帮忙分析下SMTP(入)日志！！

heieye104

这是SMTP(入)的日志，显示邮件接收完成正常，但是所有的邮件没有进入收信人的邮件列表里，而是进入了坏的对队列中，不知道谁遇到过这样的问题，为了安全起见，隐去了真实的邮件地址。

Wed 2008-02-13 19:22:40: [752:796:5] 接收 SMTP 来自[216.32.*.* : 39565]的连接
Wed 2008-02-13 19:22:40: [752:796:5] --> 220 abc.com ESMTP ESAYMAIL ready
Wed 2008-02-13 19:22:41: [752:796:5] <-- EHLO outbound3-wa4-R.bigfish.com
Wed 2008-02-13 19:22:41: [752:796:5] --> 250-abc.com Hello outbound3-wa4-R.bigfish.com, 很高兴见到你
Wed 2008-02-13 19:22:41: [752:796:5] --> 250-ETRN
Wed 2008-02-13 19:22:41: [752:796:5] --> 250-AUTH=LOGIN
Wed 2008-02-13 19:22:41: [752:796:5] --> 250-AUTH LOGIN CRAM-MD5
Wed 2008-02-13 19:22:41: [752:796:5] --> 250-8BITMIME
Wed 2008-02-13 19:22:41: [752:796:5] --> 250 SIZE 15000000
Wed 2008-02-13 19:22:41: [752:796:5] <-- MAIL FROM:<23423@amd.com> SIZE=30293
Wed 2008-02-13 19:22:41: [752:796:5] 垃圾邮件封锁器正在检查 216.32.181.16 (正在连接 IP)
Wed 2008-02-13 19:22:41: [752:796:5] --> 250 <23423@aa.com> ，发信人完成。
Wed 2008-02-13 19:22:41: [752:796:5] <-- RCPT TO:<chen@abc.com>
Wed 2008-02-13 19:22:41: [752:796:5] --> 250 <chen@abc.com>，收信人完成。
Wed 2008-02-13 19:22:42: [752:796:5] <-- RCPT TO:<r@abc.com>
Wed 2008-02-13 19:22:42: [752:796:5] --> 250 <r@abc.com>，收信人完成。
Wed 2008-02-13 19:22:42: [752:796:5] <-- RCPT TO:<jiao@abc.com>
Wed 2008-02-13 19:22:42: [752:796:5] --> 250 <jiao@abc.com>，收信人完成。
Wed 2008-02-13 19:22:42: [752:796:5] <-- RCPT TO:<xn@abc.com>
Wed 2008-02-13 19:22:42: [752:796:5] --> 250 <xn@abc.com>，收信人完成。
Wed 2008-02-13 19:22:42: [752:796:5] <-- DATA
Wed 2008-02-13 19:22:42: [752:796:5] --> 354 输入邮件，以 <CRLF>.<CRLF> 作为结尾。
Wed 2008-02-13 19:22:44: [752:796:5] --> 250 好，邮件已保存。<邮件 ID: F53A09371FB723428826B442A4B20A41B86377@sbjgexmb1.amd.com>
Wed 2008-02-13 19:22:44: [752:796:5] <-- QUIT
Wed 2008-02-13 19:22:44: [752:796:5] --> 221 下回见
Wed 2008-02-13 19:22:44: [752:796:5] SMTP 连接成功完成，已发送 30303 字节。
Wed 2008-02-13 19:22:44: [752:796:5] 将邮件移动到适当的队列。
Wed 2008-02-13 19:22:44: [752:796:5] 邮件接收来自 outbound3-wa4-R.bigfish.com [216.32.181.16]，使用 SMTP 的 <23423@aa.com> 给 <chen@abc.com> [大小 30289]{d:\mdaemon\localq\md50012305457.msg}
Wed 2008-02-13 19:22:44: [752:796:5] 邮件接收来自 outbound3-wa4-R.bigfish.com [216.32.181.16]，使用 SMTP 的 <23423@aa.com> 给 <r@abc.com> [大小 30289]{d:\mdaemon\localq\md50012305458.msg}
Wed 2008-02-13 19:22:44: [752:796:5] 邮件接收来自 outbound3-wa4-R.bigfish.com [216.32.181.16]，使用 SMTP 的 <23423@aa.com> 给 <jiao@abc.com> [大小 30289]{d:\mdaemon\localq\md50012305459.msg}
Wed 2008-02-13 19:22:44: [752:796:5] 邮件接收来自 outbound3-wa4-R.bigfish.com [216.32.181.16]，使用 SMTP 的 <23423@aa.com> 给 <xn@abc.com> [大小 30289]{d:\mdaemon\localq\md50012305460.msg}
Wed 2008-02-13 19:22:44: ----------

heieye104

补充下，有问题的域我都加入了白名单中，都是国外服务器发过来的，（AMD，佳能的呀），通对他们邮件编码分析，对方用的是邮件服务器是POSTFIX.

heieye104

下面的日志跟上面那个对比有不一样的地方：
Fri 2008-02-22 09:58:19: ----------
Fri 2008-02-22 09:58:18: [708:8809:5] 接收 SMTP 来自[213.199.154.16 : 1540]的连接
Fri 2008-02-22 09:58:18: [708:8809:5] --> 220 abc.com ESMTP ESAYMAIL ready
Fri 2008-02-22 09:58:19: [708:8809:5] <-- EHLO outbound4-dub-R.bigfish.com
Fri 2008-02-22 09:58:19: [708:8809:5] --> 250-bluefocus.com Hello outbound4-dub-R.bigfish.com, 很高兴见到你
Fri 2008-02-22 09:58:19: [708:8809:5] --> 250-ETRN
Fri 2008-02-22 09:58:19: [708:8809:5] --> 250-AUTH=LOGIN
Fri 2008-02-22 09:58:19: [708:8809:5] --> 250-AUTH LOGIN CRAM-MD5
Fri 2008-02-22 09:58:19: [708:8809:5] --> 250-8BITMIME
Fri 2008-02-22 09:58:19: [708:8809:5] --> 250 SIZE 15000000
Fri 2008-02-22 09:58:23: [708:8809:5] <-- MAIL FROM:<Tan@aaa.com> SIZE=25261
Fri 2008-02-22 09:58:23: [708:8809:5] 垃圾邮件封锁器正在检查 213.199.154.16 (正在连接 IP)
Fri 2008-02-22 09:58:23: [708:8809:5] --> 250 <Tan@aaa.com> ，发信人完成。
Fri 2008-02-22 09:58:23: [708:8809:5] <-- RCPT TO:<hsr@abc.com>
Fri 2008-02-22 09:58:23: [708:8809:5] --> 250 <hsr@abc.com>，收信人完成。
Fri 2008-02-22 09:58:26: [708:8809:5] <-- DATA
Fri 2008-02-22 09:58:26: [708:8809:5] --> 354 输入邮件，以 <CRLF>.<CRLF> 作为结尾。
Fri 2008-02-22 09:58:28: [708:8809:5] --> 250 好，邮件已保存。<邮件 ID: ADR33000000159666PRD@aaa.com>
Fri 2008-02-22 09:58:29: [708:8809:5] <-- QUIT
Fri 2008-02-22 09:58:29: [708:8809:5] --> 221 下回见
Fri 2008-02-22 09:58:29: [708:8809:5] SMTP 连接成功完成，已发送 25270 字节。
Fri 2008-02-22 09:58:29: [708:8809:5] 将邮件移动到适当的队列。
Fri 2008-02-22 09:58:29: [708:8809:5] 邮件接收来自 outbound4-dub-R.bigfish.com [213.199.154.16]，使用 SMTP 的 <Tan@aaa.com> 给 <hsr@abc.com> [大小 25259]{d:\mdaemon\localq\md50012486340.msg}

wxhsh

如果邮件正文包含IFRAME，会被CF默认规则移到坏队列去。

heieye104

邮件正文没有这样的字符，是所有那个域的邮件收不到

heieye104

这是我通过坏的队列里打开的的邮件原码，不知道有没有帮助？？

        (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
        (No client certificate requested)
        by mail75-dub.bigfish.com (Postfix) with ESMTP id D381669007F;
        Fri, 22 Feb 2008 02:16:58 +0000 (UTC)
Received: from ausb3twp01.amd.com ([163.181.250.37])
        by ausb3extmailp01.amd.com (Switch-3.2.7/Switch-3.2.7) with ESMTP id m1M2IllI019261;
        Thu, 21 Feb 2008 20:18:50 -0600
X-WSS-ID: 0JWMBNQ-01-AJR-01
Received: from sausexbh1.amd.com (sausexbh1.amd.com [163.181.22.101])
        by ausb3twp01.amd.com (Tumbleweed MailGate 3.5.1) with ESMTP id 27A155146A5;
        Thu, 21 Feb 2008 20:16:38 -0600 (CST)
Received: from SAUSEXMB3.amd.com ([163.181.22.202]) by sausexbh1.amd.com with Microsoft SMTPSVC(6.0.3790.2499);
         Thu, 21 Feb 2008 20:16:52 -0600
Received: from sbjgexmb1.amd.com ([165.204.115.204]) by SAUSEXMB3.amd.com with Microsoft SMTPSVC(6.0.3790.3959);
         Thu, 21 Feb 2008 20:16:39 -0600
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="----_=_NextPart_001_01C874F8.F32DD32A"
Subject: =?gb2312?B?Rlc6ILCu0MSzyLjlvP6hoqG206KyxaG3xOrW1bjl?=
Date: Fri, 22 Feb 2008 10:16:35 +0800
Message-ID: <F53A09371FB723428826B442A4B20A41C2E50A@sbjgexmb1.amd.com>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: =?gb2312?B?sK7QxLPIuOW8/qGiobbTorLFobfE6tbVuOU=?=
Thread-Index: Ach0VsoiUqFzmMs0RyqxdKVXc6wjHwAArzQgACfXmaA=
From: "Si, Steven" <Steven@abc.com>
To: =?gb2312?B?s8Ln+A==?= <chenying@bc.com>,
        =?gb2312?B?u8bK5u6j?= <hsr@bc.com>,
        =?gb2312?B?vcPB+qOosbG+qaOp?= <jiaolong@bc.com>,
        =?gb2312?B?0e7H1Q==?= <yangwn@mail.com>
X-OriginalArrivalTime: 22 Feb 2008 02:16:39.0507 (UTC) FILETIME=[F53B3A30:01C874F8]
X-Spam-Processed: bc.com, Fri, 22 Feb 2008 10:22:28 +0800
        (not processed: message size (132081) exceeds max size (25600))
X-MDRcpt-To: hsr@bc.com
X-MDRemoteIP: 213.199.154.16
X-Return-Path: Steven@abc.com
X-MDaemon-Deliver-To: hsr@bc.com

[ 本帖最后由 heieye104 于 2008-2-25 15:19 编辑 ]

kks168

(not processed: message size (132081) exceeds max size (25600))
是否超过邮件大小

lwz_08

250 SIZE 15000000???????????????????

检查一下你的邮件空间总大小

heieye104

邮件空间和邮件大小都没有问题，而且只有这个域发送过来的信到不了用户列表里，
只有这个域的日志才有MAIL FROM:<23423@amd.com> SIZE=30293
别的都是MAIL FROM:<23423@a1d.com>没有后面的大小，不知道怎么搞的

wxhsh

分析了一下日志，可能你把这些域加进局域网域内，导致接受后分类到错误的队列里。检查设置－RAS。。。。
看看是不是把它们加到lan domains里去了。