Subject: smap problem - my e-mail is rejected

From: "Don" <[email-masked]>
Date: Wed, 18 Jul 2001 16:16:02 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi all,

I've been using Ted Keller's anti-relaying & anti-spam version of smap/smapd
for many weeks now.  Suddenly, I have a major problem sending e-mail from my
internal server to and/or through my web server (where the fwtk is
installed).  All the e-mail gets rejected with the message:

"552 your site has been depermitted - no DNS record"

I have gone back to the original version of smap/smapd and it now works.
Can anyone clue me in on why this suddenly happened after several weeks?

---

From: Joseph S D Yao <[email-masked]>
Date: Wed, 18 Jul 2001 17:27:12 -0400

> Can anyone clue me in on why this suddenly happened after several weeks?

Your DNS has changed.  The firewall may be using an old version of DNS,
or something else may have happened, but suddenly it does not have any
record of your site.  Try doing forward and backwards lookups of your
site name and IP address on the firewall machine.  I suspect it is
looking out to the Internet, rather inside, for its information.  OR,
your internal DNS server is not speeaking to it for whatever reason.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
OSIS Center Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Ted Keller <[email-masked]>
Date: Wed, 18 Jul 2001 19:07:52 -0400 (EDT)

Don,

It would almost appear that your DNS server cannot resolve your local
domain (the mail from address).  Sometimes this will happen if your local
e-mail server forgets to masqurade to your domain name - thus listing the
fully qualified domain name on the from address.

Check out the following....

from  your firewall

nslookup
nslookup> set type=any
nslookup> yourdomainname.com

and see what the results are telling you.

ted keller

---

From: "Don" <[email-masked]>
Date: Mon, 23 Jul 2001 09:45:07 -0400

Looking at the /var/log/messages file, I see

Jul 23 09:46:01 lclweb smap[30650]: security:552 - rejected spam from host
myhost.lclcan.com/205.205.137.197 for site lclcan.com - DNS entry not found

However, lclcab.com is in my netperm-table next to the local-domain entry

Following your instructions concerning issuing a nslookup on my localdomain,
I get:

Server:  lclcan.com
Address:  216.94.98.2

lclcan.com
        origin = lclweb.lclcan.com
        mail addr = postmaster.lclcan.com
        serial = 2001012203
        refresh = 3600 (1H)
        retry   = 900 (15M)
        expire  = 1209600 (2W)
        minimum ttl = 43200 (12H)
lclcan.com      nameserver = lclweb.lclcan.com
lclcan.com      nameserver = lclweb.lclcan.com
lclweb.lclcan.com       internet address = 216.94.98.2

It does seem like the domain is being resolved.

Don

---

From: Ted Keller <[email-masked]>
Date: Tue, 24 Jul 2001 00:59:46 -0400 (EDT)

Don,

You mail server is creating the from address as myhost.lclcan.com instead
of masqurading the mail to lclcan.com.  Since myhost is not resolvable -
smap rejects it

ted keller

---

From: "Don" <[email-masked]>
Date: Tue, 24 Jul 2001 15:27:55 -0400

True, however, I have the following line in my netperm-table file which
should negate that:

smap:  local-host   205.205.137.131 205.205.137.132 205.205.137.193
205.205.137.197

The spam error message below shows host 205.205.137.197

Why isn't the above line preventing the spam check?

> > > > [To be removed from this list send the message "unsubscribe
fwtk-users"
> > in the

---

From: "Don" <[email-masked]>
Date: Tue, 24 Jul 2001 15:36:02 -0400

One more note fro the netperm-table file.  Should not the following line
also negate the refusal?

smap:           local-domain    lclcan.com *.lclcan.com

----- Original Message -----
From: "Ted Keller" <[email-masked]>
To: "Don" <[email-masked]>
Cc: "fwtk" <[email-masked]>
Sent: Tuesday, July 24, 2001 12:59 AM
Subject: Re: smap problem - my e-mail is rejected

fwtk-users"

---

From: Ted Keller <[email-masked]>
Date: Tue, 24 Jul 2001 22:16:13 -0400 (EDT)

Don,

The local-host line prevents the relay check.  It does not negate the spam
checks in any way.  Either fix up your sendmail - or add the mail-hosts to
the DNS tables.

ted keller