SPF Archives - ☩ Walking in Light with Christ - Faith, Computing, Diary ☩ Walking in Light with Christ

Posts Tagged ‘SPF’

How to disable spammer domain in QMAIL mail server with badmailto variable

Thursday, July 12th, 2012

I've recently noticed one of the qmail SMTP servers I adminster had plenty of logged spammer emails originating from yahoo.com.tw destined to reache some random looking like emails (probably unexisting) again to *@yahoo.com.tw

The spam that is tried by the spammer is probably a bounce spam, since it seems there is no web-form or anything wrong with the qmail server that might be causing the spam troubles.
As a result some of the emails from the well configured qmail (holding SPF checks), having a correct existing MX, PTR record and even having configured Domain Keys (DKIM) started being marked, whether emails are sent to *@yahoo.com legit emails.

To deal with the shits, since we don't have any Taiwanese (tw) clients, I dediced to completely prohibit any emails destined to be sent via the mail server to *@yahoo.com.tw. This is done via /var/qmail/control/badmailto qmail control variable;

Here is content of /var/qmail/control/badmailto after banning outgoing emails to yahoo.com.tw;;;

qmail:~# cat /var/qmail/control/badmailto [!%#:\*\^] [] [\{\}] @.*@ *@yahoo.com.tw

The first 4 lines are default rules, which are solving a lot of badmailto common sent emails. Thanks God after a qmail restart:

qmail:~# qmailct restart ....

Checking in /var/log/qmail-sent/current, there are no more outgoing *@yahoo.com.tw destined emails. Problem solved …

Tags: Auto, bounce, cat, checks, com, common, configured, control, control variable, default rules, dkim, domain, Draft, god, legit, mail, mail server, mx, outgoing emails, plenty, ptr, Qmail, qmailct, reache, Result, shits, smtp servers, spam, spammer, SPF, twThe, var, well, Yahoo, yahoo com tw
Posted in Qmail, System Administration | 1 Comment »

Fix to mail forwarding error “Received-SPF: none (domain.com: domain at maildomain does not designate permitted sender hosts)

Tuesday, October 18th, 2011

I’m Configuring a new Exim server to relay / forward mail via a remote Qmail SMTP server
Even though I configured properly the exim to forward via my relaying mail server with host mail.domain.com, still the mail forwarding from the Exim -> Qmail failed to work out with an error:

Fix to mail forwarding error "Received-SPF: none (domain.com: domain at maildomain does not designate permitted sender hosts)

I pondered for a while on what might be causing this “mysterous” error just to realize I forgot to add the IP address of my Exim mail server in the Qmail relay server

To solve the error I had to add in /etc/tcp.smtp on my Qmail server a record for my Exim server IP address xx.xx.xx.xx, like so:

debian-server:~# echo 'xx.xx.xx.xx:allow,RELAYCLIENT="",QS_SPAMASSASSIN="0"' >> /etc/tcp.smtp

The QS_SPAMASSASSIN=”0″ as you might have guessed instructs Qmail not to check the received mails originating from IP xx.xx.xx.xx with spamassassin.

Finally on the Qmail server to load up the new tcp.smtp settings I had to rebuild /etc/tcp.smtp.cdb and restart qmail :

– reload qmail cdb

linux-server:/var/qmail# qmailctl cdb Reloaded /etc/tcp.smtp. - restart qmail
linux-server:/var/qmail# qmailctl restart Restarting qmail: * Stopping qmail-smtpdssl. * Stopping qmail-smtpd. * Sending qmail-send SIGTERM and restarting. * Restarting qmail-smtpd. * Restarting qmail-smtpdssl.

This solved the issue and now mails are forwarded without problems via the Qmail SMTPD.

Tags: cdb, com, Configuring, domain, exim, forward mail, Forwarding, hosts, issue, Linux, mail, mail domain, mail server, none, Qmail, qmailctl, qs, quot, quot quot, relay, relay server, RELAYCLIENT, relaying mail, sender, Sending, server ip address, serverTo, SMTPD, smtpThe, spamassassin, SPF, var, while
Posted in Everyday Life, Linux, Qmail, System Administration, Various | No Comments »

How to enable Domain Keys (DKIM) in Qmail toaster based mail server install on Debian Linux

Wednesday, May 25th, 2011

Qmail dkim domain keys logo

Recently the Emails sent by one of the Qmail mail servers running on a Debian host started suddenly delivering in Spam folder in both Gmail.com and yahoo.com public mail services.

This is pretty nasty as many of the websites which used the local qmail server to deliver emails concerning subscriptions and other kind of services provided by the websites started ending in Span and thus many of the users who used their Yahoo Mail account and Google Mail – gmail accounts was unable to read emails mailed by the various websites forms and scripts which were sending emails.
You can imagine the negative effect all this “minor” mail issues had on website visitors count and the overall websites functionality.
To come up with some kind of solution to this mail issues, I did quite a lot of research to understand if Yahoo and Google Mail services has some kind of mail server delist form or some reporting service where one can delist a specific mail server as a spammer one or get some kind of help, but unfortunately it seems neither google nor yahoo has any kind of web based way to remove hosts or ip addresses of legit mail servers who has mistakenly been recognized as spam servers.

During my efforts to find a solution to the situation I red a lot of posts and forums online as well as Google’s Bulk Sender Guidelines, none if it was too helpful though.

The QMAIL server had a proper:
1. MX Record 2. TXT SPF records 3. PTR Record 4. There are proper correct mail message headers 5. Proper mails charset and encoding 6. The mail server IP is not listed anywhere in any mail blacklists (e.g. www.mxtoolbox.com/blacklists.aspx / spamhaus.org) 7. A correct SMTP greeting which matched the mail server domain name

The only thing which was missing on the mail server (checked against Google’s Bulk Sender Guidelines) was a properly configured DKIM and Domainkeys.

Thus in order to get around the situation I went the way and configured the qmail server to include and send in the mail header also Domain Keys

In this article I will briefly explain step by step how I configured Domain keys (DKIM) signing of my mails:

There are few ways domain keys signing can be implemented with Qmail.

1. By patching qmail binaries to support domain keys signing

I wanted to omit any interventions concerning the well running qmail install so I decided not to go this way.
Plus there are plenty of add-ons for qmail and as I have no time to test them the idea not to temper the existing qmail installation looked wise to me.
2. Use a wrapprer script around qmail-remote that invokes externally domainkeys binaries

This kind of solution was fitting me better and therefore I took this route to enable my qmail DKIM signing.

There are few approaches one can take described online:

Use a perl script wrapper which does does the DKIM signing (http://manuel.mausz.at/coding/qmail-dkim/)

I tried using the qmail-dkim-0.2.pl wrapper script following the exact steps described to be fulfilled to enable my outgoing mails dkim signature, however for some reason after substituting the qmail-remote with qmail-dkim.pl and setting the proper permissions, my outgoing mails failed completely and each mail I sent was returned back by the qmail MAILER-DAEMON

Use a bash shell script wrapper in combination with libdomainkeys‘s with a Mail-DKIM-0.39 .

I gave a try to this approach and thanksfully it worked after a bit of struggle to tune it up.

Here is what exactly I had to do to in order to have the domain keys signing to work using the above described qmail-remote.sh shell script wrapper

1. Install openssl related required debian packages

debian:~# apt-get install openssl libcrypt-openssl-rsa-perl libcrypt-openssl-bignum-perl libmail-dkim-perl ...

2. Create necessery directories and RSA key pairs for DomainKeys

debian:~# mkdir -p /etc/domainkeys/mydomain.com debian:~# cd /etc/domainkeys/mydomain.com debian:/etc/domainkeys/mydomain.com# openssl genrsa -out rsa.private_default 768 debian:/etc/domainkeys/mydomain.com# openssl rsa -in rsa.private_default -out rsa.public_default -pubout -outform PEM debian:/etc/domainkeys/mydomain.com# ln -sf rsa.private_default default debian:/etc/domainkeys/mydomain.com# touch selector debian:/etc/domainkeys/mydomain.com# echo 'default' >> selector

Where mydomain.com is the mail domain I need the DKIM signatures for.

I have written a small shell script which automates the task of adding new domainkeys directories and generating the RSA keys with openssl, you can download my generate_qmail_domainkey_rsa automator script here

3. Set proper permissions and owner to /etc/domainkeys directory

debian:~# chmod -R 0600 /etc/domainkeys debian:~# chown -R qmailr:qmail /etc/domainkeys

4. Generate public domain key for DNS TXT records

debian:/etc/domainkeys/mydomain.com# grep -v ^- rsa.public_default | perl -e 'while(<>){chop;$l.=$_;}print "k=rsa; t=y; p=$l;n";'

“k=rsa; t=y; p=MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMlDcYMrpWP9ouQOlFVtCHcFY
+gxrSQ6SegYeP4eeG7NECT/3jBqDtxANIVhaS9ASkEO4yNisGu4yX/DRclTm
nPWknoDtCDiD7IFEzT37qn1JLzcuknTncmFBFMDRUJq6wIDAQAB;”

The above key is used in next step 5 to set it as a TXT DNS record.

5. Create the DNS records in Name server

With BIND DNS server you need to place a records like:

_domainkey.example.com. IN TXT "k=rsa; t=y; o=-;" default._domainkey.example.com. IN TXT " p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2RkvFHbhqM/bVbb kBtZ1cZUSYcjC4q+PWjd1tFopT+HXXR9Ctx7FZ1guX5fGboiwYmhCYdVroI KRM3I48/YyQoXxtn3iYZ086v8BHaNtkcBMY+68JeEQ3K0WQkbqQXp/tsnLY SQW1yXiEo9CywxVdpwH+OY94HxK4fAbw6V11cwIDAQAB"

! The above p= key specified is the one generated in step 5.

6. Download and compile & install Mail-DKIM-0.39 ‘s perl extension

As of time of writting latest Mail-DKIM is ver. 0.39, however it’s a good idea to check and install the latest available version available on http://www.cpan.org

a) Download Mail-DKIM

debian:~# cd /usr/local/src debian:/usr/local/src# wget https://www.pc-freak.net/files/Mail-DKIM-0.39.tar.gz ... 2011-05-25 15:09:37 (264 KB/s) - `Mail-DKIM-0.39.tar.gz' saved [87375/87375] ... b) Compile & Install Mail-DKIM

debian:/usr/local/src# chown -R hipo:hipo Mail-DKIM-0.39 debian:/usr/local/src# cd Mail-DKIM-0.39

debian:/usr/local/src/Mail-DKIM-0.39# su hipo
debian:/usr/local/src/Mail-DKIM-0.39$ perl Makefile.PL
debian:/usr/local/src/Mail-DKIM-0.39$ make
…
debian:/usr/local/src/Mail-DKIM-0.39$ exit
debian:/usr/local/src/Mail-DKIM-0.39# make install
debian:/usr/local/src/Mail-DKIM-0.39# cd script
debian:/usr/local/src/Mail-DKIM-0.39/script# cp -rpf * /usr/local/bin; cd /usr/local/src

Note that the dkimsign.pl which is in the Mail-DKIM-0.39 is a very important tool used later by the qmail-remote wrapper script. This perl script is copied in the last command issued in above chunk of code.
In the up-command lines I use my unprivileged username hipo to compile, here use any non-root user is appropriate.
For instance it’s possible that the cpan user is used as a compile time user, I was lazy to configure CPAN thus I choose to use my normal unprivileged user.

c) configure rsa domain key paths in dkimsing.pl

Another thing to do here is to make sure the /usr/local/bin/dkimsign.pl which was just recently installed has a correct set location for it’s KeyFile variable.
This vailable is in the script is located online 64, I changed it to include my rsa domain key file, after I changed it, now it looks like so:

KeyFile => "/etc/domainkeys/mydomain.com/default"

7. Download and install libdomainkeys

a) Download libdomainkeys
For latest version of libdomainkeys make sure you check on http://domainkeys.sourceforge.net/

debian:/usr/local/src# wget https://www.pc-freak.net/files/libdomainkeys-0.69.tar.gz debian:/usr/local/src# tar -zxvvf libdomainkeys-0.69.tar.gz ... debian:/usr/local/src# chown -R hipo:hipo libdomainkeys-0.69 debian:/usr/local/src# cd libdomainkeys-0.69; su hipo

b) Compile and install libdomainkeys binaries

debian:/usr/local/src/libdomainkeys-0.69$ echo '-lresolv' > dns.lib debian:/usr/local/src/libdomainkeys-0.69$ make clean & & make debian:/usr/local/src/libdomainkeys-0.69$ exit debian:/usr/local/src/libdomainkeys-0.69# cp -rpf dktest dknewkey expected makeheader /usr/local/bin/

There is a note to make here, one of the programs part of libdomainkeys called dnstest is not compiled while doing make for unknown reasons?!
I was not able to compile manually dnstest either using gcc like so:

debian:/usr/local/src/libdomainkeys-0.69$ gcc -o dnstest dnstest.c dnstest.c: In function 'main': dnstest.c:11: warning: incompatible implicit declaration of built-in function 'strle' /tmp/ccH78KZ1.o: In function 'main': dnstest.c:(.text+0x2b): undefined reference to 'dns_text' collect2: ld returned 1 exit status

I have absolutely no clue why it fails o_O, but it doesn’t matter since I figured out that domainkeys header signature is properly set even without dnstest.

Let me mark here that echo ‘-lresolv’ > dns.lib you see in above code chunk is absolutely necessery in order to be able to compile libdomainkeys on Debian based distributions. If the ‘-lresolv > dns.lib’ is omitted the libdomainkeys build fails with error:

gcc -DBIND_8_COMPAT -O2 -o dktest dktest.o -L. -ldomainkeys -lcrypto `cat dns.lib` `cat socket.lib` ./libdomainkeys.a(dns_txt.o): In function `dns_text': dns_txt.c:(.text+0x2d): undefined reference to `__res_query' dns_txt.c:(.text+0xc4): undefined reference to `__dn_expand' dns_txt.c:(.text+0x184): undefined reference to `__dn_expand' collect2: ld returned 1 exit status make: *** [dktest] Error 1

8. Install libdkim (source of the libdkimtest binary later used by qmail-remote wrapper script)

debian:/usr/local/src# su hipo debian:/usr/local/src$ wget https://www.pc-freak.net/files/qmail/libdkim-1.0.19.zip debian:/usr/local/src$ wget https://www.pc-freak.net/files/qmail/libdkim-1.0.19-linux.patch debian:/usr/local/src$ wget https://www.pc-freak.net/files/qmail/libdkim-1.0.19-extra-options.patch debian:/usr/local/src$ unzip libdkim-1.0.19.zip debian:/usr/local/src$ cd libdkim/src debian:/usr/local/src/libdkim/src$ patch -p2 < ../../libdkim-1.0.19-linux.patch debian:/usr/local/src/libdkim/src$ patch -p2 < ../../libdkim-1.0.19-extra-options.patch debian:/usr/local/src/libdkim/src$ make && exit debian:/usr/local/src/libdkim/src# make install

The above install will install libdkimtest binary, used by the wrapper script to do the actual DKIM-Signature, the binary gets installed in /usr/local/bin/libdkimtest.
Here is a link to patched version of libdkim 1.0.19 , to use it instead of patching as described above download the archive untar and do a make clean && make && install

9. Download qmail-remote.wrapper (qmail-remote wrapper shell script) and set it to wrap qmail-remote

a) Copy original qmail-remote to qmail-remote.orig

debian:~# cd /var/qmail/bin debian:/var/qmail/bin# cp -rpf qmail-remote qmail-remote.orig

b) Download qmail-remote.wrapper script

Here is the qmail-remote.sh wrapper script that worked for me
Originally the wrapper script is taken from http://www.memoryhole.net/qmail/, big thanks to Russ Nelson for writting the awesome wrapper script.

debian:~# cd /var/qmail/bin/ debian:/var/qmail/bin# wget https://www.pc-freak.net/files/qmail-remote.wrapper Saving to: `qmail-remote.wrapper'

100%[============================>] 1,164 –.-K/s in 0s

2011-05-25 15:46:54 (142 MB/s) – `qmail-remote.wrapper’ saved [1164/1164]

c) Set proper permissions to the qmail-remote.wrapper script

The permissions of qmail-remote should look like so:

-rwxr-xr-x 1 root qmail 1164 2011-05-25 11:05 /var/qmail/bin/qmail-remote*

To set this permissions I used:

debian:/var/qmail/bin# chmod 755 qmail-remote.wrapper debian:/var/qmail/bin# chown qmailq:qmail qmail-remote.wrapper

d) Create /var/domainkeys directory (necessery for proper qmail remote wrapper script operations)

debian:~# mkdir /var/domainkeys debian:~# chown -R qmailr:qmail /var/domainkeys debian:~# chmod 700 -R /var/domainkeys

e) Substitute original qmail-remote binary with the wrapper script:

debian:~# qmailctl stop Stopping qmail... qmail-send qmail-smtpd debian:/var/qmail/bin# cp -rpf qmail-remote.wrapper qmail-remote debian:/var/qmail/bin# qmailctl start Starting qmail

10. Send test email to @gmail.com or @yahoo.com to test if DKIM-Signature is included in the mail header

I used my installed webmail interface squirrelmail and send a test email to my home mail server and as well as to yahoo.com

The headers of the email looked fine, here is how my DKIM signed mail headers looked like:

From - Thu May 26 15:31:37 2011 X-Account-Key: account11 X-UIDL: 1306413169.97071.pcfreak,S=1244 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys:

Return-Path: <root@mail.mydomain.com> Delivered-To: hipo@www.pc-freak.net Received: (qmail 97068 invoked by uid 1048); 26 May 2011 12:32:49 -0000 Received: from mail.mydomain.com (83.170.100.100) by mail.www.pc-freak.net with SMTP; 26 May 2011 12:32:49 -0000 Comment: DomainKeys? See http://domainkeys.sourceforge.net/ DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=mydomain.com;

b=ZnTDdUexnt8fmuHbVNXIC+JDvNLYO1zjzlI3PODe3e1oMS5dRHzVGujrS1
Yk0qqs2oW7DseZg/iHE9KOLZBeInksOnsmLsDBq1Lvzfv2xejikR52LBg6a/uK
ewECJy4jQA4cwMJ/qUxmK8EDwbgj7jqCVB95FK3Z5EdR4HoaqGQ=;

h=Received:Date:Message-ID:From:To:Subject;
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=mydomain.com; h=date
:message-id:from:to:subject; s=default; q=
/etc/domainkeys/mydomain.com/default;
bh=G32d6y8oiLehRzcuIWr9s
S+Jy+g=;
b=TPW5VXq3vlOUf1T7lfxQC00MN0kPJxaASE/gq7LbHyV1Gj/Xj+GLF
UN6hYVeKnsoKKeV108JVGcfvfTaLogsxGyS9XzUXKlLtESBj4wr/DAOQy
OcHCj75
bEOOd9nv+RehOYinXGmx0JUZpCNHGndNZ1AEabbVEiX/NQAL7iKDnE
=
Received: (qmail 28771 invoked by uid 0); 26 May 2011 12:31:30 -0000
Date: 26 May 2011 12:31:30 -0000
Message-ID: <20110526123130.28770.qmail@mail.mydomain.com>
From: root@mail.mydomain.com
To: hipo@www.pc-freak.net
Subject: testing 123

baklavavav
tatta

Notice the two lines in the above pasted header:

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=mydomain.com; h=date

This clearly shows that now both Domainkeys and DKIM are being applied to outgoing mail messages 🙂

However to be completely 100% sure the domainkeys and DKIM signing is correct, you should check the online websites which offer a mail domainkey check and DKIM signature check, an example for such a website that I used in order to test that my SSL RSA Domainkeys and DKIM correspond correctly to the ones specified in the DNS server is:
here

The idea for writting this small guide on configuring Domainkeys with Qmail and Linux is seriously inspired by Mariuz’s Blog post dkim wrapper that works using dk Hope this is helpful to somebody, it took me quite a while until I come up with the exact steps of a workable install of Domain Keys, there are so many tutorials and ways to implement this that at a certain point it’s a hell.
Like always with Qmail, even simple things are so complex, the only good thing about qmail is once you make it work well, it works forever … until the next time you will have to spend few days trying to figure it out 😉

I’m very much looking to hear if people followed the tutorial succesfully.

Any feedback concerning the article is mostly welcome!
Cheers!

Tags: briefly, Bulk, charset, com, correct mail, Date, DKIM-Signature, dnstest, domain, Domainkeys, Emails, exit, exitdebian, form, function, Gmail, google, header, help, host, ip addresses, libdkimtest, Linux, lot, mail issues, mail message, mail server, mail servers, mail services, message headers, mx record, mxtoolbox, nameThe, none, ptr, public mail, qmailctl, reporting service, root, script, server domain, server ip, signing, soccerfame, spamhaus, spammer, SPF, test, text, toaster, TXT, website visitors, wget, wrapper, yahoo mail account
Posted in Linux, System Administration | 21 Comments »

How to set up a proper mail server SPF TXT record in Bind (named) DNS server

Saturday, April 2nd, 2011

I’ve recently figured out that some of the SPF records I’m using for some of the administrated by me mail servers, was found to be incorrect by Microsoft’s mail servers for hotmail.com, msn.net and live.com .

Probably the SPF records that I used by so far were found to be incorrect by other mail account service providers also.
As a consequence of this wrongly considered SPFs” Microsoft mail servers were either rejecting my mail server messages or putting the received messages in the Junk folder.

The SPF records which were shown as incorrect according to Microsoft SPF checking Mechanism called SenderID SPF Record Wizard were defined in my bind dns domain zone file as follows:

mydomainname.com. IN TXT "v=spf1 mx ip4:123.124.128.125 ~all"

Using this TXT SPF record dns configuration Microsoft’s Sender ID SPF Record Wizard claimed I had no SPF records at all e.g., checking with the wizard I was returning the error

No SPF Record Found

Microsoft’s Sender ID Framework SPF Record Wizard is available from: The URL address http://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard/.

Therefore if you’re experiencing some kind of difficulties with sending properly email messages to Microsoft mail domain names or to some other major mail providers like Yahoo, it’s very likely that you might have a misconfigured SPF record just like me.

To deal with the situation I had to check my SPF record with the simple:

"v=spf1 a -all"

The complete TXT record which needs to be placed in the zone file of your domain name looks like so:

mydomainname.com. IN TXT "v=spf1 a -all"

The the meaning of this TXT SPF record is that the IP address in the “A” record for the name is theonly IP address that’s allowed to use that server’s name

After that change hopefully if you’re experiencing mails entering automatically in Junk filter / mail folder with msn.com, hotmail.com, live.com or yahoo.com this problems should be immediately solved.

Checking again with the the Microsoft SenderID online tool I got an output that my SPF record is correct like you read below the output that poped up from Microsoft’s page:

Sender ID Framework SPF Record Wizard

Step 2 of 4: Display Published DNS Records

The wizard has checked DNS for information about prize.bgÂ including: SPF, MX and A records. This information is displayed below.

If an SPF record was found, you can verify its contents here and use the remaining steps of this wizard to modify the record if necessary. If no SPF record was found, you can use information from the domain’s MX and A records to create a new SPF record.

Click Next to continue.

SPF Record Found
One or more functional SPF record(s) have been found for the domain mydomain.com
The full text of the domain’s SPF record is as follows.

v=spf1 a -all

Another tool which helped me a lot in debugging problems with my SPF records is found on the address http://www.kitterman.com/spf/validate.html so it might be wise to use it as well in order to check that your SPF records are correct.

Tags: Bind, bind dns, change, Click, com, consequence, content technologies, Display, DNS, domain names, file, filter mail, FoundMicrosoft, information, ip4, Junk, junk filter, mail account, mail domain, mail folder, mail providers, mail servers, Microsoft, microsoft mail, MSN, page, proper mail server, record dns, sender id, server messages, service providers, SPF, spf record, SPFs, text, tool, TXT, url address, wizard
Posted in FreeBSD, Linux, System Administration | No Comments »

Howto Remove (delist) your mail server IP from Hotmail, Live.com and MSN mail server blacklist

Wednesday, March 30th, 2011

One of the mail servers I’m administrating has problems deliving emails to addresses at @Hotmail.com, @live.com and @msn.com.

That’s quite irritating especially when all of the other major mail servers, Yahoo Mail, Gmail etc. do accept my qmail server messages in their Inbox.

Every email that is addressed to for example hotmail.com is returned back to my sender folder with the message:

Remote host said: 550 SC-001 Unfortunately, messages from 83.170.105.141 weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.

Right after my mail server delivery problems were reported by one of my colleagues, the first step I took was check if my mailserver is listed in some of the major email blacklist databases on the address:http://www.mxtoolbox.com/blacklists.aspx

By opening the above url in a browser and putting a server IP, I was unpleasently notified that my mail server let’s call it with the fiction name mail.server.com is existing in the Spamcannibal blacklist dabase . Spamcannibal as most of the blacklist databases.

To completely reassure myself my server host IP is in spamcannibal, I’ve used spacannibal’s website whois on the urlhttp://www.spamcannibal.org/cannibal.cgi.

Of course this proofed one more time I’m listed in spamcannibal… Thanksfully spamcannibal has a contact form which can be used to delist an IP address from their blacklist right from their website.

After a day of waiting my server IP was removed from spamcannibal blacklist and therefore using the mxtoolbox.com’s website mail server blacklist checker I’ve assured myself the mail server is no longer in the most notable spam blacklist on the net.

I’ve gave another try to deliver an email to my hotmail mail account myaccount@hotmail.com . The mail delivery was unsuccesful again, the qmail failure notice daemon returned my sent email to my myaccount@hotmail.com once again with the error of:

Hi. This is the qmail-send program at mail.server.com. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out.

<myaccount@hotmail.com>:
Connected to 65.55.92.136 but sender was rejected.
Remote host said: 550 SC-001 Unfortunately, messages from 83.170.105.141 weren’t
sent. Please contact your Internet service provider since part of their network is
on our block list. You can also refer your provider to
http://mail.live.com/mail/troubleshooting.aspx#errors.

— Below this line is a copy of the message.
….

The situation by so far was that I knew for sure my qmail mail server IP is not listed in major spam black lists, but still i couldn’t say for sure that there was no minor blacklist where my ip figurates, neither I was completely sure about the exact requirements microsoft expects from my mail server.

Some of the presumed reasons which could think of could be the cause the hotmail mail delivery failure errors were as follows:

1. My mail server IP had no correct A domain name record or a PTR record

2. My mail server was missing a correct SPF record
3. My dedicated server ISP has some blacklisted dedicated server IPs which belong to the same IP range as the mail server

I’ve walked through each of the 3 expected reasons that might cause the failure but it appeared that my mail server was configured to fullfil each of the 3 aforementioned requirements.

To assure myself each of the failure reasons were untrue I issued the commands:

linux:~# host mail.server.com mail.server.com has address 1.2.3.4 linux:~# host 1.2.3.4 1.2.3.4.in-addr.arpa domain name pointer mail.server.com. linux:~# host -t TXT mail.server.com mail.server.com descriptive text "v=spf1 mx ptr mx:server.com mx:mail.server.com mx:mail2.server.com -all"

Also I used the kitterman.com‘s SPF Query Validation tool located on http://www.kitterman.com/spf/validate.html to make sure my mail server SPF record is correct.

Another way to check if a mail server SPF records are correct is by sending a test email to for gmail.com and check in the email headers.

(To check the email headers in Thunderbird you can press ctrl+U)
When the email source appears look for the field Received-SPF: pass (google.com:….
If the field says pass this means your mail server SPF is fine, if it reads uknown or something different this means it’s not fine.

Next you will have to call your ISP and have a tech conversation with the tech support.

As nothing of the above assumed possible failure was checked and I was sure the email server is not affected by them

Further on logically enough I’ve pointed my browser to the http://mail.live.com/mail/troubleshooting.aspx#errors which which was prescribed in the reject email returned from hotmail’s mail server.

On that URL I red the meaning of the Remote host said: 550 SC-001 , Here is what it says:

550 SC-001 Mail rejected by Windows Live Hotmail for policy reasons. Reasons for rejection may be related to content with spam-like characteristics or IP/domain reputation. If you are not an email/network admin please contact your Email/Internet Service Provider for help.

Ain’t helpful is it??! Well I think Microsoft has a tradition of unhelpful manuals and documentation since the yearly days so that hotmail mail server error code explanation wasn’t that unexpected 😉

As I was out of ideas, I joined irc.freenode.net and asked for help in #exim irc channel.
Thanks God, there was a guy with an alias cannonball who gave me a good hints which I followed.

First he suggested that I see and join Microsoft’s (Smart Network Data Services) they’re located on https://postmaster.live.com/snds/index.aspx

Thanksfully the Smart Network Data Services could be accessed with my hotmail mail account, credentials, but after logging in to give me a real access to the site content I had to confirm, I’m a legit person and provide an legit email address where I can receive the confirmation.

As this went by in the https://postmaster.live.com/snds/addnetwork.aspx I had to use the buttons Requert Access, View IP Status and View Data to check the status of my mail server IP address 1.2.3.4

After all this struggle in 1. Requesting Access to my IP, View IP Status and View Data I finally found out the guess what unexpected fact that Microsoft’s mail servers has blacklisted my mail server IP Address!, How unexpected was that, heh ?!

So to sum up all this effort of registering in Microsoft SNDS gave me not any further clue on what I can change in my qmail mail server installation to make the user emails deliver to @hotmail.com.

After a bunch of investigation on the net, I’ve found another post which discussess issues with the 550 SC-001 error reason for a failed mail server deliveries to microsoft mail services.

Thanks God the post I’ve found pointed out that Microsoft has an Eform for delisting / removing spam black listed mail server IPs not able to deliver to hotmail and live.com

Click over the link above and you will be pointed to Microsoft’s annoying Eform for IP removal from their spam blacklist

The form needs to be filled and after that you can start praying to God to be merciful and push up Microsoft to have a good will and remove your IP from their mail spam blacklists.

The form filling takes about 20 minutes, there are plenty of information you will have to fill in the form but try to be as concrete as possible!

All the form fields are with (*) – asterisk and therefore are a required fields. After I filled up the irritating form, I’ve faced the horror of Microsoft’s Captcha!!!

Honestly I haven’t seen a more bad captcha in my life, I can’t read anything on it, neither I can perceive what word or number it is nor I can grasp whether the captcha shown letter is lower or capital… it’s really a terrible CAPTCHA I tell you! so beware and try to put all your patience in while filling it in.

What made it even worser this damned Microsoft’s IP removal form was the fact that it doesn’t work at all with Opera and Epiphany browsers.

I tried initially to use Epiphany and Opera to post the shitty form but it was no go, it could not post!!!
Thank you Microsoft for making your form a platform incompatible, I know you’re really good in that!

I finally launched IceWeasel (Firefox) and filled in the boring form once again and Thanks God this time it was properly posted as you read below:

Sender Information for Hotmail Delivery E-mail SupportE-mail Support Thank you for submitting your issue to Support.

Your Support Ticket Number:1151722088
For reference, please print this page or write down your support ticket number. Use this number when communicating with Support about this issue.
To make sure that you can receive a reply from Microsoft, add the “microsoft.com” domain to your e-mail “safe list”. If you do not receive a response in your “inbox” within 24 hours, check your “bulk mail” or “junk mail” folders.

Print the page? 😉 I guess Microsoft are not very green company as they suggest you to print it out ? 😉

Now I’m stuck into waiting and hoping that my removal request will be regarded and in a couple of days of time I’ll either hear a word from Microsoft’s tech support or directly get unbanned from their spam black list…. Pfuuu

Tags: blacklists, cannibal, checker, colleagues, com, course, dabase, delivery problems, email, failure, Gmail, host, host ip, hotmail mail, internet service provider, ip address, ISP, mail account, mail delivery, mail server, mail servers, mailserver, MSN, myaccount, record, Remote, sender, server host, server ip, server messages, spacannibal, SPF, time, tsent, url, urlhttp www, website mail, weren, whois
Posted in Linux, Linux and FreeBSD Desktop, System Administration | 37 Comments »

☩ Walking in Light with Christ – Faith, Computing, Diary

Posts Tagged ‘SPF’

Daily Bible quote

GET ARTICLE UPDATES

Useful blog? Help it:

Links to Other Places

Recent Posts

Ads

Categories

About Myself

Recent Comments

Top Post Views

blogtopsites