923094227.DLVN13285.mta4-rme.xtra.co.nz@xxxxxxxxxxxxxxxxx)
Sep 23 21:42:31 ns sendmail[32188]: VAA32188: from=<info@xxxxxxxxxxxxxxxx>, 
size=1640, class=0, pri=31640, nrcpts=1, 
msgid=<200209230942.VAA32188@xxxxxxxxxxxxxxxxxxxxxxxxxx>, proto=ESMTP, 
relay=notch.newc.com [208.37.4.28]
Sep 23 21:42:55 ns mailscanner[20378]: Scanning 1 messages, 2137 bytes
Sep 23 21:42:57 ns mailscanner[20378]: Scanned 1 messages, 2137 bytes in 1 
seconds
Sep 23 21:43:00 ns sendmail[32213]: VAA32188: to=customersname@xxxxxxxxxx, 
delay=00:00:29, xdelay=00:00:02, mailer=esmtp, relay=mta.xtra.co.nz. 
[203.96.92.132], stat=Sent (Message received: 
20020923094259.DNTD21165.mta2-rme.xtra.co.nz@xxxxxxxxxxxxxxxxxxx)

Spoke to the owner of emailfactory and he says "...We are not able to check 
the logs because we don't use a standard mail server to send the email." 
"...It's a good bet that Spamassassin is the issue"

Now I'm not disabling SpamAssassin for the sake of this one account, so 
what I did was go into the mailscanner.conf and activated the SpamAssassin 
Auto Whitelist option then edited the SpamAssassin 60_whitelist.cf file to 
include the following different variations of the domain name and addresses 
they use:-

> # emailfactory.net bulk mailer
> whitelist_from  *@emailfactory.com
> whitelist_from  *@EmailFactory.com
> whitelist_from  *@EmailFactory.net
> whitelist_from  *@emailfactory.net
> whitelist_from *.emailfactory.net
> whitelist_from *.emailfactory.com
> whitelist_from *@service.EmailFactory.com

Stopped Mailscanner then restarted it again so that it would read both 
config's again, then stopped and restarted sendmail - and got them to send 
a test message again...

Sep 24 13:05:00 ns sendmail[27428]: NAA27428: 
from=<C698325683.989.2@xxxxxxxxxxxxxxxxxxxxxxxx>, size=2011, class=0, 
pri=32011, nrcpts=1, msgid=<200209240108.VAA24690@xxxxxxxxxxxxxxxxxxxxxxx>, 
proto=ESMTP, relay=hector.emailfactory.com [66.28.35.5]

Same story (sigh) it reaches the server but then either spamassassin kills 
it or sendmail doesn't want to forward it on.

Anyway any clues - this one's doing my wee head in :)

Regards

Chae