Differences

This shows you the differences between two versions of the page.

--- system:annoyances [2021-04-28T03:02:26+0000] – michael_paoli
+++ system:annoyances [2021-05-06T06:05:20+0000] (current) – reverted the temporarily increase of max queue time from 4 days to 7 days michael_paoli
@@ Line 594: / Line 594: @@
 attempted.  So, that should help deliverability (and, on the receiving side, probably some more spam for postmaster as I presently aliased those to
 postmaster ... "good enough" for now).
+</file>
+<file>
+Looks like the SPF checks are now working.
+I also found an older spdf process running and killed that off - maybe that made the difference?
+So, yes, and seeing SPF fail/rejects in the log e.g.:
+# fgrep -ai spf rejectlog
+-04-28 02:29:33 H=(sweja-se.mail.protection.outlook.com) [183.199.220.44] F=<oefydgodea@ottawa.ca> rejected RCPT <rsvp@balug.org>: SPF check failed.
+-04-28 03:50:56 H=(smail1.vub.sk) [222.77.253.120] F=<jhylunrrhc@swebolt.se> rejected RCPT <rsvp@balug.org>: SPF check failed.
+# dig +noall +answer +nottl ottawa.ca. TXT ottawa.ca. SPF swebolt.se. TXT swebolt.se. SPF | fgrep \"v=spf
+ottawa.ca.              IN      TXT     "v=spf1 include:spf.protection.outlook.com include:_spf.esolutionsgroup.ca include:emsd1.com -all"
+swebolt.se.             IN      TXT     "v=spf1 mx ip4:167.99.44.246 include:spf.protection.outlook.com a:smtp05.dgcsystems.net -all"
+# spfquery --scope mfrom --id oefydgodea@ottawa.ca --ip 183.199.220.44; echo "$?"
+fail
+Please see http://www.openspf.org/Why?s=mfrom;id=oefydgodea%40ottawa.ca;ip=183.199.220.44;r=balug-sf-lug-v2.balug.org
+ottawa.ca: Sender is not authorized by default to use 'oefydgodea@ottawa.ca' in 'mfrom' identity (mechanism '-all' matched)
+Received-SPF: fail (ottawa.ca: Sender is not authorized by default to use 'oefydgodea@ottawa.ca' in 'mfrom' identity (mechanism '-all' matched)) receiver=balug-sf-lug-v2.balug.org; identity=mailfrom; envelope-from="oefydgodea@ottawa.ca"; client-ip=183.199.220.44
+# spfquery --scope mfrom --id jhylunrrhc@swebolt.se --ip 222.77.253.120; echo "$?"
+fail
+Please see http://www.openspf.org/Why?s=mfrom;id=jhylunrrhc%40swebolt.se;ip=222.77.253.120;r=balug-sf-lug-v2.balug.org
+swebolt.se: Sender is not authorized by default to use 'jhylunrrhc@swebolt.se' in 'mfrom' identity (mechanism '-all' matched)
+Received-SPF: fail (swebolt.se: Sender is not authorized by default to use 'jhylunrrhc@swebolt.se' in 'mfrom' identity (mechanism '-all' matched)) receiver=balug-sf-lug-v2.balug.org; identity=mailfrom; envelope-from="jhylunrrhc@swebolt.se"; client-ip=222.77.253.120
+#
+</file>
+<file>
+Wrote a handy little program to summarize the exim rejectlog failure from the most recent few such log files:
+# Rejectlog_report
+Unrouteable address
+relay not permitted
+SPF check failed
+SMTP protocol synchronization error (input sent without waiting for greeting)
+maximum allowed line length
+unqualified address not permitted
+SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised)
+missing or malformed local part
+syntactically invalid
+#
+Look at least the top couple items would be good candidates for adding configurations for fail2ban.
+Some others beyond that may also be worth doing - but not as high a priority.
+</file>
+<file>
+// reverted the temporarily increase of max queue time from 4 days to 7 days:
+# awk '{if($1~/^[^#]/||$1~/^#\*/||$0~/^# temp/)print;}' conf.d/retry/30_exim4-config
+*                      *           F,2h,15m; G,16h,1h,1.5; F,4d,6h
+# systemctl reload exim4.service
+#
 </file>