How to tell my ISP there's a problem

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
7 messages Options
Reply | Threaded
Open this post in threaded view
|

How to tell my ISP there's a problem

Chris-3
Apologies if the subject is vague however I'll attempt to explain
further. I run a cron job once a day that updates my Spamassassin
rules. Up until a couple of weeks ago I would get the output of that
cron job mailed to me. For some reason this is the only cron job output
that's not coming back. I've determined that size it not a factor since
some of my hourly logcheck messages are up to 400k if a restart has
taken place. Below is the output when it was working and the output
since them. I can't see a difference so it has to be something at my
ISP with just this one cron job but I can't see it.

https://pastebin.com/v0rMErQh

Thanks for any suggestions

--
Chris
KeyID 0xE372A7DA98E6705C
31.11972; -97.90167 (Elev. 1092 ft)
17:58:24 up 1:02, 1 user, load average: 0.95, 0.82, 0.71
Description: Ubuntu 18.04.2 LTS, kernel 4.18.0-22-generic

signature.asc (201 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: How to tell my ISP there's a problem

nektarios
On Mon, 17 Jun 2019 19:48:05 -0500
Chris Pollock <[hidden email]> wrote:

> Apologies if the subject is vague however I'll attempt to explain
> further. I run a cron job once a day that updates my Spamassassin
> rules. Up until a couple of weeks ago I would get the output of that
> cron job mailed to me. For some reason this is the only cron job
> output that's not coming back. I've determined that size it not a
> factor since some of my hourly logcheck messages are up to 400k if a
> restart has taken place. Below is the output when it was working and
> the output since them. I can't see a difference so it has to be
> something at my ISP with just this one cron job but I can't see it.
>
> https://pastebin.com/v0rMErQh
>
> Thanks for any suggestions
>
This doesn't sound like an issue coming from your ISP since the rest of
your smtp traffic is passing through - ISPs would block all traffic on
port 25 for example. The information you provided is limited but I would
start with what might have changed in your system the last couple of
weeks and then try to run the job manually and see if there is any
traffic generated going to the smtp daemon.

Nektarios Katakis.

attachment0 (499 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: How to tell my ISP there's a problem

Richard Salts
In reply to this post by Chris-3
On Monday, 17 June 2019 7:48:05 PM AEST Chris Pollock wrote:

> Apologies if the subject is vague however I'll attempt to explain
> further. I run a cron job once a day that updates my Spamassassin
> rules. Up until a couple of weeks ago I would get the output of that
> cron job mailed to me. For some reason this is the only cron job output
> that's not coming back. I've determined that size it not a factor since
> some of my hourly logcheck messages are up to 400k if a restart has
> taken place. Below is the output when it was working and the output
> since them. I can't see a difference so it has to be something at my
> ISP with just this one cron job but I can't see it.
>
> https://pastebin.com/v0rMErQh
>
> Thanks for any suggestions
Maybe it's going to a spam folder. I notice that the reply from your isp says
250 SPF validation soft failure in both cases, but if they stopped forwarding
"potentially forged" emails that might be a possible cause. It is definitely
the behaviour on smtp.embarqmail.com that has changed though, so you need to
ask the administrators of that server. Is this direct to MX or is it a fixed
relay intended to be a smarthost?

Reply | Threaded
Open this post in threaded view
|

RE: How to tell my ISP there's a problem

angelo
Hi, your Postfix logs look normal to my untrained eyes.
If it was me i would figure out the best contact email for the ISP and tell them as much detailed
info as i could, so it is easy for them to get you the answer to "what happened to X email ?".

Looks like they just need this line :

Jun 17 12:03:16 localhost postfix/smtp[8033]: 10C52100049C: to=<[hidden email]>, orig_to=<root>,
relay=smtp.embarqmail.com[206.152.134.66]:25, delay=3.6, delays=0.05/0.01/0.17/3.3, dsn=2.0.0,
status=sent (250 SPF validation soft failure)

They will then know the :
DATE
TIME
IP address of server that accepted your email

Also i think they will want the FQDN and IP address of your server.

Good luck

-ANGELO FAZZINA

[hidden email]
University of Connecticut,  ITS, SSG, Server Systems
860-486-9075

-----Original Message-----
From: [hidden email] <[hidden email]> On Behalf Of Richard James Salts
Sent: Monday, June 17, 2019 11:29 PM
To: [hidden email]
Subject: Re: How to tell my ISP there's a problem

On Monday, 17 June 2019 7:48:05 PM AEST Chris Pollock wrote:

> Apologies if the subject is vague however I'll attempt to explain
> further. I run a cron job once a day that updates my Spamassassin
> rules. Up until a couple of weeks ago I would get the output of that
> cron job mailed to me. For some reason this is the only cron job output
> that's not coming back. I've determined that size it not a factor since
> some of my hourly logcheck messages are up to 400k if a restart has
> taken place. Below is the output when it was working and the output
> since them. I can't see a difference so it has to be something at my
> ISP with just this one cron job but I can't see it.
>
> https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpastebin.com%2Fv0rMErQh&amp;data=02%7C01%7Cangelo.fazzina%40uconn.edu%7C442762b0d67a4f43757a08d6f39d536a%7C17f1a87e2a254eaab9df9d439034b080%7C0%7C0%7C636964254387499317&amp;sdata=zUjcikOfrs11SwYzM7o%2Bi6txTfWZeuQkXkqNHxOmT9k%3D&amp;reserved=0
>
> Thanks for any suggestions
Maybe it's going to a spam folder. I notice that the reply from your isp says
250 SPF validation soft failure in both cases, but if they stopped forwarding
"potentially forged" emails that might be a possible cause. It is definitely
the behaviour on smtp.embarqmail.com that has changed though, so you need to
ask the administrators of that server. Is this direct to MX or is it a fixed
relay intended to be a smarthost?

Reply | Threaded
Open this post in threaded view
|

Re: How to tell my ISP there's a problem

Chris-3
In reply to this post by Richard Salts
On Tue, 2019-06-18 at 13:29 +1000, Richard James Salts wrote:

> On Monday, 17 June 2019 7:48:05 PM AEST Chris Pollock wrote:
> > Apologies if the subject is vague however I'll attempt to explain
> > further. I run a cron job once a day that updates my Spamassassin
> > rules. Up until a couple of weeks ago I would get the output of
> > that
> > cron job mailed to me. For some reason this is the only cron job
> > output
> > that's not coming back. I've determined that size it not a factor
> > since
> > some of my hourly logcheck messages are up to 400k if a restart has
> > taken place. Below is the output when it was working and the output
> > since them. I can't see a difference so it has to be something at
> > my
> > ISP with just this one cron job but I can't see it.
> >
> > https://pastebin.com/v0rMErQh
> >
> > Thanks for any suggestions
>
> Maybe it's going to a spam folder. I notice that the reply from your
> isp says
> 250 SPF validation soft failure in both cases, but if they stopped
> forwarding
> "potentially forged" emails that might be a possible cause. It is
> definitely
> the behaviour on smtp.embarqmail.com that has changed though, so you
> need to
> ask the administrators of that server. Is this direct to MX or is it
> a fixed
> relay intended to be a smarthost?
>
I'd been told quite awhile back that the spf soft failure isn't a
problem by Centurylink  Be that as it may I went into chat with
Centurylink tech support this afternoon. I had all the information that
I could think of to share with them. After over an hour of trying to
explain what the problem is I got absolutely no where. In fact the 2nd
person I went into chat with just up and terminated the chat on me in
the middle of it. I was on the verge of changing my postfix setup to
use my gmail account when I decided to try one last thing and that was
to change the port from 25 to 587. After updating postfix files and
reloading postfix I changed the time on the spamassassin update cronjob
and let it run. Amazingly the message I expected was sent and received.
I can only conclude that making the change from port 25 to 587 made the
difference. I'll know for sure tomorrow when the SA-Update cronjob runs
at the regular time.

One last item, this isn't a mail server but just my home Ubuntu system.
I've had postfix setup for many years from way back in my Mandrake days
in order to easily send output of cronjobs to myself. It's probably
overkill but it works fine for me and runs without any problems (except
this last one).

I'd like thank those that replied.

Chris
--
Chris
KeyID 0xE372A7DA98E6705C
31.11972; -97.90167 (Elev. 1092 ft)
20:38:34 up 1 day, 3:42, 1 user, load average: 1.20, 0.77, 0.68
Description: Ubuntu 18.04.2 LTS, kernel 4.18.0-22-generic


signature.asc (201 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: How to tell my ISP there's a problem

Matus UHLAR - fantomas
On 18.06.19 21:15, Chris Pollock wrote:

>I'd been told quite awhile back that the spf soft failure isn't a
>problem by Centurylink  Be that as it may I went into chat with
>Centurylink tech support this afternoon. I had all the information that
>I could think of to share with them. After over an hour of trying to
>explain what the problem is I got absolutely no where. In fact the 2nd
>person I went into chat with just up and terminated the chat on me in
>the middle of it. I was on the verge of changing my postfix setup to
>use my gmail account when I decided to try one last thing and that was
>to change the port from 25 to 587. After updating postfix files and
>reloading postfix I changed the time on the spamassassin update cronjob
>and let it run. Amazingly the message I expected was sent and received.
>I can only conclude that making the change from port 25 to 587 made the
>difference. I'll know for sure tomorrow when the SA-Update cronjob runs
>at the regular time.

since port 587 requires authentication, different spam checks are often
applied there.

>One last item, this isn't a mail server but just my home Ubuntu system.

so you should use authentication when sending mail from it. So do I.

>I've had postfix setup for many years from way back in my Mandrake days
>in order to easily send output of cronjobs to myself. It's probably
>overkill but it works fine for me and runs without any problems (except
>this last one).

time changes, so do requirements. Good that you solved it.

--
Matus UHLAR - fantomas, [hidden email] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Posli tento mail 100 svojim znamim - nech vidia aky si idiot
Send this email to 100 your friends - let them see what an idiot you are
Reply | Threaded
Open this post in threaded view
|

Re: How to tell my ISP there's a problem

Chris-3
In reply to this post by Chris-3
On Tue, 2019-06-18 at 21:15 -0500, Chris Pollock wrote:

> On Tue, 2019-06-18 at 13:29 +1000, Richard James Salts wrote:
> > On Monday, 17 June 2019 7:48:05 PM AEST Chris Pollock wrote:
> > > Apologies if the subject is vague however I'll attempt to explain
> > > further. I run a cron job once a day that updates my Spamassassin
> > > rules. Up until a couple of weeks ago I would get the output of
> > > that
> > > cron job mailed to me. For some reason this is the only cron job
> > > output
> > > that's not coming back. I've determined that size it not a factor
> > > since
> > > some of my hourly logcheck messages are up to 400k if a restart
> > > has
> > > taken place. Below is the output when it was working and the
> > > output
> > > since them. I can't see a difference so it has to be something at
> > > my
> > > ISP with just this one cron job but I can't see it.
> > >
> > > https://pastebin.com/v0rMErQh
> > >
> > > Thanks for any suggestions
> >
> > Maybe it's going to a spam folder. I notice that the reply from
> > your
> > isp says
> > 250 SPF validation soft failure in both cases, but if they stopped
> > forwarding
> > "potentially forged" emails that might be a possible cause. It is
> > definitely
> > the behaviour on smtp.embarqmail.com that has changed though, so
> > you
> > need to
> > ask the administrators of that server. Is this direct to MX or is
> > it
> > a fixed
> > relay intended to be a smarthost?
> >
>
> I'd been told quite awhile back that the spf soft failure isn't a
> problem by Centurylink  Be that as it may I went into chat with
> Centurylink tech support this afternoon. I had all the information
> that
> I could think of to share with them. After over an hour of trying to
> explain what the problem is I got absolutely no where. In fact the
> 2nd
> person I went into chat with just up and terminated the chat on me
> inJun 19 12:45:03 localhost boinc[1710]: No protocol specified
> the middle of it. I was on the verge of changing my postfix setup to
> use my gmail account when I decided to try one last thing and that
> was
> to change the port from 25 to 587. After updating postfix files and
> reloading postfix I changed the time on the spamassassin update
> cronjob
> and let it run. Amazingly the message I expected was sent and
> received.
> I can only conclude that making the change from port 25 to 587 made
> the
> difference. I'll know for sure tomorrow when the SA-Update cronjob
> runs
> at the regular time.
>
> One last item, this isn't a mail server but just my home Ubuntu
> system.
> I've had postfix setup for many years from way back in my Mandrake
> days
> in order to easily send output of cronjobs to myself. It's probably
> overkill but it works fine for me and runs without any problems
> (except
> this last one).
>
> I'd like thank those that replied.
>
> Chris
I spoke too soon. Today with the SA-Update message at the normal time
it went out as usual however as has been the case I didn't get it back.
So, I changed the time on the cronjob and ran it again about 45mins
later. This time since there was no update and the message that the
cronjob generated was much smaller it came back. I've posted some more
syslog postfix output on pastebin. One thing I've noticed is that the
original SA-Update cronjob message is forwarded [1] whereas none of the
others aren't. Another thing I noticed is that when there is no update
the message of course is much smaller than when there is one. Update -
size=215160 no update - size=5845 which of course makes sense however
the message with no update output came back as it should have.

[1] localhost postfix/local[22152]: 7706F10007E7: to=<
[hidden email]>, orig_to=<root>, relay=local, delay=0.16,
delays=0.11/0/0/0.05, dsn=2.0.0, status=sent (forwarded as
84C6C10004DC)

I'm pretty sure it's not a file size problem because I just sent myself
a 9Mb file attachment with Evolution and the fact that a logcheck
message handled by postfix after a restart is around 500k. I've been
trying to send a large file with mailx to see if it comes back but nomatter what command line options I use no file gets attached.

mailx -a ~/Downloads/MISSION_Act_Community_Care_Booklet.pdf -s "test"
[hidden email]

I've also tried putting the -a after the 'To:' address still doesn't
work.

https://pastebin.com/wd3QfxJ4


--
Chris
KeyID 0xE372A7DA98E6705C
31.11972; -97.90167 (Elev. 1092 ft)
16:54:11 up 1 day, 23:58, 1 user, load average: 0.68, 0.82, 0.71
Description: Ubuntu 18.04.2 LTS, kernel 4.18.0-22-generic

signature.asc (201 bytes) Download Attachment