一个英国服务器的退信和调试经历，大家一起研究研究

tdk

顺利发送成功，速度很快
日志如下：
[24/Jul/2007 23:02:36][824] {smtps} SMTP server session begin; client connected from ruby.uk-dns.com:42348
[24/Jul/2007 23:02:36][824] {smtps} Looking up address 62.149.35.14 in DNS blacklist SpamCop...
[24/Jul/2007 23:02:36][824] {smtps} Address 14.35.149.62.bl.spamcop.net not found in DNS blacklist SpamCop
[24/Jul/2007 23:02:36][824] {smtps} Looking up address 62.149.35.14 in DNS blacklist SpamHaus SBL-XBL...
[24/Jul/2007 23:02:36][824] {smtps} Address 14.35.149.62.sbl-xbl.spamhaus.org not found in DNS blacklist SpamHaus SBL-XBL
[24/Jul/2007 23:02:36][824] {smtps} Looking up address 62.149.35.14 in DNS blacklist 国内cbl-...
[24/Jul/2007 23:02:36][824] {smtps} Address 14.35.149.62.cblless.anti-spam.org.cn not found in DNS blacklist 国内cbl-
[24/Jul/2007 23:02:36][824] {smtps} Looking up address 62.149.35.14 in DNS blacklist WPBL - Weighted Private Block List...
[24/Jul/2007 23:02:39][824] {smtps} Address 14.35.149.62.db.wpbl.info found in DNS blacklist WPBL - Weighted Private Block List (127.0.0.2)
[24/Jul/2007 23:02:39][824] {smtps} Looking up address 62.149.35.14 in DNS blacklist SpamHaus SBL-XBL...
[24/Jul/2007 23:02:39][824] {smtps} Address 14.35.149.62.zen.spamhaus.org not found in DNS blacklist SpamHaus SBL-XBL
[24/Jul/2007 23:02:39][824] {smtps} Looking up address 62.149.35.14 in DNS blacklist Distributed Sender Blackhole List - unconfirmed...
[24/Jul/2007 23:02:40][824] {smtps} Address 14.35.149.62.unconfirmed.dsbl.org not found in DNS blacklist Distributed Sender Blackhole List - unconfirmed
[24/Jul/2007 23:02:40][824] {smtps} Looking up address 62.149.35.14 in DNS blacklist Distributed Sender Blackhole List - trusted...
[24/Jul/2007 23:02:40][824] {smtps} Address 14.35.149.62.list.dsbl.org not found in DNS blacklist Distributed Sender Blackhole List - trusted
[24/Jul/2007 23:02:40][824] {smtps} Looking up address 62.149.35.14 in DNS blacklist sbl.spamhaus.org...
[24/Jul/2007 23:02:40][824] {smtps} Address 14.35.149.62.sbl.spamhaus.org not found in DNS blacklist sbl.spamhaus.org
[24/Jul/2007 23:02:40][824] {smtps} Delaying SMTP greeting to ruby.uk-dns.com:42348 for 15 seconds
[24/Jul/2007 23:02:55][824] {smtps} Sent SMTP greeting to ruby.uk-dns.com:42348
[24/Jul/2007 23:02:55][824] {smtps} Command HELO ruby.uk-dns.com
[24/Jul/2007 23:02:55][824] {smtps} Sent reply to HELO: 250 mail.com.cn
[24/Jul/2007 23:02:56][824] {smtps} Command MAIL FROM:<>
[24/Jul/2007 23:02:56][824] {smtps} Sent reply to MAIL: 250 2.1.0 Sender <> ok
[24/Jul/2007 23:02:56][824] {smtps} Command RCPT TO:<test@com.cn>
[24/Jul/2007 23:02:56][824] {smtps} Sent reply to RCPT: 250 2.1.5 Recipient <test@com.cn> ok (local)
[24/Jul/2007 23:02:56][824] {smtps} Command QUIT
[24/Jul/2007 23:02:56][824] {smtps} SMTP server session end
[24/Jul/2007 23:04:33][1588] {smtps} SMTP server session begin; client connected from 194.30.227.97:3259
[24/Jul/2007 23:04:33][1588] {smtps} Looking up address 194.30.227.97 in DNS blacklist SpamCop...
[24/Jul/2007 23:04:35][1588] {smtps} Address 97.227.30.194.bl.spamcop.net not found in DNS blacklist SpamCop
[24/Jul/2007 23:04:35][1588] {smtps} Looking up address 194.30.227.97 in DNS blacklist SpamHaus SBL-XBL...
[24/Jul/2007 23:04:35][1588] {smtps} Address 97.227.30.194.sbl-xbl.spamhaus.org not found in DNS blacklist SpamHaus SBL-XBL
[24/Jul/2007 23:04:35][1588] {smtps} Looking up address 194.30.227.97 in DNS blacklist 国内cbl-...
[24/Jul/2007 23:04:35][1588] {smtps} Address 97.227.30.194.cblless.anti-spam.org.cn found in DNS blacklist 国内cbl- (127.0.8.5)
[24/Jul/2007 23:04:35][1588] {smtps} Delaying SMTP greeting to 194.30.227.97:3259 for 15 seconds
[24/Jul/2007 23:04:50][1588] {smtps} Sent SMTP greeting to 194.30.227.97:3259
[24/Jul/2007 23:04:51][1588] {smtps} Command EHLO mail.fabulous.gr
[24/Jul/2007 23:04:51][1588] {smtps} Sent reply to EHLO: 250 mail.com.cn ...
[24/Jul/2007 23:04:51][1588] {smtps} Command STARTTLS
[24/Jul/2007 23:04:52][1588] {smtps} Successfully switched to TLS mode
[24/Jul/2007 23:04:53][1588] {smtps} Command EHLO mail.fabulous.gr
[24/Jul/2007 23:04:53][1588] {smtps} Sent reply to EHLO: 250 mail.com.cn ...
[24/Jul/2007 23:04:53][1588] {smtps} Command MAIL From:<rcggd@97.227.30.194.in-addr.arpa> SIZE=10754
[24/Jul/2007 23:04:53][1588] {smtps} Sender address <rcggd@97.227.30.194.in-addr.arpa> domain does not exist
[24/Jul/2007 23:04:53][1588] {smtps} Sent reply to MAIL: 553 5.1.8 Sender address <rcggd@97.227.30.194.in-addr.arpa> domain does not exist
[24/Jul/2007 23:04:53][1588] {smtps} Connection to SMTP server 194.30.227.97 lost: connection closed by remote host.
[24/Jul/2007 23:04:53][1588] {smtps} SMTP server session end
[24/Jul/2007 23:04:54][824] {smtps} SMTP server session begin; client connected from 194.30.227.97:3404
[24/Jul/2007 23:04:54][824] {smtps} Looking up address 194.30.227.97 in DNS blacklist SpamCop...
[24/Jul/2007 23:04:54][824] {smtps} Address 97.227.30.194.bl.spamcop.net not found in DNS blacklist SpamCop
[24/Jul/2007 23:04:54][824] {smtps} Looking up address 194.30.227.97 in DNS blacklist SpamHaus SBL-XBL...
[24/Jul/2007 23:04:54][824] {smtps} Address 97.227.30.194.sbl-xbl.spamhaus.org not found in DNS blacklist SpamHaus SBL-XBL
[24/Jul/2007 23:04:54][824] {smtps} Looking up address 194.30.227.97 in DNS blacklist 国内cbl-...
[24/Jul/2007 23:04:54][824] {smtps} Address 97.227.30.194.cblless.anti-spam.org.cn found in DNS blacklist 国内cbl- (127.0.8.5)
[24/Jul/2007 23:04:54][824] {smtps} Delaying SMTP greeting to 194.30.227.97:3404 for 15 seconds
[24/Jul/2007 23:05:09][824] {smtps} Sent SMTP greeting to 194.30.227.97:3404
[24/Jul/2007 23:05:10][824] {smtps} Connection to SMTP server 194.30.227.97 lost: connection closed by remote host.
[24/Jul/2007 23:05:10][824] {smtps} SMTP server session end
[24/Jul/2007 23:06:51][1588] {smtps} SMTP server session begin; client connected from 2.eb.344a.static.theplanet.com:42442
[24/Jul/2007 23:06:51][1588] {smtps} Looking up address 74.52.235.2 in DNS blacklist SpamCop...
[24/Jul/2007 23:06:52][1588] {smtps} Address 2.235.52.74.bl.spamcop.net not found in DNS blacklist SpamCop
[24/Jul/2007 23:06:52][1588] {smtps} Looking up address 74.52.235.2 in DNS blacklist SpamHaus SBL-XBL...
[24/Jul/2007 23:06:52][1588] {smtps} Address 2.235.52.74.sbl-xbl.spamhaus.org not found in DNS blacklist SpamHaus SBL-XBL
[24/Jul/2007 23:06:52][1588] {smtps} Looking up address 74.52.235.2 in DNS blacklist 国内cbl-...
[24/Jul/2007 23:06:52][1588] {smtps} Address 2.235.52.74.cblless.anti-spam.org.cn not found in DNS blacklist 国内cbl-
[24/Jul/2007 23:06:52][1588] {smtps} Looking up address 74.52.235.2 in DNS blacklist WPBL - Weighted Private Block List...
[24/Jul/2007 23:06:52][1588] {smtps} Address 2.235.52.74.db.wpbl.info not found in DNS blacklist WPBL - Weighted Private Block List
[24/Jul/2007 23:06:52][1588] {smtps} Looking up address 74.52.235.2 in DNS blacklist SpamHaus SBL-XBL...
[24/Jul/2007 23:06:52][1588] {smtps} Address 2.235.52.74.zen.spamhaus.org not found in DNS blacklist SpamHaus SBL-XBL
[24/Jul/2007 23:06:52][1588] {smtps} Looking up address 74.52.235.2 in DNS blacklist Distributed Sender Blackhole List - unconfirmed...
[24/Jul/2007 23:06:53][1588] {smtps} Address 2.235.52.74.unconfirmed.dsbl.org not found in DNS blacklist Distributed Sender Blackhole List - unconfirmed
[24/Jul/2007 23:06:53][1588] {smtps} Looking up address 74.52.235.2 in DNS blacklist Distributed Sender Blackhole List - trusted...
[24/Jul/2007 23:06:53][1588] {smtps} Address 2.235.52.74.list.dsbl.org not found in DNS blacklist Distributed Sender Blackhole List - trusted
[24/Jul/2007 23:06:53][1588] {smtps} Looking up address 74.52.235.2 in DNS blacklist sbl.spamhaus.org...
[24/Jul/2007 23:06:53][1588] {smtps} Address 2.235.52.74.sbl.spamhaus.org not found in DNS blacklist sbl.spamhaus.org
[24/Jul/2007 23:06:53][1588] {smtps} Delaying SMTP greeting to 2.eb.344a.static.theplanet.com:42442 for 15 seconds
[24/Jul/2007 23:07:08][1588] {smtps} Sent SMTP greeting to 2.eb.344a.static.theplanet.com:42442
[24/Jul/2007 23:07:09][1588] {smtps} Command HELO srv.cairoserver.com
[24/Jul/2007 23:07:09][1588] {smtps} Sent reply to HELO: 250 mail.com.cn
[24/Jul/2007 23:07:09][1588] {smtps} Command MAIL FROM:<>
[24/Jul/2007 23:07:09][1588] {smtps} Sent reply to MAIL: 250 2.1.0 Sender <> ok
[24/Jul/2007 23:07:10][1588] {smtps} Command RCPT TO:<test@com.cn>
[24/Jul/2007 23:07:10][1588] {smtps} Sent reply to RCPT: 250 2.1.5 Recipient <test@com.cn> ok (local)
[24/Jul/2007 23:07:10][1588] {smtps} Command QUIT
[24/Jul/2007 23:07:10][1588] {smtps} SMTP server session end

tdk

同时安全日志警告如下：
[24/Jul/2007 23:02:56] IP address 62.149.35.14 found in DNS blacklist WPBL - Weighted Private Block List, mail from <> to <test@com.cn>
第一个在黑名单，我的策略是增加1的评分 没有拒绝，你是不是有rbl拒绝了呢？

[24/Jul/2007 23:04:53] Message from IP address 194.30.227.97, sender <rcggd@97.227.30.194.in-addr.arpa> rejected: sender domain does not exist
第二个没有反解

dennishan

你的日志有点乱，有些应该和这2封邮件无关的，恰好又垃圾进来吧。
[24/Jul/2007 23:04:33][1588] {smtps} SMTP server session begin; client connected from 194.30.227.97:3259
[24/Jul/2007 23:04:33][1588] {smtps} Looking up address 194.30.227.97 in DNS blacklist SpamCop...
[24/Jul/2007 23:04:35][1588] {smtps} Address 97.227.30.194.bl.spamcop.net not found in DNS blacklist SpamCop
[24/Jul/2007 23:04:35][1588] {smtps} Looking up address 194.30.227.97 in DNS blacklist SpamHaus SBL-XBL...
[24/Jul/2007 23:04:35][1588] {smtps} Address 97.227.30.194.sbl-xbl.spamhaus.org not found in DNS blacklist SpamHaus SBL-XBL
[24/Jul/2007 23:04:35][1588] {smtps} Looking up address 194.30.227.97 in DNS blacklist 国内cbl-...
[24/Jul/2007 23:04:35][1588] {smtps} Address 97.227.30.194.cblless.anti-spam.org.cn found in DNS blacklist 国内cbl- (127.0.8.5)
[24/Jul/2007 23:04:35][1588] {smtps} Delaying SMTP greeting to 194.30.227.97:3259 for 15 seconds
[24/Jul/2007 23:04:50][1588] {smtps} Sent SMTP greeting to 194.30.227.97:3259
[24/Jul/2007 23:04:51][1588] {smtps} Command EHLO mail.fabulous.gr
[24/Jul/2007 23:04:51][1588] {smtps} Sent reply to EHLO: 250 mail.com.cn ...
[24/Jul/2007 23:04:51][1588] {smtps} Command STARTTLS
[24/Jul/2007 23:04:52][1588] {smtps} Successfully switched to TLS mode
[24/Jul/2007 23:04:53][1588] {smtps} Command EHLO mail.fabulous.gr
[24/Jul/2007 23:04:53][1588] {smtps} Sent reply to EHLO: 250 mail.com.cn ...
[24/Jul/2007 23:04:53][1588] {smtps} Command MAIL From:<rcggd@97.227.30.194.in-addr.arpa> SIZE=10754
[24/Jul/2007 23:04:53][1588] {smtps} Sender address <rcggd@97.227.30.194.in-addr.arpa> domain does not exist
[24/Jul/2007 23:04:53][1588] {smtps} Sent reply to MAIL: 553 5.1.8 Sender address <rcggd@97.227.30.194.in-addr.arpa> domain does not exist
[24/Jul/2007 23:04:53][1588] {smtps} Connection to SMTP server 194.30.227.97 lost: connection closed by remote host.
[24/Jul/2007 23:04:53][1588] {smtps} SMTP server session end
[24/Jul/2007 23:04:54][824] {smtps} SMTP server session begin; client connected from 194.30.227.97:3404
[24/Jul/2007 23:04:54][824] {smtps} Looking up address 194.30.227.97 in DNS blacklist SpamCop...
[24/Jul/2007 23:04:54][824] {smtps} Address 97.227.30.194.bl.spamcop.net not found in DNS blacklist SpamCop
[24/Jul/2007 23:04:54][824] {smtps} Looking up address 194.30.227.97 in DNS blacklist SpamHaus SBL-XBL...
[24/Jul/2007 23:04:54][824] {smtps} Address 97.227.30.194.sbl-xbl.spamhaus.org not found in DNS blacklist SpamHaus SBL-XBL
[24/Jul/2007 23:04:54][824] {smtps} Looking up address 194.30.227.97 in DNS blacklist 国内cbl-...
[24/Jul/2007 23:04:54][824] {smtps} Address 97.227.30.194.cblless.anti-spam.org.cn found in DNS blacklist 国内cbl- (127.0.8.5)
[24/Jul/2007 23:04:54][824] {smtps} Delaying SMTP greeting to 194.30.227.97:3404 for 15 seconds
[24/Jul/2007 23:05:09][824] {smtps} Sent SMTP greeting to 194.30.227.97:3404
[24/Jul/2007 23:05:10][824] {smtps} Connection to SMTP server 194.30.227.97 lost: connection closed by remote host.
[24/Jul/2007 23:05:10][824] {smtps} SMTP server session end

dennishan

Kerio的SMTP延迟设置这么长，15秒？-接收任何小邮件都得超过15秒，感觉5秒差不多。
[24/Jul/2007 23:02:40][824] {smtps} Delaying SMTP greeting to ruby.uk-dns.com:42348 for 15 seconds

U-Mail

感谢大家，特别感谢dennishan，太仔细了！

我忘记了对方的反查，这台服务器上做了一个特殊的安全处理，不允许对方反查询，打开就好了，谢谢大家：）

[ 本帖最后由 U-Mail 于 2007-7-25 01:44 编辑 ]

stdmis

好! 長見識啊!

忍不住好奇，自建一個郵件服務器發了一個測試信，主旨：test ,沒有正文，結果是發出了，不過中間有兩個停頓怕時間比較長。日志如下：
Wed 2007-07-25 08:15:06: Session 33; child 1
Wed 2007-07-25 08:13:04: Parsing Message <c:\mdaemon\remoteq\pd35000000011.msg>
Wed 2007-07-25 08:13:04: From: xxxx@yyyyyy.com.cn
Wed 2007-07-25 08:13:04: To: carrie@parisian.co.uk
Wed 2007-07-25 08:13:04: Subject: test
Wed 2007-07-25 08:13:04: Message-ID: <46A6958B.1050509@alltop.com.cn>
Wed 2007-07-25 08:13:04: MX-record resolution of [parisian.co.uk] in progress (DNS Server: 10.136.74.8)...
Wed 2007-07-25 08:13:05: *  P=000 S=000 D=parisian.co.uk TTL=(240) MX=[parisian.co.uk] {62.149.35.14}
Wed 2007-07-25 08:13:05: Attempting MX: P=000 S=000 D=parisian.co.uk TTL=(240) MX=[parisian.co.uk] {62.149.35.14}
Wed 2007-07-25 08:13:05: Attempting SMTP connection to [62.149.35.14 : 25]
Wed 2007-07-25 08:13:05: Waiting for connection...
Wed 2007-07-25 08:13:05: Connection established (10.136.74.1 : 3332 -> 62.149.35.14 : 25)
Wed 2007-07-25 08:13:05: Waiting for protocol initiation...
Wed 2007-07-25 08:13:08: <-- 220-ruby.uk-dns.com ESMTP Exim 4.66 #1 Wed, 25 Jul 2007 01:14:03 +0100
Wed 2007-07-25 08:13:08: <-- 220-We do not authorize the use of this system to transport unsolicited,
Wed 2007-07-25 08:13:08: <-- 220 and/or bulk e-mail.
Wed 2007-07-25 08:13:08: --> EHLO mail.alltop.com.cn
Wed 2007-07-25 08:13:08: <-- 250-ruby.uk-dns.com Hello mail.alltop.com.cn [59.37.18.34]
Wed 2007-07-25 08:13:08: <-- 250-SIZE 52428800
Wed 2007-07-25 08:13:08: <-- 250-PIPELINING
Wed 2007-07-25 08:13:08: <-- 250-AUTH PLAIN LOGIN
Wed 2007-07-25 08:13:08: <-- 250-STARTTLS
Wed 2007-07-25 08:13:08: <-- 250 HELP
Wed 2007-07-25 08:13:08: --> MAIL From:<xxxx@yyyyyy.com.cn> SIZE=830
Wed 2007-07-25 08:13:08: <-- 250 OK
Wed 2007-07-25 08:13:08: --> RCPT To:<carrie@parisian.co.uk>
Wed 2007-07-25 08:13:58: <-- 250 Accepted
Wed 2007-07-25 08:13:58: --> DATA
Wed 2007-07-25 08:13:59: <-- 354 Enter message, ending with "." on a line by itself
Wed 2007-07-25 08:13:59: Sending <c:\mdaemon\remoteq\pd35000000011.msg> to [62.149.35.14]
Wed 2007-07-25 08:13:59: Transfer Complete.
Wed 2007-07-25 08:15:06: <-- 250 OK id=1IDUWk-0001vK-Ph
Wed 2007-07-25 08:15:06: --> QUIT
Wed 2007-07-25 08:15:06: <-- 221 ruby.uk-dns.com closing connection
Wed 2007-07-25 08:15:06: SMTP session successful (Bytes in/out: 460/946)
Wed 2007-07-25 08:15:06: ----------

自建的郵件服務器沒有做反向解析(沒條件做)。到寫這個帖子為止沒收到退信。

[ 本帖最后由 stdmis 于 2007-7-25 08:50 编辑 ]

redif

真的佩服!!

hshletter

真的不错的帖子，学到了不少东西，觉得这种反垃圾邮件方法不错。@

dennishan

时间比较长是因为对方服务器连你服务器的验证时间长，50秒
应该和带宽有关-或者你也和TDK一样设置了15-30秒的SMTP应答延迟。
Wed 2007-07-25 08:13:08: --> RCPT To:<carrie@parisian.co.uk>
Wed 2007-07-25 08:13:58: <-- 250 Accepted

另外，估计carrie@parisian.co.uk会疯了，很多人给他发测试邮件

U-Mail

既然聊到这儿了，再深挖下，，

那些检查域名和IP对应关系的邮件服务器，通过中继发过去的邮件一般都是拒收，谁有解决办法？

像GMAIL那样替换MAIL FROM?