false positive

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
pattonb
Posts: 6
Joined: Sat Jul 01, 2017 3:09 am

false positive

Postby pattonb » Thu Oct 12, 2017 5:12 pm

Am seeing "false positives" in zimbra.log ".....50 4.7.25 Client host rejected: cannot find your hostname....." , Am wondering how this happens.
A dig/nslookup confirms that the fqdn does resolve.


phoenix
Ambassador
Ambassador
Posts: 25160
Joined: Fri Sep 12, 2014 9:56 pm

Re: false positive

Postby phoenix » Thu Oct 12, 2017 5:27 pm

Many things can 'cause' it but you've given no information (nor any log files) about the circumstances under which this problem occurs nor have you mentioned how often this happens nor whether it's a new problem nor anything about your ZCS server and there's also no confirmation about your DNS records (including reverse dns) being correct. You should always post the full output of the following command:

Code: Select all

zmcontrol -v
Regards

Bill

Rspamd: A high performance spamassassin replacement

If you'd like to see this implemented in a future version of ZCS then please vote on Bugzilla entries 97706 & 108168
pattonb
Posts: 6
Joined: Sat Jul 01, 2017 3:09 am

Re: false positive

Postby pattonb » Thu Oct 12, 2017 9:18 pm

zmcontrol -v --> Release 8.7.6_GA_1776.RHEL6_64_20170326144124 RHEL6_64 FOSS edition.

and here is a snippit of the logs.

Oct 12 12:40:45 gw postfix/postscreen[25313]: CONNECT from [72.2.34.28]:17339 to [184.68.103.194]:25
Oct 12 12:40:45 gw postfix/postscreen[25313]: PASS OLD [72.2.34.28]:17339
Oct 12 12:40:45 gw postfix/smtpd[29598]: warning: hostname hrmdf.net does not resolve to address 72.2.34.28
Oct 12 12:40:45 gw postfix/smtpd[29598]: connect from unknown[72.2.34.28]
Oct 12 12:40:45 gw postfix/smtpd[29598]: Anonymous TLS connection established from unknown[72.2.34.28]: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)
Oct 12 12:40:45 gw postfix/smtpd[29598]: NOQUEUE: filter: RCPT from unknown[72.2.34.28]: <user@highriver.ca>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10026; from=<user@highriver.ca> to=<user@outlookrealty.ca> proto=ESMTP helo=<mail.hrmdf.net>
Oct 12 12:40:45 gw postfix/smtpd[29598]: NOQUEUE: filter: RCPT from unknown[72.2.34.28]: <user@highriver.ca>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10024; from=<user@highriver.ca> to=<user@outlookrealty.ca> proto=ESMTP helo=<mail.hrmdf.net>
Oct 12 12:40:45 gw postfix/smtpd[29598]: NOQUEUE: reject: RCPT from unknown[72.2.34.28]: 450 4.7.25 Client host rejected: cannot find your hostname, [72.2.34.28]; from=<user@highriver.ca> to=<user@outlookrealty.ca> proto=ESMTP helo=<mail.hrmdf.net>
Oct 12 12:40:45 gw postfix/smtpd[29598]: disconnect from unknown[72.2.34.28] ehlo=2 starttls=1 mail=1 rcpt=0/1 quit=1 commands=5/6
Oct 12 12:41:46 gw postfix/postscreen[25313]: CONNECT from [72.2.34.28]:17358 to [184.68.103.194]:25
Oct 12 12:41:46 gw postfix/postscreen[25313]: PASS OLD [72.2.34.28]:17358
Oct 12 12:41:46 gw postfix/smtpd[29598]: warning: hostname hrmdf.net does not resolve to address 72.2.34.28

I have edited the email to and from, other than that, the pertinent info is there.

frequently I see the "cannot find your hostname " mean, ptr lookup failed. In this example the ptr is fine.

dig -x 72.2.34.28
;; ANSWER SECTION:
28.34.2.72.in-addr.arpa. 66892 IN PTR hrmdf.net.
28.34.2.72.in-addr.arpa. 66892 IN PTR mail.hrmdf.net.

I wonder if having 2 answers is the issue.
phoenix
Ambassador
Ambassador
Posts: 25160
Joined: Fri Sep 12, 2014 9:56 pm

Re: false positive

Postby phoenix » Fri Oct 13, 2017 4:58 am

pattonb wrote:28.34.2.72.in-addr.arpa. 66892 IN PTR hrmdf.net.

I wonder if having 2 answers is the issue.
That's exactly the problem and the record above is not a valid hostname and it's required to be that - remove that entry and it will be fine.
Regards

Bill

Rspamd: A high performance spamassassin replacement

If you'd like to see this implemented in a future version of ZCS then please vote on Bugzilla entries 97706 & 108168

Return to “Administrators”

Who is online

Users browsing this forum: Google [Bot] and 16 guests