Deferred, but good.. I think..

ipguru99 · Post by **ipguru99** » Sun Jan 13, 2008 9:36 pm

Hello all,
I got another customer on Zimbra, they couldn't be happier. I am trying to teach them the things to look for on a day-to-day admin basis so they can take this over. I have done a couple of small installations so I know most of the 'gotchas'.
On this particular install, they have been up and running for a couple of days. I primed the Bayes pump by having a really bad (spam) account of mine pulled from pop3 and I imported an admin of the old system's sent folder and did a CLI for ham on that. So they are thrilled so far with the spam performance!
What I can't figure out (and this isn't happening at all at the other customers), is why I am getting SO much deferred mail. Not good (or anything I care about) deferred mail, but total spam. We did the cut for them on Friday, so it has only been running for 48 hours, but mail is coming in and going out just fine, but I have over 200 deferred messages? Not to anyone on this system or from anyone on this system?? Here is an example:

[QUOTE]Sender:mailer-daemon

From host: localhost

From domain: undefined

From IP: 127.0.0.1

Recipients: bidz.com@escalatingconfocal.com

To domain: escalatingconfocal.com

Content filter: undefined

Size: 3460

Reason: Connect to mx1.ecogreenacid.com, Server refused to talk to me, too many connections...[/QUOTE]

So obviously I understand the error.. too many connections. But why or who is sending this email and how did it end up on my server (there are no users sending email this weekend.. so a user isn't sending this)? Are they trying to use me as a relay? I just can't figure this out. I have looked through the forums here and I did a search on Origin Ip and most people complain about not being able to send anything when you do a search for 'deferred'.. but that is not the case (regular 'good' email travels just fine..). One poster said it will sit in there for 4 days.. another said there isn't any limit of emails that can be in there.
I am sure it would slow things down if there were a bunch, but if I got 200 (I looked through the first 75 deferred on day one and deleted them because it was the same kind of crap) for 4 days, would 800 in there be bad?
Sorry, lots of questions in there, but I have never seen this... and I run it for three customers and for my own business as well.
Thanks! And to everyone here, it took me a year to get these people to switch to Zimbra and so far, the admins LOVE it! Keep up the great work!
bk

ipguru99 · Post by **ipguru99** » Tue Jan 15, 2008 2:54 pm

Nobody knows this? I can't find it anywhere in searching. There isn't a default for how long something will sit in the deferred queue?

jholder · Post by **jholder** » Tue Jan 15, 2008 3:09 pm

What version of Zimbra are you running?

ipguru99 · Post by **ipguru99** » Tue Jan 15, 2008 3:18 pm

Thanks! 4.5.10 on Ubuntu 6.06.1.
I have done a couple of the tweaks mentioned on the wiki, but nothing drastic. My dns is fine (/etc/hosts and nslookups have been checked..). Everything is actually great, I am just trying to explain to this customer why every day we are adding around 75 emails to the deferred queue that aren't going anywhere...
Thanks again for answering!

16128deepblue · Post by **16128deepblue** » Thu Jan 17, 2008 2:36 am

[quote user="ipguru99"]Thanks! 4.5.10 on Ubuntu 6.06.1.
I have done a couple of the tweaks mentioned on the wiki, but nothing drastic. My dns is fine (/etc/hosts and nslookups have been checked..). Everything is actually great, I am just trying to explain to this customer why every day we are adding around 75 emails to the deferred queue that aren't going anywhere...
Thanks again for answering![/QUOTE]
Hi,
maybe this is backscatter (Postfix Backscatter Howto). Could it be, that some of the users forward the mail to a some other account? Or some users POP accounts to another mailserver (we have customers using a exchange Server which POPs all their accounts from our Zimbra and using our Zimbra as outbound relay). In that case, the downstream Mailserver could generate bounces to forged senders and relay these bounces through zimbra.

These bounce messages get stuck in the deferred queue for some days....
Regards

Thomas

ipguru99 · Post by **ipguru99** » Thu Jan 17, 2008 8:14 am

Thanks! That could definitely be what some of this is. I will look into what else I can do to keep them from getting into the deferred queue... I see in a quick look at the doc that there are some other steps.
Does anyone know how long things will sit in the deferred queue with Zimbra? My real concern is that I leave this to the customer and come back a week later and they haven't deleted any and they have 1,000 messages in the deferred queue. It would be really easy to say, "Messages are purged after 4 days..."
Thanks for responding,