Email forwarding no longer working ?

jeveleens

New Member
Hi,

I am using Email forwarding on Zoneedit for my domain (to my IP address but a different port, as my new cable modem is blocking port 25). This worked fine for a month now (I set this up in December when I received the new modem), but stopped working today (Feb 1).

Is it possible that there is a problem with the email forwarding service ?

Thanks

Jan
 

sandy neal

Administrator
Staff member
Hi again

ok...

the mail server isn't accepting connections:

Feb 1 15:07:05 mxc01-zpc postfix/qmgr[27767]: DD8D7122D5F: to=<alfonso@eveleens.net>, relay=none, delay=36668, delays=36668/0/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to 77.248.104.116[77.248.104.116]:2525: Connection refused)

An initial telnet test..... handshake could mean that either mx-caprica's IP is somehow blocked,

Name: mx-caprica.zoneedit.com
Address: 64.68.198.23
Name: mx-caprica.zoneedit.com
Address: 64.68.198.24
or the mail server is listening, but otherwise broken by configuration issues.

regards.
 

jeveleens

New Member
OK, so you are saying that my email server has suddenly started to refuse the connections from mx-caprica ? (or my ISP has blocked mx-caprica's IP ?)
 

sandy neal

Administrator
Staff member
hi again... both would appear to be valid reasons for the deferred status... but the ISP blocking MX-Caprica may not be the issue... as much as a server config issue.

regards.
 

jeveleens

New Member
I did some digging in the postfix log file.

On Sunday, my postfix started to reject emails from 64.68.198.24. This is the first one:

"Jan 31 11:58:18 lion postfix/smtpd[951440]: NOQUEUE: reject: RCPT from mxc02.zoneedit.com[64.68.198.24]: 554 5.7.1 Service unavailable; Client host [64.68.198.24] blocked using bl.spamcop.net"

as the server was suddenly on the blacklist of spamcop.net. Same for the other mail server (64.68.198.24)

"Jan 31 12:11:47 lion postfix/smtpd[952246]: NOQUEUE: reject: RCPT from mxc01.zoneedit.com[64.68.198.23]: 554 5.7.1 Service unavailable; Client host [64.68.198.23] blocked using bl.spamcop.net"

My postfix server received several more attempts from your servers (all rejected for the same reason), until 15:55 on 31st.

After that the logs show no more connection requests from your servers in my mail log. There were some connections requests from other servers (which are 'random' (spam attempts) and got rejected), so it shows that my postfix is still reachable.

I also tested the connection to my postfix server on my port 2525 from both within my ISP network and from outside (thru my mobile internet provider) with the help of Telnet, and could see these connection requests coming thru in the log. This leads me to the conclusion that probably your servers IP got also blocked somehow by my ISP as I do not see any connection requests anymore in the log (including the one you posted).

In the mean time I checked on the spamcop.net website and your servers are no longer listed and I also removed this spamcop check from postfix for the moment.
But this has had no effect (as I believe the Zoneedit server now fails to pass the firewall of my ISP)

Would love to hear your view/feedback.
 

sandy neal

Administrator
Staff member
HI again...

its
simply a refusal.

Here's an example, we only get a two word response, so we do not really have anything to guess upon.

Feb 1 15:58:27 mxc01-zpc postfix/qmgr[27767]: 3F4A61285C4: from=<SRS0=LBXd=HD=inspire.pinterest.com=bounces-549650466930167654@srszone.org>, size=108872, nrcpt=1 (queue active) Feb 1 15:58:27 mxc01-zpc postfix/smtp[26032]: 3F4A61285C4: to=<margret@eveleens.net>, relay=none, delay=1.2, delays=1.1/0/0.1/0, dsn=4.4.1, status=deferred (connect to 77.248.104.116[77.248.104.116]:2525: Connection refused)
 

jeveleens

New Member
That indeed is the standard response for reasons like firewall restrictions, inactive servers, misconfiguration and so on. But I can see in my mail log there is on my end no connection request (whereas other connection request, eg with Telnet from outside my ISP come thru), so I have to conclude a firewall is blocking the connection from the Zoneedit servers somewhere.
The problem is I have no way of providing further prove to that. Think if you would try to telnet to my IP:2525 from one of these mailservers you would be able to see if you can see my Postfix prompt or not.

I am stuck right now with no plan B
 

sandy neal

Administrator
Staff member
Hi again...

the most recent logs we have available:

Feb 2 07:55:08 mxc02-zpc postfix/qmgr[788]: 6D614829E7: to=<jan@eveleens.net>, relay=none, delay=129754, delays=129754/0/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to 77.248.104.116[77.248.104.116]:2525: Connection refused)



here there was a change to port 587 , same result:
Feb 2 14:20:10 mxc02-zpc postfix/qmgr[788]: 1DB1E83A3A: to=<jan@eveleens.net>, relay=none, delay=97438, delays=97438/0/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to 77.248.104.116[77.248.104.116]:587: Connection refused)
 

jeveleens

New Member
OK, as a plan B, I moved the server to different physical location with a different ISP and IP address.
My server is successfully receiving emails again now at both ports 25 and 587 (now directly, no longer via your email servers as this ISP is not blocking port 25)
The emails queued at your mail servers have not come in yet (which I would have expected)
Is your server still getting Connection refused when it (re)tries to send the queued messages ?
 

jeveleens

New Member
Just an update. The queued emails on your mail server finally started trickling in yesterday. Not sure I have all of them now, but looking positive.
Still weird that this didn't happen earlier as I moved the server to a different IP and ISP already middle of last week.
 

jeveleens

New Member
Yes, on I wrote earlier in my post on Feb1, my postfix started rejecting emails on Jan 31 from your server as it was on the blacklist of Spamcop.

"Jan 31 11:58:18 lion postfix/smtpd[951440]: NOQUEUE: reject: RCPT from mxc02.zoneedit.com[64.68.198.24]: 554 5.7.1 Service unavailable; Client host [64.68.198.24] blocked using bl.spamcop.net"
 

sandy neal

Administrator
Staff member
ahh OK.. so it turns out spamcop.net let their domain name expire. so until it was renewed and for about 24 -48 hours after it was renewed, all spamcop services were either non existent or very wonky.

its one thing we never thought to look at.

regards...
 

jeveleens

New Member
OK, thanks. That may explain the situation on Sunday 31, but I still do not understand why your mail server continued to get 'Connection refused' when trying to contact my mail server as I removed Spamcop.net from the blacklists already on the Monday (and there was no smtp activity anymore from your server in my postfix logs until last Sunday).

Only on Feb 7, around 14:40 CEST the first contact was again established from mxc02 (a bit later also from mxc01) and started the queued emails coming in. So, effectively for about 1 week mcx01 nor mcx02 were able to get thru to my mail server (and I did not change anything during the weekend on my server, not even a reboot or restart of the postfix server).
In the mean Idid get emails from 64.68.198.156 (edi3) on Feb 5, (probably a notification that i logged in on Zoneedit website). That email went straight to my port 25, as by that time I had moved my server to a different IP and ISP and no longer using the email forward via mxc01 or mxc02 (but it shows that my server was reachable from 64.68.198.xxx)
 
Top