[ctw] Re: Forged Helo's Blocked - Now invalid local sender

  • From: Tom Shaw <tshaw@xxxxxxxx>
  • To: ctw@xxxxxxxxxxxxx
  • Date: Wed, 27 May 2009 12:51:07 -0400

Do you have localDomains file populated? localDomains must contain your local domain names or else hel checking must be turned off.


At 11:47 AM -0400 5/27/09, Garret Cleversley wrote:
I did the update yesterday and afterwards saw a huge uptick in mail being classified as spam because of forged helo's.

May-27-09 10:51:56 128.205.5.208 <xxxx@xxxxxxxxxxx> MessageScore is now 25, after adding 25 (Extreme Bad History for 128.205.5.208) May-27-09 10:51:56 128.205.5.208 <xxxx@xxxxxxxxxxx> MessageScore is now 175, after adding 150 (forged Helo: 'localmailD.acsu.buffalo.edu') May-27-09 10:51:56 [ForgedHELO] 128.205.5.208 <xxxx@xxxxxxxxxxx> [spam found] (forced: forged Helo: 'localmailD.acsu.buffalo.edu')

I took another look at my prefs and all seems the same. The above is my MOM! so I need to figure out why she's getting blocked even though she's whitelisted.

Looking through the logs since the update I have tons of legitimate mail getting blocked now....

Everything was set to score and not out right block. I've turned it all off for now but obviously would like get it fixed.

I can send ASSP log if it helps..

I just turned off all helo settings then everything starting getting blocked with:

May-27-09 11:35:15 66.79.181.215 <adneta@xxxxxxxxxxxxxxxxxxxxx> MessageScore is now 20, after adding 20 (Invalid Local Sender 'adneta@xxxxxxxxxxxxxxxxxxxxx') May-27-09 11:35:15 [ForgedLocalSender] 66.79.181.215 <adneta@xxxxxxxxxxxxxxxxxxxxx> [spam found] (forced: Invalid Local Sender 'adneta@xxxxxxxxxxxxxxxxxxxxx')


I have put my server on test mode for now.

I double checked all local user lists, local domains etc.


Garret


Circle The Wagons
manage: //www.freelists.org/list/ctwpost: mailto:ctw@xxxxxxxxxxxxx
unsubscribe: mailto:ctw-request@xxxxxxxxxxxxx?subject=unsubscribe
search: //www.freelists.org/archives/ctw
faq: //www.freelists.org/wiki/the_faq


--
Tom Shaw - Chief Engineer, OITC
<tshaw at oitc.com>, http://www.oitc.com/ local wx: http://www.oitc.com/weather
US Phone Numbers: 321-984-3714, 321-729-6258(fax), 321-258-2475(cell/voice mail,pager)
Text Paging: http://www.oitc.com/Pager/sendmessage.html
AIM/iChat: trshaw@xxxxxxx

Fish more and Live longer
Circle The Wagons
manage: //www.freelists.org/list/ctw post: mailto:ctw@xxxxxxxxxxxxx
unsubscribe: mailto:ctw-request@xxxxxxxxxxxxx?subject=unsubscribe
search: //www.freelists.org/archives/ctw
faq: //www.freelists.org/wiki/the_faq

Other related posts: