Byteplant Forum

Home » CleanMail Support » CleanMail Server Talk » Why is email blocked?
Why is email blocked? [message #2021] Wed, 12 August 2009 08:32 Go to next message
sd1401
Messages: 11
Registered: May 2006
Junior Member
Hi,

my USV client wants to send notification emails to my mail server. However, always if CleanMail gets the message, it is blocked.
If I disable CleanMail and set my mail server's SMTP directly to port 25, the email goes through and the server accepts it.
If CleanMail is on Port 25, the mail is not delivered and in the Log it says, that the message was "blocked".
I have added a whitelist filter such that the email will be accepted no matter what the other filters say, but even in this case, the mail will be blocked.
Here is an extract from the log:

Aug 12, 2009, 08:23:11 Session 0: Connection from ***.***.***.100 accepted on ***.***.***.107:25
Aug 12, 2009, 08:23:11 Session 0: X-CleanMail-MessageID: 4A825FCF00000000
Aug 12, 2009, 08:23:11 Session 0: (Spam Trap) No action
Aug 12, 2009, 08:23:11 Session 0: From: UPS@****.de
Aug 12, 2009, 08:23:11 Session 0: To: ****@*****.de
Aug 12, 2009, 08:23:11 Session 0: Subject: UPS : Self Test Passed
Aug 12, 2009, 08:23:11 Session 0: (Whitelist) Filter result is accept/deliver
Aug 12, 2009, 08:23:11 Session 0: Received end of data, mail size 1kB

You have any ideas what the reason could be?

Thanks,
sd1401

Re: Why is email blocked? [message #2022 is a reply to message #2021] Wed, 12 August 2009 08:44 Go to previous messageGo to next message
support
Messages: 918
Registered: April 2004
Senior Member
> my USV client wants to send notification emails to my mail
> server. However, always if CleanMail gets the message, it is
> blocked.
> If I disable CleanMail and set my mail server's SMTP directly
> to port 25, the email goes through and the server accepts it.
> If CleanMail is on Port 25, the mail is not delivered and in
> the Log it says, that the message was "blocked".
> I have added a whitelist filter such that the email will be
> accepted no matter what the other filters say, but even in this
> case, the mail will be blocked.
> Here is an extract from the log:
>
> Aug 12, 2009, 08:23:11 Session 0: Connection from
> ***.***.***.100 accepted on ***.***.***.107:25
> Aug 12, 2009, 08:23:11 Session 0: X-CleanMail-MessageID:
> 4A825FCF00000000
> Aug 12, 2009, 08:23:11 Session 0: (Spam Trap) No action
> Aug 12, 2009, 08:23:11 Session 0: From: UPS@****.de
> Aug 12, 2009, 08:23:11 Session 0: To: ****@*****.de
> Aug 12, 2009, 08:23:11 Session 0: Subject: UPS : Self Test
> Passed
> Aug 12, 2009, 08:23:11 Session 0: (Whitelist) Filter result is
> accept/deliver
> Aug 12, 2009, 08:23:11 Session 0: Received end of data, mail
> size 1kB

Please post the complete log of this session (ending with "connection closed" or something like that).



Customer Support
Byteplant GmbH
Re: Why is email blocked? [message #2023 is a reply to message #2022] Wed, 12 August 2009 11:58 Go to previous messageGo to next message
sd1401
Messages: 11
Registered: May 2006
Junior Member
Hi,
thanks for your answer.
Yes, sorry, the last lines I missed.
The complete log transcript of Session 0 is:


Aug 12, 2009, 08:23:11 Session 0: Connection from ***.***.***.100 accepted on ***.***.***.107:25
Aug 12, 2009, 08:23:11 Session 0: X-CleanMail-MessageID: 4A825FCF00000000
Aug 12, 2009, 08:23:11 Session 0: (Spam Trap) No action
Aug 12, 2009, 08:23:11 Session 0: From: UPS@****.de
Aug 12, 2009, 08:23:11 Session 0: To: ****@*****.de
Aug 12, 2009, 08:23:11 Session 0: Subject: UPS : Self Test Passed
Aug 12, 2009, 08:23:11 Session 0: (Whitelist) Filter result is accept/deliver
Aug 12, 2009, 08:23:11 Session 0: Received end of data, mail size 1kB
Aug 12, 2009, 08:23:21 Session 0: Connection closed by client
Aug 12, 2009, 08:23:21 Session 0: Incoming mail action: client disconnect/delete
Aug 12, 2009, 08:23:21 Session 0: Connection from ***.***.***.100 closed


I also tested with a freeware mail tool to send an email with the same properties (the UPS service sends without credentials and so on), and that worked. It seems that the UPS service is a bit impatient and disconnects after 10 seconds. However, I wonder why CleanMail needs a so long time for processing the Mail...?
Or are there also other causes for such a problem?

Thanks fpr reply!
sd1401
Re: Why is email blocked? [message #2024 is a reply to message #2022] Thu, 13 August 2009 09:59 Go to previous messageGo to next message
sd1401
Messages: 11
Registered: May 2006
Junior Member
Hi,

it's strange, my second post from yesterday doesn't show up here, therefore, I send it again:

I ommitted the last lines of the log, I'm sorry.
Unfortunately, today I haven't the log lines anymore, so I have to post the results from a new experiment, this time with extended logging:

Aug 13, 2009, 09:53:08 Session 0: Connection from ***.***.***.1 accepted on ***.***.***.107:25
Aug 13, 2009, 09:53:08 Session 0: 220 my-domain-here.de Microsoft ESMTP MAIL Service, Version: 6.0.3790.3959 ready at Thu, 13 Aug 2009 09:53:08 +0200
Aug 13, 2009, 09:53:08 Session 0: EHLO localhost
Aug 13, 2009, 09:53:08 Session 0: 250-my-domain-here.de Hello [127.0.0.1]
Aug 13, 2009, 09:53:08 Session 0: 250-TURN
Aug 13, 2009, 09:53:08 Session 0: 250-SIZE
Aug 13, 2009, 09:53:08 Session 0: 250-ETRN
Aug 13, 2009, 09:53:08 Session 0: 250-PIPELINING
Aug 13, 2009, 09:53:08 Session 0: 250-DSN
Aug 13, 2009, 09:53:08 Session 0: 250-ENHANCEDSTATUSCODES
Aug 13, 2009, 09:53:08 Session 0: 250-8bitmime
Aug 13, 2009, 09:53:08 Session 0: 250-VRFY
Aug 13, 2009, 09:53:08 Session 0: 250-AUTH GSSAPI NTLM LOGIN
Aug 13, 2009, 09:53:08 Session 0: 250-AUTH=LOGIN
Aug 13, 2009, 09:53:08 Session 0: 250 OK
Aug 13, 2009, 09:53:08 Session 0: MAIL FROM:
Aug 13, 2009, 09:53:08 Session 0: 250 2.1.0 UPS@other-domain-there.de....Sender OK
Aug 13, 2009, 09:53:08 Session 0: RCPT TO:
Aug 13, 2009, 09:53:08 Session 0: 250 2.1.5 the-user@my-domain-here.de
Aug 13, 2009, 09:53:08 Session 0: RCPT TO:
Aug 13, 2009, 09:53:08 Session 0: 250 2.1.5 postmaster@my-domain-here.de
Aug 13, 2009, 09:53:08 Session 0: DATA
Aug 13, 2009, 09:53:08 Session 0: X-CleanMail-MessageID: 4A83C66400000000
Aug 13, 2009, 09:53:08 Session 0: 354 Start mail input; end with .
Aug 13, 2009, 09:53:08 Session 0: (Spam Trap) No action
Aug 13, 2009, 09:53:08 Session 0: From: UPS@other-domain-there.de
Aug 13, 2009, 09:53:08 Session 0: To: the-user@my-domain-here.de
Aug 13, 2009, 09:53:08 Session 0: To: postmaster@my-domain-here.de
Aug 13, 2009, 09:53:08 Session 0: Subject: Self Test Initiated
Aug 13, 2009, 09:53:08 Session 0: (Whitelist) Filter result is accept/deliver
Aug 13, 2009, 09:53:09 Session 0: Received end of data, mail size 1kB
Aug 13, 2009, 09:53:09 Session 0: (Attachment Filter) Filter result is accept/deliver
Aug 13, 2009, 09:53:09 Session 0: (ClamWin Free Antivirus) Executing: C:\Programme\ClamWin\bin\clamscan.exe "C:\WINDOWS\TEMP\ClamWin0i.msg" --no-summary --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --tempdir="C:\Programme\ClamWin\tmp"
Aug 13, 2009, 09:53:19 Session 0: Connection closed by client
Aug 13, 2009, 09:53:19 Session 0: Incoming mail action: client disconnect/delete
Aug 13, 2009, 09:53:19 Session 0: Connection from ***.***.***.1 closed

Means "client disconnect", that the UPS service didn't wait for the end of the transaction? Note that it waited 10 seconds, and please note that the transmission of the mail works fine, if CleanMail is by-passed. So why delays CleanMail the transmission by 10 seconds although the white list filter says deliver? Or can there still be other causes for this problem?

Thanks for replies!

Regards,
sd1401

Re: Why is email blocked? [message #2138 is a reply to message #2021] Fri, 14 August 2009 13:07 Go to previous messageGo to next message
support
Messages: 918
Registered: April 2004
Senior Member
sd1401 wrote on Thu, 13 August 2009 09:59
Hi,
Means "client disconnect", that the UPS service didn't wait for the end of the transaction? Note that it waited 10 seconds, and please note that the transmission of the mail works fine, if CleanMail is by-passed. So why delays CleanMail the transmission by 10 seconds although the white list filter says deliver? Or can there still be other causes for this problem?



Yes, the UPS service is very impatient, the recommended SMTP timeout is in the range of 5 to 10 minutes, and 10s is not long enough.

Due to popular demand, whitelisting does not affect the AV filter and the attachment blocker, meaning that messages from whitelisted senders are virus-checked by default. You can change this behaviour by edition the CleanMail.cf file, the procedure is outlined in the manual. In one of the upcoming releases, we will add this configuration switch to the configuration dialog.

As you can be pretty sure that you want get spams our viruses from this source, it is safe to bypass CleanMail and send the messages to your SMTP server directly.


Customer Support
Byteplant GmbH
Re: Why is email blocked? [message #2141 is a reply to message #2138] Fri, 14 August 2009 13:23 Go to previous message
support
Messages: 918
Registered: April 2004
Senior Member
See here for online instructions to do this.

Customer Support
Byteplant GmbH
Previous Topic: Virus filter says it's SPAM!?
Next Topic: whitelist and external filters
Goto Forum:
  


Current Time: Tue Sep 27 14:07:13 CEST 2016