邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: 垃圾邮件问题 [打印本页]

作者: heieye104 时间: 2008-10-14 11:27
标题: 垃圾邮件问题
最近我发现有些服务器发过来的邮件无法收到，我加到白名单后也是收不到，不知道为什么？谁遇到过这样的问题

作者: heieye104 时间: 2008-10-14 11:36
这是万网发信过来的信息，spamhaus还失败了，别的邮件都没事

Mon 2008-10-13 09:43:07: Session 9588; child 3; thread 592
Mon 2008-10-13 09:43:04: 接受 SMTP 连接来自 [221.122.57.45:61849]
Mon 2008-10-13 09:43:04: Performing PTR lookup (45.57.122.221.IN-ADDR.ARPA)
Mon 2008-10-13 09:43:04: *  D=45.57.122.221.IN-ADDR.ARPA TTL=(1440) PTR=[mx.hichina.com]
Mon 2008-10-13 09:43:04: *  Gathering A records...
Mon 2008-10-13 09:43:04: *  D=mx.hichina.com TTL=(5) A=[221.122.57.45]
Mon 2008-10-13 09:43:04: ---- End PTR results
Mon 2008-10-13 09:43:04: --> 220 mail.abc.com ESMTP MDaemon 9.6.4; Mon, 13 Oct 2008 09:43:04 +0800
Mon 2008-10-13 09:43:04: <-- EHLO mx.hichina.com
Mon 2008-10-13 09:43:04: Performing IP lookup (mx.hichina.com)
Mon 2008-10-13 09:43:04: *  D=mx.hichina.com TTL=(5) A=[221.122.57.45]
Mon 2008-10-13 09:43:04: ---- End IP lookup results
Mon 2008-10-13 09:43:04: --> 250-mail.abc.com Hello mx.hichina.com, pleased to meet you
Mon 2008-10-13 09:43:04: --> 250-ETRN
Mon 2008-10-13 09:43:04: --> 250-AUTH=LOGIN
Mon 2008-10-13 09:43:04: --> 250-AUTH LOGIN CRAM-MD5
Mon 2008-10-13 09:43:04: --> 250-8BITMIME
Mon 2008-10-13 09:43:04: --> 250 SIZE 0
Mon 2008-10-13 09:43:04: <-- MAIL FROM:
Mon 2008-10-13 09:43:04: Performing IP lookup (hichina.com)
Mon 2008-10-13 09:43:04: *  D=hichina.com TTL=(10) A=[121.199.253.130]
Mon 2008-10-13 09:43:04: *  P=010 S=001 D=hichina.com TTL=(5) MX=[mx.hichina.com]
Mon 2008-10-13 09:43:04: *  P=020 S=000 D=hichina.com TTL=(5) MX=[mxrelay.hichina.com]
Mon 2008-10-13 09:43:04: *  D=hichina.com TTL=(10) A=[121.199.253.130]
Mon 2008-10-13 09:43:04: *  D=hichina.com TTL=(10) A=[121.199.253.130]
Mon 2008-10-13 09:43:04: ---- End IP lookup results
Mon 2008-10-13 09:43:04: Performing SPF lookup (hichina.com / 221.122.57.45)
Mon 2008-10-13 09:43:04: *  Result: none; no SPF record in DNS
Mon 2008-10-13 09:43:04: ---- End SPF results
Mon 2008-10-13 09:43:04: --> 250 , Sender ok
Mon 2008-10-13 09:43:04: <-- RCPT TO:
Mon 2008-10-13 09:43:04: 执行 DNS-BL 查询（221.122.57.45 - 正在连接 IP）
Mon 2008-10-13 09:43:05: *  zen.spamhaus.org，spamhaus 列出的 $IP$，请参见http://www.spamhaus.org - 失败
Mon 2008-10-13 09:43:05: ---- 结束 DNS-BL 结果
Mon 2008-10-13 09:43:05: --> 250 , Recipient ok
Mon 2008-10-13 09:43:05: <-- DATA
Mon 2008-10-13 09:43:05: Creating temp file (SMTP): d:\mdaemon\queues\temp\md50000020298.tmp
Mon 2008-10-13 09:43:05: --> 354 Enter mail, end with .
Mon 2008-10-13 09:43:05: Message size: 6210 bytes
Mon 2008-10-13 09:43:05: Performing DKIM lookup
Mon 2008-10-13 09:43:05: *  File: d:\mdaemon\queues\temp\md50000020298.tmp
Mon 2008-10-13 09:43:05: *  Message-ID: 013b01c92cd4$7dca5230$5f040a0a@ID0495
Mon 2008-10-13 09:43:05: *  Result: neutral
Mon 2008-10-13 09:43:05: ---- End DKIM results
Mon 2008-10-13 09:43:05: Performing DomainKeys lookup (Sender: yangfan1@hichina.com)
Mon 2008-10-13 09:43:05: *  File: d:\mdaemon\queues\temp\md50000020298.tmp
Mon 2008-10-13 09:43:05: *  Message-ID: 013b01c92cd4$7dca5230$5f040a0a@ID0495
Mon 2008-10-13 09:43:05: *  Querying for policy: hichina.com
Mon 2008-10-13 09:43:05: * Querying: _domainkey.hichina.com ...
Mon 2008-10-13 09:43:05: * DNS: *  名称服务器报告未知的域名
Mon 2008-10-13 09:43:05: *  Result: neutral
Mon 2008-10-13 09:43:05: ---- End DomainKeys results
Mon 2008-10-13 09:43:05: Passing message through AntiVirus (Size: 6210)...
Mon 2008-10-13 09:43:05: *  例外列表里的收件人或发件人
Mon 2008-10-13 09:43:05: ---- End AntiVirus results
Mon 2008-10-13 09:43:05: Passing message through Outbreak Protection...
Mon 2008-10-13 09:43:05: *  Message-ID: 013b01c92cd4$7dca5230$5f040a0a@ID0495
Mon 2008-10-13 09:43:05: *  Reference-ID: str=0001.0A150201.48F2A7AA.008C:SCFSTAT1542605,ss=1,fgs=0
Mon 2008-10-13 09:43:05: *  Virus result: 0 - Clean
Mon 2008-10-13 09:43:05: *  Spam result: 1 - Clean
Mon 2008-10-13 09:43:05: *  IWF result: 0 - Clean
Mon 2008-10-13 09:43:05: ---- End Outbreak Protection results
Mon 2008-10-13 09:43:05: Passing message through Spam Filter (Size: 6210)...
Mon 2008-10-13 09:43:07: *  3.0 MDAEMON_DNSBL MDaemon: marked by MDaemon's DNSBL
Mon 2008-10-13 09:43:07: *  1.6 HEAD_ILLEGAL_CHARS Headers have too many raw illegal characters
Mon 2008-10-13 09:43:07: *  0.3 CN_BODY_494 BODY: Body contains "尊敬的"
Mon 2008-10-13 09:43:07: *  0.3 CN_BODY_375 BODY: Body contains "会员"
Mon 2008-10-13 09:43:07: *  0.1 CN_BODY_130 BODY: Body contains "您的"
Mon 2008-10-13 09:43:07: *  0.7 CN_BODY_129 BODY: Body contains "联系电话"
Mon 2008-10-13 09:43:07: *  0.0 CN_BODY_63 BODY: Body contains "地址"
Mon 2008-10-13 09:43:07: *  1.6 CN_BODY_342 BODY: Body contains "您好"
Mon 2008-10-13 09:43:07: *  0.2 CN_BODY_48 BODY: Body contains "邮件"
Mon 2008-10-13 09:43:07: *  0.5 CN_BODY_169 BODY: Body contains "热线"
Mon 2008-10-13 09:43:07: *  0.0 HTML_MESSAGE BODY: HTML included in message
Mon 2008-10-13 09:43:07: *  0.2 HTML_FONT_FACE_BAD BODY: HTML font face is not a word
Mon 2008-10-13 09:43:07: * 10 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
Mon 2008-10-13 09:43:07: *    [score: 1.0000]
Mon 2008-10-13 09:43:07: *  0.2 MIME_BASE64_NO_NAME RAW: base64 attachment does not have a file name
Mon 2008-10-13 09:43:07: *  1.9 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding
Mon 2008-10-13 09:43:07: *  8.0 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
Mon 2008-10-13 09:43:07: *    [URIs: www.net.cn www.com.cn]
Mon 2008-10-13 09:43:07: *  3.0 URIBL_BLACK Contains a URL listed in the URIBL.com blacklist
Mon 2008-10-13 09:43:07: *    [URIs: www.net.cn www.com.cn]
Mon 2008-10-13 09:43:07: *  8.0 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
Mon 2008-10-13 09:43:07: *    [URIs: www.net.cn www.com.cn]
Mon 2008-10-13 09:43:07: ---- End SpamAssassin results
Mon 2008-10-13 09:43:07: Spam Filter score/req: 39.70/12.0
Mon 2008-10-13 09:43:07: Message refused because spam score is too high
Mon 2008-10-13 09:43:07: --> 554 Sorry, message looks like SPAM to me
Mon 2008-10-13 09:43:07: <-- QUIT
Mon 2008-10-13 09:43:07: --> 221 See ya in cyberspace
Mon 2008-10-13 09:43:07: SMTP 会话终止（in/out 字节： 6315/412）

作者: wxhsh 时间: 2008-10-14 11:52
标题: 回复 2楼 heieye104 的帖子
http://www.5dmail.net/bbs/thread-178803-1-1.html

作者: heieye104 时间: 2008-10-14 11:57
我的不是所有的都误判，只有万网的这个

作者: wxhsh 时间: 2008-10-14 12:03
标题: 回复 4楼 heieye104 的帖子
主要是它的邮件太象垃圾邮件了，贝叶斯都有10分了，又没有FROM头，所以白名单无效，只有加到信任主机里了。

作者: heieye104 时间: 2008-10-14 15:00
都加了，但MD好像没什么反应，把他们解析出来的几个MX记录的IP都加入了

作者: wxhsh 时间: 2008-10-14 15:02
标题: 回复 6楼 heieye104 的帖子
是加的221.122.57.45这个IP吗？

作者: heieye104 时间: 2008-10-14 15:19
对 221.122.57.45

作者: heieye104 时间: 2008-10-14 15:20
我把中文过滤规则也去掉了，还见不到他们的信，见鬼了

作者: wxhsh 时间: 2008-10-14 15:27
标题: 回复 9楼 heieye104 的帖子
中文没几分的，反正只要经SA，就过不了。应该可以跳过的吧，你加在哪里的？

作者: heieye104 时间: 2008-10-14 15:30
信任主机里
垃圾邮件过滤里
DNS白名单

作者: wxhsh 时间: 2008-10-14 15:38
标题: 回复 11楼 heieye104 的帖子
这么强，能否贴下现在的日志

作者: heieye104 时间: 2008-10-14 15:46
Tue 2008-10-14 15:09:39: Session 4523; child 11; thread 3432
Tue 2008-10-14 15:09:36: 接受 SMTP 连接来自 [218.30.103.139:43599]
Tue 2008-10-14 15:09:36: Performing PTR lookup (139.103.30.218.IN-ADDR.ARPA)
Tue 2008-10-14 15:09:36: *  D=139.103.30.218.IN-ADDR.ARPA TTL=(502) PTR=[gate.hichina.com]
Tue 2008-10-14 15:09:36: *  Gathering A records...
Tue 2008-10-14 15:09:36: *  D=gate.hichina.com TTL=(10) A=[218.30.103.139]
Tue 2008-10-14 15:09:36: ---- End PTR results
Tue 2008-10-14 15:09:36: --> 220 mail.abc.com ESMTP MDaemon 9.6.4; Tue, 14 Oct 2008 15:09:36 +0800
Tue 2008-10-14 15:09:36: <-- EHLO gate.hichina.com
Tue 2008-10-14 15:09:36: Performing IP lookup (gate.hichina.com)
Tue 2008-10-14 15:09:36: *  D=gate.hichina.com TTL=(10) A=[218.30.103.139]
Tue 2008-10-14 15:09:36: ---- End IP lookup results
Tue 2008-10-14 15:09:36: --> 250-mail.abc.com Hello gate.hichina.com, pleased to meet you
Tue 2008-10-14 15:09:36: --> 250-ETRN
Tue 2008-10-14 15:09:36: --> 250-AUTH=LOGIN
Tue 2008-10-14 15:09:36: --> 250-AUTH LOGIN CRAM-MD5
Tue 2008-10-14 15:09:36: --> 250-8BITMIME
Tue 2008-10-14 15:09:36: --> 250 SIZE 0
Tue 2008-10-14 15:09:36: <-- MAIL From:<sales@hichina.com> SIZE=3875 BODY=8BITMIME
Tue 2008-10-14 15:09:36: Performing IP lookup (hichina.com)
Tue 2008-10-14 15:09:37: *  D=hichina.com TTL=(10) A=[121.199.253.130]
Tue 2008-10-14 15:09:37: *  P=010 S=001 D=hichina.com TTL=(1) MX=[mx.hichina.com]
Tue 2008-10-14 15:09:37: *  P=020 S=000 D=hichina.com TTL=(1) MX=[mxrelay.hichina.com]
Tue 2008-10-14 15:09:37: *  D=hichina.com TTL=(10) A=[121.199.253.130]
Tue 2008-10-14 15:09:37: *  D=hichina.com TTL=(10) A=[121.199.253.130]
Tue 2008-10-14 15:09:37: ---- End IP lookup results
Tue 2008-10-14 15:09:37: Performing SPF lookup (hichina.com / 218.30.103.139)
Tue 2008-10-14 15:09:37: *  Result: none; no SPF record in DNS
Tue 2008-10-14 15:09:37: ---- End SPF results
Tue 2008-10-14 15:09:37: --> 250 <sales@hichina.com>, Sender ok
Tue 2008-10-14 15:09:37: <-- RCPT To:<liyong@abc.com>
Tue 2008-10-14 15:09:37: 执行 DNS-BL 查询（218.30.103.139 - 正在连接 IP）
Tue 2008-10-14 15:09:37: *  zen.spamhaus.org，spamhaus 列出的 $IP$，请参见http://www.spamhaus.org - 失败
Tue 2008-10-14 15:09:37: ---- 结束 DNS-BL 结果
Tue 2008-10-14 15:09:37: --> 250 <liyong@abc.com>, Recipient ok
Tue 2008-10-14 15:09:37: <-- DATA
Tue 2008-10-14 15:09:37: Creating temp file (SMTP): d:\mdaemon\queues\temp\md50000016736.tmp
Tue 2008-10-14 15:09:37: --> 354 Enter mail, end with <CRLF>.<CRLF>
Tue 2008-10-14 15:09:37: Message size: 4193 bytes
Tue 2008-10-14 15:09:37: Performing DKIM lookup
Tue 2008-10-14 15:09:37: *  File: d:\mdaemon\queues\temp\md50000016736.tmp
Tue 2008-10-14 15:09:37: *  Message-ID: 200810140708.m9E78tLv008506@gate.hichina.com
Tue 2008-10-14 15:09:37: *  Result: neutral
Tue 2008-10-14 15:09:37: ---- End DKIM results
Tue 2008-10-14 15:09:37: Performing DomainKeys lookup (Sender: sales@hichina.com)
Tue 2008-10-14 15:09:37: *  File: d:\mdaemon\queues\temp\md50000016736.tmp
Tue 2008-10-14 15:09:37: *  Message-ID: 200810140708.m9E78tLv008506@gate.hichina.com
Tue 2008-10-14 15:09:37: *  Querying for policy: hichina.com
Tue 2008-10-14 15:09:37: * Querying: _domainkey.hichina.com ...
Tue 2008-10-14 15:09:37: * DNS: *  名称服务器报告未知的域名
Tue 2008-10-14 15:09:37: *  Result: neutral
Tue 2008-10-14 15:09:37: ---- End DomainKeys results
Tue 2008-10-14 15:09:37: Passing message through AntiVirus (Size: 4193)...
Tue 2008-10-14 15:09:37: *  例外列表里的收件人或发件人
Tue 2008-10-14 15:09:37: ---- End AntiVirus results
Tue 2008-10-14 15:09:37: Passing message through Outbreak Protection...
Tue 2008-10-14 15:09:37: *  Message-ID: 200810140708.m9E78tLv008506@gate.hichina.com
Tue 2008-10-14 15:09:37: *  Reference-ID: str=0001.0A150204.48F445B4.0011,ss=1,fgs=0
Tue 2008-10-14 15:09:37: *  Virus result: 0 - Clean
Tue 2008-10-14 15:09:37: *  Spam result: 1 - Clean
Tue 2008-10-14 15:09:37: *  IWF result: 0 - Clean
Tue 2008-10-14 15:09:37: ---- End Outbreak Protection results
Tue 2008-10-14 15:09:37: Passing message through Spam Filter (Size: 4193)...
Tue 2008-10-14 15:09:38: *  0.4 X_PRIORITY_HIGH Sent with 'X-Priority' set to high
Tue 2008-10-14 15:09:38: *  3.0 MDAEMON_DNSBL MDaemon: marked by MDaemon's DNSBL
Tue 2008-10-14 15:09:38: *  4.1 FROM_ILLEGAL_CHARS From: has too many raw illegal characters
Tue 2008-10-14 15:09:38: *  4.3 SUBJ_ILLEGAL_CHARS Subject: has too many raw illegal characters
Tue 2008-10-14 15:09:38: *  1.6 HEAD_ILLEGAL_CHARS Headers have too many raw illegal characters
Tue 2008-10-14 15:09:38: *  0.1 HTML_50_60 BODY: Message is 50% to 60% HTML
Tue 2008-10-14 15:09:38: *  1.9 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words
Tue 2008-10-14 15:09:38: *  1.8 HTML_OBFUSCATE_10_20 BODY: Message is 10% to 20% HTML obfuscation
Tue 2008-10-14 15:09:38: *  0.0 HTML_MESSAGE BODY: HTML included in message
Tue 2008-10-14 15:09:38: * 10 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
Tue 2008-10-14 15:09:38: *    [score: 1.0000]
Tue 2008-10-14 15:09:38: *  0.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
Tue 2008-10-14 15:09:38: *  0.2 MIME_BASE64_NO_NAME RAW: base64 attachment does not have a file name
Tue 2008-10-14 15:09:38: *  1.9 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding
Tue 2008-10-14 15:09:38: *  0.2 MIME_BASE64_BLANKS RAW: Extra blank lines in base64 encoding
Tue 2008-10-14 15:09:38: *  3.0 URIBL_BLACK Contains a URL listed in the URIBL.com blacklist
Tue 2008-10-14 15:09:38: *    [URIs: eachnic.com www.net.cn www.com.cn]
Tue 2008-10-14 15:09:38: [hichina.com]
Tue 2008-10-14 15:09:38: *  1.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Tue 2008-10-14 15:09:38: *  1.6 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
Tue 2008-10-14 15:09:38: ---- End SpamAssassin results
Tue 2008-10-14 15:09:38: Spam Filter score/req: 35.30/12.0
Tue 2008-10-14 15:09:38: Message refused because spam score is too high
Tue 2008-10-14 15:09:38: --> 554 Sorry, message looks like SPAM to me
Tue 2008-10-14 15:09:39: <-- QUIT
Tue 2008-10-14 15:09:39: --> 221 See ya in cyberspace

作者: wxhsh 时间: 2008-10-14 15:48
标题: 回复 13楼 heieye104 的帖子
对方的发邮件IP太多，现在又是218.30.103.139 了。。。。。。

作者: wxhsh 时间: 2008-10-14 15:50
标题: 回复 14楼 wxhsh 的帖子
不过这个信里有from，白名单加*@hichina.com应该有效的吧。

作者: heieye104 时间: 2008-10-14 15:53
这是要他们手动发的信，我白名单加*@hichina.com 应该是有效的，加完后我还重启了MD，不服不行了

作者: wxhsh 时间: 2008-10-14 15:55
标题: 回复 16楼 heieye104 的帖子
对方自动发的程序写的不好，我一般都定义FROM的。

作者: heieye104 时间: 2008-10-14 16:00
呵，问题是手动的也给挡了，气人呀，换人了，我得找回万网ID密码，这样太不安全了

作者: wxhsh 时间: 2008-10-14 16:03
标题: 回复 18楼 heieye104 的帖子
另外有个小问题，其实是MD的BUG，它DNS黑名单两行并一行了，你把原来删了，手动再加下吧。

作者: heieye104 时间: 2008-10-14 16:15
标题: 回复 19楼 wxhsh 的帖子
删了重建还在一行

作者: wxhsh 时间: 2008-10-14 16:16
标题: 回复 20楼 heieye104 的帖子
显示是在一行，但实际是分隔的。看日志就知道了。

作者: heieye104 时间: 2008-10-14 16:17
有没有把他们的IP记录在别的地方？

作者: wxhsh 时间: 2008-10-14 16:34
标题: 回复 22楼 heieye104 的帖子
什么意思？
字数

作者: heieye104 时间: 2008-10-14 17:58
我是说有没有隐藏项里有被挡的IP或者是域名

作者: wxhsh 时间: 2008-10-15 11:02
标题: 回复 24楼 heieye104 的帖子
被档的IP缓存多数都在SA前的安全防护功能里，SA是不缓存的。

欢迎光临邮件服务器-邮件系统-邮件技术论坛(BBS) (http://bbs.5dmail.net/)