SMTP too busy!!!

Discussions on webmail and the Professional version.
Post Reply
moegal
Posts: 118
Joined: Mon Feb 09, 2004 10:30 pm

SMTP too busy!!!

Post by moegal »

Help! I am getting the following after well over a year of running great.

*************
An unknown error has occured. Account: 'marty@moegal.com', Server: 'mail.moegal.com', Protocol: SMTP, Server Response: '451 ESMTP MailEnable Service temporarily refused connection at 03/28/06 17:10:19 from IP (71.3.11.24) because the server is too busy.' Port 25, Secure(SSL): No, Server Error: 451, Error Number: 0x800CCC6A

The server is not running that hard and i've change the threads to 64 from 16, temporarily. I did not restart the service though.

Thanks,

Marty

oldgoat
Posts: 2
Joined: Tue Mar 28, 2006 10:14 pm

Post by oldgoat »

I saw that same error when I added a domain that got a lot of spam. It seemed like the spammers would open a connection, mail enable would give an error either because they were blacklisted or sending to invalid users, but then ME wouldn't close the connection, and the spammers would keep the connection open indefinitely. Eventually so many connections were left open (and idle) that ME would stop accepting new ones with the same error you mention above. I gave up, and ME's support didn't help me so I just outsourced the mail hosting for that domain.

moegal
Posts: 118
Joined: Mon Feb 09, 2004 10:30 pm

Post by moegal »

Well thanks. I've put in a support ticket and have been discussing it with Ben. Nothing yet though.

moegal
Posts: 118
Joined: Mon Feb 09, 2004 10:30 pm

Post by moegal »

Ben spent over 3 hours helping out yesterday on my server. Here is what he said.

****************************
Lowered the connection error on inbound to 3 before dropping connection this will help against some attacks leaving connections open.

Raised Connections to 200 (this can be lowered later but not necessary, I
would review the log sizes and when they go down if they do then lower this with them.) At the moment todays is 2mb normally your whole says log is about 1.5 mb)

Lowered timeout from 1000 to 500 (you can leave this)

Turned on some SMTP security. Reject mail if sender is from an invalid domain this may help some spam messages get blocked.
******************************

It is working now so I will keep you posted. Further, I installed the latest version early this morning.

Marty

moegal
Posts: 118
Joined: Mon Feb 09, 2004 10:30 pm

Post by moegal »

We made it a whole day without a "...too busy" error. Looks like it worked. Thanks Ben.

Marty

Rooey123
Posts: 50
Joined: Thu Mar 10, 2005 8:05 am

Help

Post by Rooey123 »

We need someone's help. We got the server too busy error today. After diggin deeper we found that someone had pointed a domain to our servers, which we don't service.

Additionally, we found that this domain was being spammed to death.

Since we couldn't change the domain, I created the Mail server on our Server, and Disabled it. Still the spammers hit the server.

See a portion of the log:

05/25/06 16:19:56 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:junta@egsclaw.com]) has been disabled.
05/25/06 16:19:56 ME-I0074: (Debug) [728] end of conversation
05/25/06 16:19:56 ME-I0074: (Debug) [568] end of conversation
05/25/06 16:19:57 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:hutley@egsclaw.com]) has been disabled.
05/25/06 16:19:57 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:igalit@egsclaw.com]) has been disabled.
05/25/06 16:19:58 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:jleft@egsclaw.com]) has been disabled.
05/25/06 16:19:58 ME-I0074: (Debug) [552] end of conversation
05/25/06 16:19:58 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:jwitt@egsclaw.com]) has been disabled.
05/25/06 16:19:58 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:joncon@egsclaw.com]) has been disabled.
05/25/06 16:19:59 ME-I0074: (Debug) [724] end of conversation
05/25/06 16:19:59 ME-I0074: (Debug) [648] end of conversation
05/25/06 16:19:59 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:kanwal@egsclaw.com]) has been disabled.
05/25/06 16:19:59 ME-I0074: (Debug) [660] end of conversation
05/25/06 16:19:59 ME-I0074: (Debug) [612] end of conversation
05/25/06 16:19:59 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:jeeaton@egsclaw.com]) has been disabled.
05/25/06 16:19:59 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:jehmac@egsclaw.com]) has been disabled.
05/25/06 16:20:00 ME-I0074: (Debug) [776] end of conversation
05/25/06 16:20:00 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:karnofski@egsclaw.com]) has been disabled.
05/25/06 16:20:00 ME-I0074: (Debug) [412] end of conversation
05/25/06 16:20:00 ME-I0074: (Debug) [548] end of conversation
05/25/06 16:20:00 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:grignon@egsclaw.com]) has been disabled.
05/25/06 16:20:01 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:kastanes@egsclaw.com]) has been disabled.
05/25/06 16:20:01 ME-I0069: (recv) socket [380] was gracefully closed 201.240.242.206 before any command received. Remote client closed the connection.
05/25/06 16:20:01 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:jhaveri@egsclaw.com]) has been disabled.
05/25/06 16:20:01 ME-I0074: (Debug) [380] end of conversation
05/25/06 16:20:02 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:jibber@egsclaw.com]) has been disabled.
05/25/06 16:20:02 ME-I0074: (Debug) [816] end of conversation
05/25/06 16:20:02 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:jfraser@egsclaw.com]) has been disabled.
05/25/06 16:20:02 ME-I0074: (Debug) [420] end of conversation
05/25/06 16:20:02 ME-I0074: (Debug) [900] end of conversation
05/25/06 16:20:02 ME-I0074: (Debug) [824] end of conversation
05/25/06 16:20:02 ME-I0074: (Debug) [404] end of conversation
05/25/06 16:20:03 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:jillane@egsclaw.com]) has been disabled.
05/25/06 16:20:03 ME-I0074: (Debug) [376] end of conversation
05/25/06 16:20:03 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:judys@egsclaw.com]) has been disabled.
05/25/06 16:20:03 ME-I0074: (Debug) [672] end of conversation
05/25/06 16:20:03 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:karpf@egsclaw.com]) has been disabled.
05/25/06 16:20:03 ME-I0074: (Debug) [872] end of conversation
05/25/06 16:20:03 ME-I0074: (Debug) [412] end of conversation
05/25/06 16:20:04 ME-I0074: (Debug) [836] end of conversation
05/25/06 16:20:04 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:kastning@egsclaw.com]) has been disabled.
05/25/06 16:20:04 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:karto@egsclaw.com]) has been disabled.
05/25/06 16:20:05 ME-I0074: (Debug) [572] end of conversation
05/25/06 16:20:05 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:intima@egsclaw.com]) has been disabled.
05/25/06 16:20:05 ME-I0074: (Debug) [924] end of conversation
05/25/06 16:20:05 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:jonesse@egsclaw.com]) has been disabled.
05/25/06 16:20:05 ME-I0074: (Debug) [664] end of conversation
05/25/06 16:20:05 ME-I0074: (Debug) [820] end of conversation
05/25/06 16:20:06 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:kamalm@egsclaw.com]) has been disabled.
05/25/06 16:20:06 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:jungs@egsclaw.com]) has been disabled.
05/25/06 16:20:06 ME-I0074: (Debug) [772] end of conversation
05/25/06 16:20:06 ME-I0074: (Debug) [396] end of conversation
05/25/06 16:20:06 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:jszeder@egsclaw.com]) has been disabled.
05/25/06 16:20:06 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:jaenke@egsclaw.com]) has been disabled.
05/25/06 16:20:07 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:kaseko@egsclaw.com]) has been disabled.
05/25/06 16:20:07 ME-I0074: (Debug) [540] end of conversation
05/25/06 16:20:07 ME-I0074: (Debug) [544] end of conversation
05/25/06 16:20:07 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:kager@egsclaw.com]) has been disabled.
05/25/06 16:20:07 ME-I0074: (Debug) [672] end of conversation
05/25/06 16:20:07 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:jorgy@egsclaw.com]) has been disabled.
05/25/06 16:20:07 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:gdias@egsclaw.com]) has been disabled.
05/25/06 16:20:08 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:ibkin@egsclaw.com]) has been disabled.
05/25/06 16:20:08 ME-I0074: (Debug) [760] end of conversation
05/25/06 16:20:08 ME-I0074: (Debug) [660] end of conversation
05/25/06 16:20:08 ME-E0105: Local Delivery: Failure - Domain for ([SMTP:hybodus@egsclaw.com]) has been disabled.
05/25/06 16:20:09 ME-E0105: Local Delivery: Failure - Domain for


Question:

HOW CAN WE STOP THESE PEOPLE!! They are using spoofed IP addresses, so we can't just ban the IP. We need to somehow say Refuse any connection for this domain - egsclaw.com

Can anyone Help? Thoughts?

mammdo
Posts: 35
Joined: Tue Nov 16, 2004 7:21 pm
Location: México

Post by mammdo »

Use ASSP as a firewall proxy before anything can reach my MailEnable server, ASSP deals with all spam and let mailEnable do his job

works great!!

but be careful, needs a lot of time for configure it. and have many options to use, be carefull with this options

sdp
Posts: 4
Joined: Fri Oct 22, 2004 12:31 pm

Post by sdp »

moegal wrote:Raised Connections to 200 (this can be lowered later but not necessary, I
would review the log sizes and when they go down if they do then lower this with them.) At the moment todays is 2mb normally your whole says log is about 1.5 mb)
Thanks for the hint! But this config, where is it? I find all other but not this one. Thanks

mammdo
Posts: 35
Joined: Tue Nov 16, 2004 7:21 pm
Location: México

Post by mammdo »

That's the hard part, the cofing is so extense and you have to do step bystep, you will need that MailEnable listen on 127.0.0.1:25 for inbound connections and let ASSP listen on your public IP:25 as MailEnable do

Then, you need to put every config in test mode and change it to normal mode when you know that s is working fine.

My ASSP blocks (not filter) the 90% of REAL SPAM and the other 10% is filtered to my clients with a subject mark [SPAM]

If a real SPAM in the 90% gets a 550 Error, or simply deny the SMTP connection by his IP

Please read all the docs, every server is diferent.

Post Reply