> Hi again
>
> Yes, 110.66.159.212.is the IP of our mail server and
> mail.mischiefkids.co.uk is our own domain name.
> I did set the controls to disallow everything as you said Thomas,
> and above the disallow I put the mailfoundry range of addresses.
> As some valid mail could not then get through (e.g. coming from
> Yahoo) I had to remove the disallow.

Ok, now that we have the info I think we can see the problem.  Your domain is really
mischiefkids.co.uk and this mail is being routed via the mailfoundry address.  The name
mail.mischiefkids.co.uk is the name assigned to your mail server.  If you sent mail from Yahoo
to user@mischiefkids.co.uk it should have gone through properly.  People should not be
sending to user@mail.mischiefkids.co.uk unless they are spammers and you want them
blocked.  Mail from Yahoo to your domain addressed to user@mischiefkids.co.uk should be
sent via the mailfoundry hosts.  

Answer Section:
    mischiefkids.co.uk, A, 89.145.78.228
    mischiefkids.co.uk, MX, 10, mx1.mailfoundry.com
    mischiefkids.co.uk, MX, 10, mx2.mailfoundry.com

Answer Section:
    mx1.mailfoundry.com, A, 66.18.18.112

Answer Section:
    mx2.mailfoundry.com, A, 66.18.18.113

The domain mail.mischiefkids.co.uk though has no MX records at all.  Any mail to
user@mail.mischiefkids.co.uk is going direct to the server.  

Answer Section:
    mail.mischiefkids.co.uk, A, 212.159.66.110

You are trying to block people from sending mail direct to the server and this address should
not be accepting mail from anything but the mailfoundry MX hosts.


>
> It would seem that Dilbert is correct (thanks for that Dilbert) and
> I will just have to be patient and keep trying the disallow settings
> every few weeks.

Not really, you need to get a tool to check the DNS records for your domain every once in a
while to verify what is being propagated to the world. The site CheckDNS is a good place to
start.  FWIW, I use the free tool Cyberkit to do this sort of thing.

> Thank you for your input and confirming that my DNS settings are
> correct.
> Lynn

Many years ago the Guy who installed our network also installed Mercury & Pegasus for us.

Apart from doing the upgrades we have never needed to alter a thing and everything has run perfectly except that the spam levels have continued to increase until we can no longer cope with them (we do use Spamhalter but still have to wade through the spambox each day as it is not 100%) and we are also getting the following error from every email we send to our customers who have hotmail:

550 DY-001 Mail rejected by Windows Live Hotmail for policy reasons. We
generally do not accept email from dynamic IP's as they are not typically
used to deliver unauthenticated SMTP e-mail to an Internet mail server.

We have a static IP with our ISP
The mydomain.co.uk has has it's own IP address (rather than a shared one).

 At the moment, all email is piped straight through to Mercury by the website hosting company.
The website/domain name hosting company provide Mailfoundry they suggest that all our email should go through their servers:
"For email to pass through our MailFoundry

appliance would mean the email would have to arrive on our server and

then you use POP mailbox to pull the email over to your mail server"

 Is this easy to do?
I have tried reading the Mercury manual but, to be honest very little of it means anything to me and the warnings about setting things up incorrectly frighten the life out of me but just to be able to stop the spam would be a huge bonus.

 Any help or information that anyone can give me would be much appreciated.
Thanks.
Lynn
PS Have just tried to buy a license but seems it is not enabled yet :(
PPS would be happy just to sort out the POP on Mercury first and try and sort the hotmail problem later as they do not seem related.

 

If you want email to pass through your ISP, you need to change from MercuryE to MercuryC, and also invoke MercuryD. These modules are well documented within the help system.

Licensing is available but David's site appears to be down at the moment. The link is: http://persephone.pmail.gen.nz/mlic

The HotMail problem most likely depends on that you haven't got a valid reverse lookup for your sending IP.

I know spamhalter, clamwall and graywall stops some spam as you've noticed. To get maintenance free products you most likely need to purchase commercial software for inbound smtp mail.

Thank you Peter, you have given me a start on where to look now if I do decide to go over to pop but I think I'll take up your suggestion and see if I can buy a Mailfoundry license for smtp.

 Yes the link has been down but I'll keep trying.

 I do have a valid reverse lookup (according to dnsstuff) but no ptr record. This was given to the hosting company but seems they haven't installed it but I'll get on to them.

Thanks again.

Lynn

[quote user="LynnL"]

Many years ago the Guy who installed our network also installed Mercury & Pegasus for us.

Apart from doing the upgrades we have never needed to alter a thing and everything has run perfectly except that the spam levels have continued to increase until we can no longer cope with them (we do use Spamhalter but still have to wade through the spambox each day as it is not 100%) and we are also getting the following error from every email we send to our customers who have hotmail:

550 DY-001 Mail rejected by Windows Live Hotmail for policy reasons. We
generally do not accept email from dynamic IP's as they are not typically
used to deliver unauthenticated SMTP e-mail to an Internet mail server.

We have a static IP with our ISP
The mydomain.co.uk has has it's own IP address (rather than a shared one).

 Any help or information that anyone can give me would be much appreciated.
Thanks.
Lynn
PS Have just tried to buy a license but seems it is not enabled yet :(
PPS would be happy just to sort out the POP on Mercury first and try and sort the hotmail problem later as they do not seem related.

[/quote]

The error message from hotmail implies that the reverse DNS lookup is showing a hostname that looks like it comes from a  randomly assigned IP address.  I can't verify that since you did not provide a real domain name.  You can ask your ISP to provide a PTR record pointing to your domain and that should fix the Hotmail problem.

As for the other stuff, it's your call but i do not like anyone  filtering my mail if it's not required.

[quote user="LynnL"] Thank you Peter, you have given me a start on where to look now if I do decide to go over to pop but I think I'll take up your suggestion and see if I can buy a Mailfoundry license for smtp. [/quote]

I have no experience with mailfoundry, they seem quite expensive. We run with Symantec Mail Services for SMTP (based on Brightmail antispam) which isn't run on special appliance - I think they offer 30 days trial as well. Here it currently reports 93,4% spam and viral infected emails. No one has so far complained that we remove "false-positives", but as soon as we turn filtering off - the phones begin to ring. Time ... is always precious.

There are most likely many other similar products out there, but whatever you choose I'm interested in your feedback later.

Hi Peter
Sorry for the long delay.
I have found Mailfoundry to be excellent with only 2 false positives in all the time I have now used it and these were quickly sorted by just clicking 'release' in the mailfoundry daily digest. They also have an online account reporting system and according to this, they have blocked huge amounts of virus infected emails destined for us.

For huge companies, I suppose Mailfoundry could be expensive but, for up to 10 email address on their hosted service it is currently free (and only a nominal amount when they start to charge) and very easy to setup plus very fast response from their customer service dept.

I now have only one problem, some spammers seem to be by-passing the mailfoundry settings, at first I thought it was that they had a long dns refresh delay but, even now we still get quite a few spam mails coming direct to us rather than through Mailfoundry.
My contact at Mailfoundry sent this:
"Hi, Some spammers have the time to live on their DNS servers set much longer
than would be normal and so some may still be seeing the old DNS records.
If this continues to be an issue I would recommend setting your mail server so it only accepts mail from the 66.**.**.*/24 block of IP
addresses as this should make it so the only external mail that will be allowed through is from the mailfoundry"

The problem now is that I do not know where to change the settings ie. in Mercury or in the W2k DNS settings?
If you know how to do this I would appreciate you letting me know.


 

Go to Configuration | MercuryS | Connection control and set a refuse of 0.0.0.1 - 255.255.255.255 and then an allow above it that accepts the entire IP address range of their mail servers.  This now will block anyone from sending mail to your system except the Mailfoundry hosts.

Hi Thomas

Thank you for your suggestion.

I did as you said but, when I tested this from yahoo I got a 520 error so I have had to remove the setting.
Any other help would be appreciated.
Lynn
PS The header in this thread is now incorrect as I never did have to change over to POP as I sorted out the problems with the hotmail refusals.
 

This would suggest that yahoo is resolving your MX to your server, not mailfoundry but the complete error message would shed more light.

This is exactly what you are trying to achieve (direct delivery being refused), but the only problem is your DNS MX is still pointing to your server. 

You really need to provide the exact error message and your actual domain name for us to help you out.  You have said the DNS was changed to mailfoundry servers but you have never provided the actual name for us to check this out.

Hi
Thanks for your input.
When I added the mailfoundry IP address range to allow and set everything else to disallow, (as per the info Thomas gave), on testing it from my yahoo account I got the following error.

Unable to deliver message to: <info (at) *s.co.uk>
Delivery failed for the following reason:
Unable to read SMTP greeting from 520 Connection not authorised from
this address.[212.159.66.110]

This has been a permanent failure.  No further delivery attempts will
be made.

I then set the server back to its previous configaration.
This means that most of the mail coming to the server goes through mailfoundry but, some mail by-passes the mail foundry servers and comes direct to the mailserver at 212.159.66.110
Please let me know if you need any further info.
Thanks
Lynn

Again, this is exactly what you are trying to achieve (direct delivery being refused).

Your problem is DNS caching. The records for mischiefkids.co.uk point to mailfoundry so the direct connections are coming from cached DNS records that you can do nothing about. Wait until the direct connections (from valid sources) stop then re-implement the block.  

[quote user="LynnL"]

Hi
Thanks for your input.
When I added the mailfoundry IP address range to allow and set everything else to disallow, (as per the info Thomas gave), on testing it from my yahoo account I got the following error.

Unable to deliver message to: <info (at) mischiefkids.co.uk>
Delivery failed for the following reason:
Unable to read SMTP greeting from 520 Connection not authorised from
this address.[212.159.66.110]

This has been a permanent failure.  No further delivery attempts will
be made.

I then set the server back to its previous configaration.
This means that most of the mail coming to the server goes through mailfoundry but, some mail by-passes the mail foundry servers and comes direct to the mailserver at 212.159.66.110
Please let me know if you need any further info.
Thanks
Lynn

<!-- type = message -->[/quote]

How have you set this up?  Are you sure you have allowed all of the mailfoundry  IP addresses?  That said this IP address 212.159.66.110 is not a mailfoundery IP address.

Answer Section:
    110.66.159.212.IN-ADDR.ARPA, PTR, mail.mischiefkids.co.uk
 

sot it appears to be working as specified.  Is this your own domain name and IP address.  Again, it would help a lot if you were to provide  the domain name and IP address of the system.

Hi again
Yes, 110.66.159.212.is the IP of our mail server and mail.*.co.uk is our own domain name.
I did set the controls to disallow everything as you said Thomas, and above the disallow I put the mailfoundry range of addresses.
As some valid mail could not then get through (e.g. coming from Yahoo) I had to remove the disallow.

It would seem that Dilbert is correct (thanks for that Dilbert) and I will just have to be patient and keep trying the disallow settings every few weeks.
Thank you for your input and confirming that my DNS settings are correct.
Lynn