发送带附件邮件提示500 What? I don't understand that.

fsdjsb

发送日志，如下：
Thu 2009-02-12 14:08:41: --> 235 Authentication successful
Thu 2009-02-12 14:08:41: Authenticated as a5wfy@abc.com
Thu 2009-02-12 14:08:41: <-- MAIL FROM: <a5wfy@abc.com>
Thu 2009-02-12 14:08:41: --> 250 <a5wfy@abc.com>, Sender ok
Thu 2009-02-12 14:08:41: <-- RCPT TO: <atjqcmgr@abc.com>
Thu 2009-02-12 14:08:41: --> 250 <atjqcmgr@abc.com>, Recipient ok
Thu 2009-02-12 14:08:41: <-- RCPT TO: <a3cgy@abc.com>
Thu 2009-02-12 14:08:41: --> 250 <a3cgy@abc.com>, Recipient ok
Thu 2009-02-12 14:08:41: <-- RCPT TO: <a3lz@abc.com>
Thu 2009-02-12 14:08:41: --> 250 <a3lz@abc.com>, Recipient ok
Thu 2009-02-12 14:08:41: <-- RCPT TO: <a5wxj@abc.com>
Thu 2009-02-12 14:08:41: --> 250 <a5wxj@abc.com>, Recipient ok
Thu 2009-02-12 14:08:41: <-- RCPT TO: <atjpro7@abc.com>
Thu 2009-02-12 14:08:41: --> 250 <atjpro7@abc.com>, Recipient ok
Thu 2009-02-12 14:08:41: <-- RCPT TO: <atjfactoryd3@abc.com>
Thu 2009-02-12 14:08:41: --> 250 <atjfactoryd3@abc.com>, Recipient ok
Thu 2009-02-12 14:08:41: <-- RCPT TO: <acl@mail.a.com.co>
Thu 2009-02-12 14:08:41: --> 250 <acl@mail.a.com.co>, Recipient ok
Thu 2009-02-12 14:08:41: <-- RCPT TO: <atjbz@abc.com>
Thu 2009-02-12 14:08:41: --> 250 <atjbz@abc.com>, Recipient ok
Thu 2009-02-12 14:08:41: <-- RCPT TO: <a3gsj@abc.com>
Thu 2009-02-12 14:08:41: --> 250 <a3gsj@abc.com>, Recipient ok
Thu 2009-02-12 14:08:41: <-- RCPT TO: <a3kwj@abc.com>
Thu 2009-02-12 14:08:41: --> 250 <a3kwj@abc.com>, Recipient ok
Thu 2009-02-12 14:08:41: <-- RCPT TO: <a5xh@abc.com>
Thu 2009-02-12 14:08:41: --> 250 <a5xh@abc.com>, Recipient ok
Thu 2009-02-12 14:08:41: <-- RCPT TO: <a5zj@abc.com>
Thu 2009-02-12 14:08:41: --> 250 <a5zj@abc.com>, Recipient ok
Thu 2009-02-12 14:08:41: <-- Data
Thu 2009-02-12 14:08:41: Creating temp file (SMTP): d:\mdaemon\queues\temp\md50000016788.tmp
Thu 2009-02-12 14:08:41: --> 354 Enter mail, end with <CRLF>.<CRLF>
Thu 2009-02-12 14:08:41: Message size: 2001 bytes
Thu 2009-02-12 14:08:41: Message creation successful: d:\mdaemon\queues\inbound\md50000468154.msg
Thu 2009-02-12 14:08:41: --> 250 Ok, message saved <Message-ID: >
Thu 2009-02-12 14:08:41: <--
Thu 2009-02-12 14:08:41: --> 500 What? I don't understand that.
Thu 2009-02-12 14:08:41: <-- =A1=A1=A1=A1=A1=A1=A1=A1=A1=A1=A1=A1=A1=A1=A1=A1=D6=C2
Thu 2009-02-12 14:08:41: --> 500 What? I don't understand that.
Thu 2009-02-12 14:08:41: <-- =C0=F1=A3=A1
Thu 2009-02-12 14:08:41: --> 500 What? I don't understand that.
Thu 2009-02-12 14:08:41: <--  =09=09=09=09
Thu 2009-02-12 14:08:41: Too many errors encountered
Thu 2009-02-12 14:08:41: SMTP session successful (Bytes in/out: 3366/1034)
Thu 2009-02-12 14:08:41: ----------

fsdjsb

邮件接收者收到了邮件的正文信息,但只是邮件附件丢失,所以session successful,因为是一台本地服务器,所以这个问题应该定位在邮件客户端呢,还是发送邮件的服务器端?

Kyan

原帖由 leungys 于 2009-2-14 17:20 发表


Do you notice the last line of your quote?

Your version is SMTP session terminated.
The fsdjsb's version is SMTP session successful.

In fact, by default, if three consecutive errors encoun ...

你說得對，在我的日誌有三個 "500 What? I don't understand that." 錯誤以後 SMTP session 就終止了。而在 fsdjsb 的日誌裡，雖有三個 "500 What? I don't understand that." 錯誤，但它的 SMTP session 卻仍是成功的。 的確是不合邏輯，所以你懷疑他日誌是被改過的。

leungys

原帖由 Kyan 于 2009-2-14 17:08 发表
我貼出我被假冒「駭客」想以我的主機作為他濫發垃圾廣告郵件時的 SMTP(in) 日誌一節：
..
Mon 2008-08-11 18:03:05: <-- Host: www.scanproxy.com
Mon 2008-08-11 18:03:05: Too many errors encountered
Mon 2008-08-11 18:03:05: SMTP session terminated (Bytes in/out: 407/176)

Do you notice the last line of your quote?

Your version is SMTP session terminated.
The fsdjsb's version is SMTP session successful.

In fact, by default, if three consecutive errors encountered by MDaemon email server, the associated session should be terminated. It is what I mentioned before - the logical fault.

For whatever reasons, if sending mail with invaild commands, this statement "500 What? I don't understand that." would be recorded to the smtp(in) log.



[ 本帖最后由 leungys 于 2009-2-14 17:58 编辑 ]

Kyan

原帖由 leungys 于 2009-2-14 16:01 发表
這個日誌有沒有被改動過, 邏輯上有不對的地方 !!

我貼出一段，我被假冒「駭客」想以我的主機作為他濫發垃圾廣告郵件的跳板時內有 "500 What? I don't understand that." 的 SMTP(in) 日誌：

Mon 2008-08-11 18:03:05: Session 699; child 1; thread 5208
Mon 2008-08-11 18:03:05: Accepting SMTP connection from [118.167.137.84:1702]
Mon 2008-08-11 18:03:05: Performing PTR lookup (84.137.167.118.IN-ADDR.ARPA)
Mon 2008-08-11 18:03:05: *  D=84.137.167.118.IN-ADDR.ARPA TTL=(983) PTR=[118-167-137-84.dynamic.hinet.net]
Mon 2008-08-11 18:03:05: *  Gathering A records...
Mon 2008-08-11 18:03:05: *  D=118-167-137-84.dynamic.hinet.net TTL=(1363) A=[118.167.137.84]
Mon 2008-08-11 18:03:05: ---- End PTR results
Mon 2008-08-11 18:03:05: --> 220 tgshi.net ESMTP MDaemon 9.6.6; Mon, 11 Aug 2008 18:03:05 +0800
Mon 2008-08-11 18:03:05: <-- GET http://www.scanproxy.com:80/p-25.html HTTP/1.0
Mon 2008-08-11 18:03:05: --> 500 What? I don't understand that.
Mon 2008-08-11 18:03:05: <-- Content-Type: text/html
Mon 2008-08-11 18:03:05: --> 500 What? I don't understand that.
Mon 2008-08-11 18:03:05: <-- Proxy-Connection: keep-alive
Mon 2008-08-11 18:03:05: --> 500 What? I don't understand that.
Mon 2008-08-11 18:03:05: <-- Host: www.scanproxy.com
Mon 2008-08-11 18:03:05: Too many errors encountered
Mon 2008-08-11 18:03:05: SMTP session terminated (Bytes in/out: 407/176)







[ 本帖最后由 Kyan 于 2009-2-14 17:24 编辑 ]

leungys

這個日誌有沒有被改動過, 邏輯上有不對的地方 !!

Kyan

原帖由 redif 于 2009-2-14 10:57 发表
是不是收件人太多 了

不太清楚是不是收件人太多關係，但肯定是發信人系統上的問題，因為平時我的 SMTP(in) 的日誌裡從來不曾有過這樣的顯示。

redif

是不是收件人太多 了

Kyan

原帖由 fsdjsb 于 2009-2-13 14:34 发表
在内部中使用,用于群发,单独发的时候也出现过,而且是随机的

我在去年 8 月 10 遭受所謂「駭客（實際上不是駭客，而是一批只是想學做駭客的搗蛋鬼）」攻擊，一天發了將近 900 封 mail 給我，連續二天，但都被我拒收了，其所發之 mail 中並未附有任何附件，然而我的日誌中也出現好幾次 500 What? I don't understand that.，那是發信人系統的問題，以此提供參考。

fsdjsb

在内部中使用,用于群发,单独发的时候也出现过,而且是随机的