Koozali.org: home of the SME Server

mailfront black list log files

SSBN

mailfront black list log files
« on: August 05, 2003, 06:14:18 PM »
I have a few questions about mailfront black list blocking log files.
Emails that pass through look like this


@400000003f2a4de42ed35f94 tcpserver: status: 0/40
@400000003f2a4de62e985264 tcpserver: status: 1/40
@400000003f2a4de62e9c6174 tcpserver: pid 2311 from 24.230.193.170
@400000003f2a4de7311cb73c tcpserver: ok 2311 0:192.168.16.33:25 cpe0050bf0050b8-cm001095225ccb.cpe.net.cable.rogers.com:24.230.193.170::61240
@400000003f2a4de8185ca414 smtpfront-qmail[2311]: MAIL FROM:
@400000003f2a4de81f191cec smtpfront-qmail[2311]: RCPT TO:
@400000003f2a4de83116f2ac smtpfront-qmail[2311]: Accepted message qp 2312 bytes 955
@400000003f2a4de837d71504 smtpfront-qmail[2311]: bytes in: 895 bytes out: 181
@400000003f2a4de837da9774 tcpserver: end 2311 status 0

It all looks fine to me. But I want to find out what emals the blacklist are blocking. The only entreys I fine look like this.

@400000003f2a4d371b639e9c rblsmtpd: 68.74.221.95 pid 2289: 451 http://dsbl.org/listing?ip=68.74.221.95


and this

@400000003f2f81c5033ee114 rblsmtpd: 12.129.205.79 pid 11208: 451 http://www.spamhaus.org/SBL/sbl.lasso?query=SBL5535


What do these lines mean and are they blocked email. If so how do I tell what has bin blocked. If this isn’t blocked email what is and what should a blocked email look like.

Steve Bush

Re: mailfront black list log files
« Reply #1 on: August 06, 2003, 04:17:49 AM »
Each time an IP address from a RBL blocked server tries to send mail to your server, its connection is rejected.  The IP address along with a link to its entry in the RBL database is logged.

Simply copy the part of the line that starts with http into your browser and it will show you the reason the server was black listed.

Charlie Brady

Re: mailfront black list log files
« Reply #2 on: August 13, 2003, 09:19:50 PM »
Steve Bush wrote:

> Each time an IP address from a RBL blocked server tries to
> send mail to your server, its connection is rejected.  The IP
> address along with a link to its entry in the RBL database is
> logged.

And because the connection is rejected, no other information is available about the mail item that their server wished to send (i.e sender, recipient and content is all unknown).

Charlie