Tracing email

am 31.10.2005 01:42:19 von BobW

I don't even know if this message will make it to the newsgroup but I'm
trying. Here's my problem...

DSL Modem was reset to factory settings. Major pain in the backside getting
things back to what I THINK is working. Everything's fine except I can't
seem to send or receive email externally. I'm running Sendmail and I can
send mail all over INSIDE my network but I can't seem to get mail to go out,
nor can I send mail from outside to inside. I was down for probably 14
hours +/- 2 hours and it seems DNS is working both inside and out, I'm able
to get to websites, ftp from outside, and even read news groups.

What I'm hoping to find is some way to trace where an email message is going
when it leaves my Sendmail server to try and find where it's getting
stopped/blocked/deleted.

Again, I'm able to read the newsgroup but no email. (Fingers crossed that
this makes it to the newsgroup!)

TIA
Bob

Re: Tracing email

am 31.10.2005 02:23:54 von Sam

Re: Tracing email

am 31.10.2005 02:45:40 von Mike Heins

On 2005-10-31, BobW wrote:
> I don't even know if this message will make it to the newsgroup but I'm
> trying. Here's my problem...
>
> DSL Modem was reset to factory settings. Major pain in the backside getting
> things back to what I THINK is working. Everything's fine except I can't
> seem to send or receive email externally.

Most ISPs no longer allow port 25 traffic.

> I'm running Sendmail and I can
> send mail all over INSIDE my network but I can't seem to get mail to go out,
> nor can I send mail from outside to inside.

This is in line with port 25 being closed by your ISP.

--
Mike Heins
Perusion -- Expert Interchange Consulting http://www.perusion.com/

Be patient. God isn't finished with me yet. -- unknown

Re: Tracing email

am 31.10.2005 02:49:50 von Mark Crispin

Are you certain that your mail is leaving your sendmail server?

Check your mail logs (pointed to by /etc/syslog.conf) and see if it is
establishing outgoing connections and delivering the mail. If your
outgoing mail is stuck on the local system, you should probably see error
messages in the mail logs. Those messages are usually a good indication
of what is wrong.

For example:
% grep mail /etc/syslog.conf
mail.* /var/log/mail.log
shows that your mail log is in a file called /var/log/mail.log. Start
looking at the end of that file, e.g.,
% tail /var/log/mail.log
or go through it with your favorite editor.

If mail is leaving your sendmail server and appears to be delivered
elsewhere, then you need to check at that point. Repeat until either it's
out of your hands or you found the point where it gets stuck/lost.

As for incoming mail, see if you can do the command:
% telnet localhost 25
You should get connected and a greeting message starting with "220" (just
type "quit" and return to get out). If not, then your SMTP server isn't
listening, and you need to figure out why that is happening.

What I'm about to suggest is somewhat akin to using a sledgehammer to
drive in a thumbtack. If your system hasn't been rebooted since you fixed
your DSL modem settings, try rebooting. It could be that sendmail started
up with the wrong network configuration. There *are* more elegant ways to
clear up such problems, but this is the simplest; and anyway, you want to
make sure that it'll work after a reboot anyway. If rebooting fixes the
problem, then don't worry about it.

Good luck!

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.

Re: Tracing email

am 31.10.2005 02:52:58 von Mark Crispin

On Mon, 31 Oct 2005, Mike Heins wrote:
> Most ISPs no longer allow port 25 traffic.

If that's his problem (and it very well could be) then presumably he's
been given instructions by his ISP on how to send mail including what port
and/or authentication credentials he should use.

Also, if that's the case, then mail should be piling up in his local mail
queue and the mail logs should have "timeout" or "refused" errors. Hence
the first stop is to check the mail queue and the mail logs.

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.

Re: Tracing email

am 31.10.2005 03:25:31 von Alan Connor

On comp.mail.misc, in <11maq3i4im96qb0@corp.supernews.com>, "BobW" wrote:

So the little would-be spammer or cyberstalker hiding his
posting history and identity by using a common name for a
throw-away alias wants to know how to keep people from tracking
him down?

And no NNTP-Posting-Host IP in your headers.

Whatta coincidence.

Piss off.

[Note: I don't read the posts of "Sam" or any of his
many aliases, nor any responses to them.]

I'll leave you to incompents like "Sam" and his sockpuppets.
That bozo can't even get a mail into my mailboxes.

AC

--
URLs in headers.

FAQ: Canonical list of questions Beavis refuses to answer (V1.40) (was Re: Tracing email)

am 31.10.2005 04:27:27 von Sam

This is a MIME GnuPG-signed message. If you see this text, it means that
your E-mail or Usenet software does not support MIME signed messages.
The Internet standard for MIME PGP messages, RFC 2015, was published in 1996.
To open this message correctly you will need to install E-mail or Usenet
software that supports modern Internet standards.

--=_mimegpg-commodore.email-scan.com-7492-1130729253-0003
Content-Type: text/plain; format=flowed; charset="US-ASCII"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Usenet Beavis writes:

> [ nothing of importance ]

> Piss off.

You first, Beavis.

> [Note: it's not my fault that I'm a complete dumbass. I was dropped
> on my head as a child. See http://angel.1jh.com/nanae/kooks/alanconnor.shtml
> for more information]
>
> I'll leave you to some words of wisdom from "Sam", my mental superior.

Right on cue, Beavis.

============================================================ ===============

FAQ: Canonical list of questions Beavis refuses to answer (V1.40)

This is a canonical list of questions that Beavis never answers. This FAQ is
posted on a semi-regular schedule, as circumstances warrant.

For more information on Beavis, see:

http://angel.1jh.com/nanae/kooks/alanconnor.shtml

Although Beavis has been posting for a long time, he always remains silent
on the subjects enumerated below. His response, if any, usually consists of
replying to the parent post with a loud proclamation that his Usenet-reading
software runs a magical filter that automatically identifies anyone who's
making fun of him, and hides those offensive posts. For more information
see question #9 below.

============================================================ ================

1) If spammers avoid forging real E-mail addresses on spam, then where do
all these bounces everyone reports getting (for spam with their return
address was forged onto) come from?

2) If your Challenge-Response filter is so great, why do you still munge
when posting to Usenet?

3) Do you still believe that rsh is the best solution for remote access?
(http://tinyurl.com/5qqb6)

4) What is your evidence that everyone who disagrees with you, and thinks
that you're a moron, is a spammer?

5) How many different individuals do you believe really post to
comp.mail.misc? What is the evidence for your paranoid belief that everyone,
except you, who posts here is some unknown arch-nemesis of yours?

6) How many times, or how often, do you believe is necessary to announce
that you do not read someone's posts? What is your reason for making these
regularly-scheduled proclamations? Who do you believe is so interested in
keeping track of your Usenet-reading habits?

7) When was the last time you saw Bigfoot (http://tinyurl.com/23r3f)?

8) If your C-R system employs a spam filter so that it won't challenge spam,
then why does any of the mail that passes the filter, and is thusly presumed
not to be spam, need to be challenged?

9) You claim that the software you use to read Usenet magically identifies
any post that makes fun of you. In http://tinyurl.com/3swes you explain
that "What I get in my newsreader is a mock post with fake headers and no
body, except for the first parts of the Subject and From headers."

Since your headers indicate that you use slrn and, as far as anyone knows,
the stock slrn doesn't work that way, is this interesting patch to slrn
available for download anywhere?

10) You regularly post alleged logs of your procmail recipe autodeleting a
bunch of irrelevant mail that you've received. Why, and who exactly do you
believe is interested in your mail logs?

11) How exactly do you "enforce" an "order" to stay out of your mailbox,
supposedly (http://tinyurl.com/cs8jt)? Since you issue this "order" about
every week, or so, apparently nobody wants to follow it. What are you going
to do about it?

12) What's with your fascination with shit? (also http://tinyurl.com/cs8jt)?

13) You complain about some arch-nemesis of yours always posting forged
messages in your name. Can you come up with even a single URL, as an example
of what you're talking about?

14) You always complain about some mythical spammers that pretend to be
spamfighters (http://tinyurl.com/br4td). Who exactly are those people, and
can you post a copy of a spam that you supposedly received from them, that
proves that they're really spammers, and not spamfighters?

--=_mimegpg-commodore.email-scan.com-7492-1130729253-0003
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.7 (GNU/Linux)

iD8DBQBDZY8lx9p3GYHlUOIRAvSwAJ0S/B1JpHYlQzay4Bt92UwZfpP1+gCf XzF6
bij9kg0O0mOvL76ZXcGcXaE=
=EaM/
-----END PGP SIGNATURE-----

--=_mimegpg-commodore.email-scan.com-7492-1130729253-0003--

Re: FAQ: Canonical list of questions Beavis refuses to answer (V1.40) (was Re: Tracing email

am 31.10.2005 05:42:02 von Alan Connor

On comp.mail.misc, in , "Sam" wrote:

One more time: I can't refuse to answer questions I have never
been asked.

I haven't read any of your stupid and obnoxious posts in years.

If someone hadn't told me, I wouldn't even know that you meant
me when you used the name "Beavis".

Don't like how I do things "Sam"?

Feel free to dine on solid human wastes.

And thank you for wearing a gag when you are in my newsreader.

(Not that you have any choice in the matter.)

Let me guess: "BobW" is _you_.

Isn't it amazing what an ignorant child can do with their
Mommy's computer and their Daddy's credit card and a
beginner's Operating System like Windows.

AC

--
Homepage: http://home.earthlink.net/~alanconnor/
Fanclub: http://www.pearlgates.net/nanae/kooks/alanconnor.shtml

(was/still is) Re: Tracing email

am 31.10.2005 07:54:42 von BobW

>
> Let me guess: "BobW" is _you_.
>
Nope. I'm not this Sam guy. For some reason, I can't even read what he's
posting. It all seems to get rolled into an attachment. I see an entry in
the news reader but I guess I'm lucky.

As for my current situation, I am able to get proper responses from the
TELNET to port 25. I also seem to have finally gotten a message at my work
email address, which is what I'm using to test. It seemed to take awhile to
get there but get there it did.

I have, finally, received an error message, I'm pretty sure, from my
sendmail system. It says that while it was talking with my work's email
site that:
"<<< 452 Unable to accept message because the server is out of disk
space. ... Deferred: 452 Unable to accept message
because the server is out of disk space.
Warning: message still undelivered after 4 hours
Will keep trying until message is 5 days old"

I'm not sure which system has the full disk. My system's seem to be fine
with the main partition only at 83% full, and if work was full I would have
been called in LONG before this. Also, I don't see why I wouldn't be
getting ANY incoming email unless there really is a full disk somewhere, but
who's?

Again, I have gotten a message to go from home to work by nothing seems to
be getting through from work to home. I have received an error message at
home but no error messages at work. Normally, I get anywhere from 30 to 50
emails a day so it's not that it's just been quiet.

I have rebooted/power-cycled everything, down to the hubs I use, and it all
appears to have come back up normally and without any errors. Is it
possible I've set something in my DSL modem differently that could cause
this?

Once again, TIA
BobW

Re: (was/still is) Re: Tracing email

am 31.10.2005 08:36:30 von Alan Connor

On comp.mail.misc, in <11mbftlgba40m24@corp.supernews.com>, "BobW" wrote:

That's supposed to be a properly-formatted email address in your
From header. It's supposed to have an "@".

If you don't want your real email address there, put the munged
version in your signature, and put a ".invalid" at the end of
whatever fake address you put in your From header.

[Note: I don't read the posts of "Sam" or any of his
many aliases, nor any responses to them.]

AC

--
Homepage: http://home.earthlink.net/~alanconnor/
Fanclub: http://www.pearlgates.net/nanae/kooks/alanconnor.shtml

Re: (was/still is) Re: Tracing email

am 31.10.2005 11:07:09 von BobW

I'm a bit confused, here. If I've pissed in your corn flakes somewhere
along the line, please forgive me as I wasn't aware. If you want my direct
email, I'm more than happy to give it to you. I just don't need more mass
mailers sending me "Viagla" advertisements once my problem is solved. My
email address is bobw56 at rkwco dot com.

Again, I'm sorry if I've done something wrong or improper. It was not
intentional if I have.

"Alan Connor" wrote in message
news:slrndmbic7.59o.i3x9mdw@b29x3m.invalid...
> On comp.mail.misc, in <11mbftlgba40m24@corp.supernews.com>, "BobW" wrote:
>
>
> That's supposed to be a properly-formatted email address in your
> From header. It's supposed to have an "@".
>
> If you don't want your real email address there, put the munged
> version in your signature, and put a ".invalid" at the end of
> whatever fake address you put in your From header.
>
> [Note: I don't read the posts of "Sam" or any of his
> many aliases, nor any responses to them.]
>
> AC
>
>
> --
> Homepage: http://home.earthlink.net/~alanconnor/
> Fanclub: http://www.pearlgates.net/nanae/kooks/alanconnor.shtml

Re: (was/still is) Re: Tracing email

am 31.10.2005 11:50:34 von Frank Slootweg

BobW wrote:
> I'm a bit confused, here. If I've pissed in your corn flakes somewhere
> along the line, please forgive me as I wasn't aware. If you want my direct
> email, I'm more than happy to give it to you. I just don't need more mass
> mailers sending me "Viagla" advertisements once my problem is solved. My
> email address is bobw56 at rkwco dot com.
>
> Again, I'm sorry if I've done something wrong or improper. It was not
> intentional if I have.

See Sam's FAQ posting and all will be revealed.

Re: (was/still is) Re: Tracing email

am 31.10.2005 12:05:23 von BobW

> See Sam's FAQ posting and all will be revealed.

I wish I could but I can't because all of his posts are put into an
attachment and I can't seem to look at his attachments. They are named
"att00234.txt" and "att00247.dat" with different sizes. They are grayed out
as well as the "save attachments" so I can't get to them in any form I'm
aware of. All of his messages are like that. I did see one message that
someone else replied to and left some of his remarks.

Thanks
BobW

Re: FAQ: Canonical list of questions Beavis refuses to answer (V1.40) (was Re: Tracing email)

am 31.10.2005 12:52:43 von Sam

Re: (was/still is) Re: Tracing email

am 31.10.2005 12:53:32 von Sam

Re: (was/still is) Re: Tracing email

am 31.10.2005 17:27:58 von Mark Crispin

On Sun, 30 Oct 2005, BobW wrote:
> I'm not sure which system has the full disk. My system's seem to be fine
> with the main partition only at 83% full, and if work was full I would have
> been called in LONG before this.

From your description, it is the system at work which has a full disk.
If you have multiple disks/partitions, look to see which one holds
/var/spool/mail, /tmp, and /var/tmp. One of these is full.

> Also, I don't see why I wouldn't be
> getting ANY incoming email unless there really is a full disk somewhere, but
> who's?

If your work system is the relay for your incoming mail, that would
explain it.

> Again, I have gotten a message to go from home to work by nothing seems to
> be getting through from work to home. I have received an error message at
> home but no error messages at work. Normally, I get anywhere from 30 to 50
> emails a day so it's not that it's just been quiet.

Log in at work, do a "df" to see the status of all disks/partitions, and
check the mailer logs there. You should do the same on your own system,
just to be sure. Your description makes it sound like it is the system at
work, but it doesn't hurt to double-check.

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.

Re: (was/still is) Re: Tracing email

am 31.10.2005 17:34:19 von Mark Crispin

On Mon, 31 Oct 2005, BobW wrote:
> Again, I'm sorry if I've done something wrong or improper. It was not
> intentional if I have.

Please do not concern yourself with the rants of an individual with known
mental health problems.

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.

Re: (was/still is) Re: Tracing email

am 31.10.2005 18:01:21 von Steve Baker

On Mon, 31 Oct 2005 02:07:09 -0800, "BobW" wrote:

>I'm a bit confused, here. If I've pissed in your corn flakes somewhere
>along the line, please forgive me as I wasn't aware. If you want my direct
>email, I'm more than happy to give it to you. I just don't need more mass
>mailers sending me "Viagla" advertisements once my problem is solved. My
>email address is bobw56 at rkwco dot com.

Alan is an idiot, pay him no mind.

That "no space" message was about your server at work.

It looks like you're talking about the domain rkwco dot com. The
problem there is the DNS situation... you don't have any. To sum it up,
two of the listed nameservers never heard of you, and the third is off
the air.

Steve Baker

====================
$ dig @i.gtld-servers.net rkwco.com
....
;; AUTHORITY SECTION:
rkwco.com. 172800 IN NS animal.blarg.net.
rkwco.com. 172800 IN NS guysmiley.blarg.net.
rkwco.com. 172800 IN NS ns1.rkwco.com.

;; ADDITIONAL SECTION:
animal.blarg.net. 172800 IN A 206.124.128.1
guysmiley.blarg.net. 172800 IN A 206.124.128.3
ns1.rkwco.com. 172800 IN A 206.124.140.37
====================
$ dig @animal.blarg.net rkwco.com
....
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
....
;; SERVER: 206.124.128.1#53(animal.blarg.net)
===================
animal.blarg.net is not authoritative for rkwco.com

===================
$ dig @guysmiley.blarg.net rkwco.com
....
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
....
;; SERVER: 206.124.128.3#53(guysmiley.blarg.net)
===================
guysmiley.blarg.net is not authoritative for rkwco.com

===================
$ dig @206.124.140.37 rkwco.com
....
;; connection timed out; no servers could be reached

Re: (was/still is) Re: Tracing email

am 31.10.2005 19:53:08 von Mark Crispin

On Mon, 31 Oct 2005, Steve Baker wrote:
> It looks like you're talking about the domain rkwco dot com. The
> problem there is the DNS situation... you don't have any. To sum it up,
> two of the listed nameservers never heard of you, and the third is off
> the air.

Good catch. It looks like you have Blarg's server set up to be secondary
to be your primary ns1.rkwco.com server at 206.124.140.37. If you're like
most Blarg SOHO customers, your DSL modem is at 206.124.140.33 and you
have 5 other IPs between 34 and 38.

From the outside, your DSL modem seems to be flapping up and down, and
none of the other IPs on your network are responding to pings or
connections to your SMTP port (although you may have them in stealth mode
or packet filters).

This isn't the cause of your problem, but when you get some free time you
should change your domain registration so the Blarg serves are
ns1.blarg.net and ns2.blarg.net instead of the old animal and guysmiley
names.

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.

Re: (was/still is) Re: Tracing email

am 31.10.2005 21:03:30 von BobW

Thank you, Steve. This got me going in the right direction. I had a tunnel
from the DSL Modem to my DNS server that was missing so the outside couldn't
find anything inside. My system is now happily filling my inbox with oodles
of spam and viruses that I had come so accustom to deleting. dance> I also need to check on those other two DNS servers and make sure
I'm suppose to be using them.

BobW

"Steve Baker" wrote in message
news:bqicm1hdk67oeio49br2fuss1mpt6j4u33@4ax.com...
> On Mon, 31 Oct 2005 02:07:09 -0800, "BobW" wrote:
>
> That "no space" message was about your server at work.
>
> It looks like you're talking about the domain rkwco dot com. The
> problem there is the DNS situation... you don't have any. To sum it up,
> two of the listed nameservers never heard of you, and the third is off
> the air.
>
> Steve Baker
>
> ====================
> $ dig @i.gtld-servers.net rkwco.com
> ...
> ;; AUTHORITY SECTION:
> rkwco.com. 172800 IN NS animal.blarg.net.
> rkwco.com. 172800 IN NS guysmiley.blarg.net.
> rkwco.com. 172800 IN NS ns1.rkwco.com.
>
> ;; ADDITIONAL SECTION:
> animal.blarg.net. 172800 IN A 206.124.128.1
> guysmiley.blarg.net. 172800 IN A 206.124.128.3
> ns1.rkwco.com. 172800 IN A 206.124.140.37
> ====================
> $ dig @animal.blarg.net rkwco.com
> ...
> ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
> ...
> ;; SERVER: 206.124.128.1#53(animal.blarg.net)
> ===================
> animal.blarg.net is not authoritative for rkwco.com
>
> ===================
> $ dig @guysmiley.blarg.net rkwco.com
> ...
> ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
> ...
> ;; SERVER: 206.124.128.3#53(guysmiley.blarg.net)
> ===================
> guysmiley.blarg.net is not authoritative for rkwco.com
>
> ===================
> $ dig @206.124.140.37 rkwco.com
> ...
> ;; connection timed out; no servers could be reached

Re: (was/still is) Re: Tracing email

am 31.10.2005 21:56:35 von BobW

You guys are the greatest! Thanks for your comments, Mark. I'll be sure to
do that in the next day or two.

I'm documenting everything in the setup, now that it's working, and I'm
going to staple it all together so I know which page goes with which
configuration.

Thanks again!
BobW

Re: (was/still is) Re: Tracing email

am 31.10.2005 22:52:59 von Steve Baker

On Mon, 31 Oct 2005 12:03:30 -0800, "BobW" wrote:

>My system is now happily filling my inbox with oodles
>of spam and viruses...

Oh, good, I love a happy ending. ;-)

Steve Baker

Re: (was/still is) Re: Tracing email

am 01.11.2005 00:39:27 von Alan Connor

On comp.mail.misc, in , "Steve Baker" wrote:

Yet another one of "Sam's" sockpuppets.

You, know, I honestly think that this fool thinks that I
read the shit he posts.

And that I care what he thinks.

Wrong, "Sam".

AC

--
See my headers.

Meet the Beavis (was Re: (was/still is) Re: Tracing email)

am 01.11.2005 01:59:42 von Sam

[OT] OE: How to see full posting. (was: (was/still is) Re: Tracing email)

am 01.11.2005 11:20:25 von Frank Slootweg

BobW wrote:
> > See Sam's FAQ posting and all will be revealed.
>
> I wish I could but I can't because all of his posts are put into an
> attachment and I can't seem to look at his attachments. They are named
> "att00234.txt" and "att00247.dat" with different sizes. They are grayed out
> as well as the "save attachments" so I can't get to them in any form I'm
> aware of. All of his messages are like that. I did see one message that
> someone else replied to and left some of his remarks.

I see that you are using Outlook Express. In OE I also see these
attachments, but for me they are not grayed out and I can open them (the
..txt file is the actual body of Sam's posting; the .dat file is his PGP
signature, so you can skip that).

I don't know why you can not open the attachments (perhaps one
of your Tools->Options... settings?).

I thought you might have the "Do not allow attachments to be saved or
opened that could potentially be a virus." setting switched on (Tools ->
Options... -> Security -> Virus Protection), but that only hides the
..dat file, but still shows the .txt file and allows it to be opened. So
it must be something else.

In any case, what should work is this:

- Open the article in it's own window.

- File -> Properties -> Details -> Message Source...
This will open a text window (click the full-screen icon if needed)
with the complete article, i.e. header, PGP 'announcement', body and
PGP signature. Most of the time, only the body is what you are looking
for.

I hope this helps.