0

I took a look at my postfix logs and I've noticed an odd occurrence lately: SMTP sessions that seem to end right after the RCPT TO, as such:

postfix/smtpd[11333]: > unknown[XXX.XXX.238.86]: 220 [mydomain.com] ESMTP (Ubuntu)
postfix/smtpd[11333]: < unknown[XXX.XXX.238.86]: EHLO LMSPC.[otherdomain.com]
postfix/smtpd[11333]: > unknown[XXX.XXX.238.86]: 250-[mydomain.com]
postfix/smtpd[11333]: > unknown[XXX.XXX.238.86]: 250-PIPELINING
postfix/smtpd[11333]: > unknown[XXX.XXX.238.86]: 250-SIZE 10240000
postfix/smtpd[11333]: > unknown[XXX.XXX.238.86]: 250-ETRN
postfix/smtpd[11333]: > unknown[XXX.XXX.238.86]: 250-STARTTLS
postfix/smtpd[11333]: > unknown[XXX.XXX.238.86]: 250-ENHANCEDSTATUSCODES
postfix/smtpd[11333]: > unknown[XXX.XXX.238.86]: 250-8BITMIME
postfix/smtpd[11333]: > unknown[XXX.XXX.238.86]: 250 DSN
postfix/smtpd[11333]: < unknown[XXX.XXX.238.86]: MAIL From:<tobyami@LMSPC.[otherdomain.com]>
postfix/smtpd[11333]: > unknown[XXX.XXX.238.86]: 250 2.1.0 Ok
postfix/smtpd[11333]: < unknown[XXX.XXX.238.86]: RCPT To:<[myusername]@[mydomain.com]>

For comparison, this is what a "normal" session looks like in my logs:

postfix/smtpd[31674]: > mail-wg0-f52.google.com[74.125.82.52]: 220 [mydomain.com] ESMTP (Ubuntu)
postfix/smtpd[31674]: < mail-wg0-f52.google.com[74.125.82.52]: EHLO mail-wg0-f52.google.com
postfix/smtpd[31674]: > mail-wg0-f52.google.com[74.125.82.52]: 250-[mydomain.com]
postfix/smtpd[31674]: > mail-wg0-f52.google.com[74.125.82.52]: 250-PIPELINING
postfix/smtpd[31674]: > mail-wg0-f52.google.com[74.125.82.52]: 250-SIZE 10240000
postfix/smtpd[31674]: > mail-wg0-f52.google.com[74.125.82.52]: 250-ETRN
postfix/smtpd[31674]: > mail-wg0-f52.google.com[74.125.82.52]: 250-ENHANCEDSTATUSCODES
postfix/smtpd[31674]: > mail-wg0-f52.google.com[74.125.82.52]: 250-8BITMIME
postfix/smtpd[31674]: > mail-wg0-f52.google.com[74.125.82.52]: 250 DSN
postfix/smtpd[31674]: < mail-wg0-f52.google.com[74.125.82.52]: MAIL FROM:<[whatever]@gmail.com> SIZE=1774
postfix/smtpd[31674]: > mail-wg0-f52.google.com[74.125.82.52]: 250 2.1.0 Ok
postfix/smtpd[31674]: < mail-wg0-f52.google.com[74.125.82.52]: RCPT TO:<[my username]@[mydomain.com]>
postfix/smtpd[31674]: > mail-wg0-f52.google.com[74.125.82.52]: 250 2.1.5 Ok
postfix/smtpd[31674]: < mail-wg0-f52.google.com[74.125.82.52]: DATA
postfix/smtpd[31674]: > mail-wg0-f52.google.com[74.125.82.52]: 354 End data with <CR><LF>.<CR><LF>
postfix/smtpd[31674]: > mail-wg0-f52.google.com[74.125.82.52]: 250 2.0.0 Ok: queued as 6346912215C
postfix/smtpd[31674]: < mail-wg0-f52.google.com[74.125.82.52]: QUIT
postfix/smtpd[31674]: > mail-wg0-f52.google.com[74.125.82.52]: 221 2.0.0 Bye

It seems my server doesn't answer with an "Ok" once it gets a RCPT TO in the first case. Things just seem to...stop.

It doesn't bother me too much since I still get mails, and occurrences like the former example seem to all come from IPs either without a reverse DNS or from "weird" domains; as such, I'm assuming they must be spam attempts.

Still, I'm wondering what's happening here. I can't tell who's dropping the connection first, my server or the remote, nor can I tell why the connection would be dropped. If it's on my end, why is it dropped at this point, after the RCPT TO, and not before? If it's on the remote end, why drop it before sending anything, or even before letting my server respond?

EDIT: It seems because smtpd was in verbose mode, it wasn't logging everything, ironically. After disabling verbose mode, I see it's actually rejecting those right after the RCPT TO. Why it wasn't logging that when it was told to be verbose is beyond me, though.

0

It can be for a number of different reasons.

I used to run these tests to see whether a mail server was configured properly (was it setup to accept mail for that particular domain. I had occurences when new mail servers weren't setup properly and then people complained that they hadn't received mail only to realise that they had misconfigured their won systems so I decided to do these tests from then on) prior to cutover on a mail server change.

From a SPAM perspective it can be used to test whether the system is setup as an open relay (misconfigured) allowing for anyone to send email to anyone out on the Internet.

http://en.wikipedia.org/wiki/Open_mail_relay

From a security/intelligence perspective it can be used to determine whether a particular person still works with a firm by determining whether the email address is still present at a firm.

The only other time when I've seen this type of anomaly is with improperly setup security devices, bugs within devices/software, bizarre DoS attacks, and also hardware failure.

  • That's what I thought at first: that it was used to check for an open relay, or to check if the address does exist. However, in the case I mentioned, the connection is dropped before my server answers the RCPT TO. So there's no way to use this to tell if it would have accepted it or not. – ThibautRenaux Feb 28 '15 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.