In dying need of help with MTA setup

[borngunners]

I am unable to send email to external domain and have some mails deferred. I am able to send email internally and can receive emails from external domain. Please help.

Thanks

[LaFong]

Look for errors in /var/log/maillog.

[borngunners]

after looking into the mail log file, this is a portion of the error message:

Jan 11 04:36:07 zimbra postfix/smtp[2976]: warning: relayhost configuration problem
Jan 11 04:36:07 zimbra postfix/smtp[2976]: 01DA118CA646: to=<bcooper4@terpmail.umd.edu>, relay=none, delay=1147, delays=1147/0.01/0/0, dsn=4.3.5, status=deferred (mail for hea
Jan 11 04:36:07 zimbra postfix/smtp[2974]: 5A09418CA642: to=<mhopkinsonumd@gmail.com>, relay=none, delay=4569, delays=4569/0.02/0/0, dsn=4.3.5, status=deferred (mail for healt
Jan 11 04:36:07 zimbra postfix/smtp[2971]: 69FAB18CA647: to=<mhopkinsonumd@gmail.com>, relay=none, delay=1002, delays=1002/0.01/0/0, dsn=4.3.5, status=deferred (mail for healt
Jan 11 04:36:07 zimbra postfix/smtp[2972]: 52AC318CA643: to=<mhopkinsonumd@gmail.com>, relay=none, delay=4520, delays=4520/0.01/0/0, dsn=4.3.5, status=deferred (mail for healt
Jan 11 04:36:53 zimbra postfix/smtpd[2546]: connect from n54.k45.ru[93.188.208.54]
Jan 11 04:36:54 zimbra postfix/smtpd[2546]: NOQUEUE: reject: RCPT from n54.k45.ru[93.188.208.54]: 550 5.1.1 <gandy@in.need.help>: Recipient address rejected: User unknown in
Jan 11 04:36:54 zimbra postfix/smtpd[2546]: lost connection after RCPT from n54.k45.ru[93.188.208.54]
Jan 11 04:36:54 zimbra postfix/smtpd[2546]: disconnect from n54.k45.ru[93.188.208.54]
Jan 11 04:37:24 zimbra postfix/smtpd[2546]: warning: 182.18.138.223: hostname static-182.18.138-223.ctrls.in verification failed: Name or service not known
Jan 11 04:37:24 zimbra postfix/smtpd[2546]: connect from unknown[182.18.138.223]
Jan 11 04:37:25 zimbra postfix/smtpd[2546]: E0A9B18CA5E4: client=unknown[182.18.138.223]
Jan 11 04:37:26 zimbra postfix/cleanup[2589]: E0A9B18CA5E4: message-id=<20120110232923.3D3254CEF40948A1@amazonjr.net>
Jan 11 04:37:27 zimbra postfix/qmgr[32414]: E0A9B18CA5E4: from=<info@amazonjr.net>, size=9560, nrcpt=1 (queue active)
Jan 11 04:37:27 zimbra postfix/smtpd[3437]: connect from maile-ad.linkedin.com[69.28.147.167]
Jan 11 04:37:27 zimbra postfix/smtpd[2546]: disconnect from unknown[182.18.138.223]
Jan 11 04:37:28 zimbra postfix/smtpd[3437]: 02D2018CA648: client=maile-ad.linkedin.com[69.28.147.167]
Jan 11 04:37:28 zimbra postfix/cleanup[2589]: 02D2018CA648: message-id=<1481812382.91900391.1326274240600.JavaMail.app @ela4-app0106.prod>
Jan 11 04:37:28 zimbra postfix/qmgr[32414]: 02D2018CA648: from=<m-vmFCEFRN4cc7lrWAsXHyLLguv1DPf7W0K7Xt2LRX4MR7fu95Kz kEjdg4ityDs4@bounce.linkedin.com>, size=59414, nrcpt=1 (que
Jan 11 04:37:28 zimbra postfix/smtpd[2597]: connect from localhost.localdomain[127.0.0.1]
Jan 11 04:37:28 zimbra postfix/smtpd[2597]: E93A118CA649: client=localhost.localdomain[127.0.0.1]
Jan 11 04:37:28 zimbra postfix/cleanup[2589]: E93A118CA649: message-id=<20120110232923.3D3254CEF40948A1@amazonjr.net>
Jan 11 04:37:28 zimbra postfix/qmgr[32414]: E93A118CA649: from=<info@amazonjr.net>, size=10315, nrcpt=1 (queue active)
Jan 11 04:37:28 zimbra postfix/smtpd[2597]: disconnect from localhost.localdomain[127.0.0.1]
Jan 11 04:37:28 zimbra postfix/smtp[2590]: E0A9B18CA5E4: to=<harris@in.need.help>, relay=127.0.0.1[127.0.0.1]:10024, delay=3.9, delays=2/0/0/1.9, dsn=2.0.0, status=sent (250
Jan 11 04:37:28 zimbra postfix/qmgr[32414]: E0A9B18CA5E4: removed
Jan 11 04:37:29 zimbra postfix/lmtp[2598]: E93A118CA649: to=<harris@in.need.help>, relay=zimbra.in.need.help[192.8.26.167]:7025, delay=0.21, delays=0.04/0/0/0.17, dsn=2.1
Jan 11 04:37:29 zimbra postfix/qmgr[32414]: E93A118CA649: removed
Jan 11 04:37:33 zimbra postfix/smtpd[3437]: disconnect from maile-ad.linkedin.com[69.28.147.167]
Jan 11 04:37:36 zimbra postfix/smtpd[2597]: connect from localhost.localdomain[127.0.0.1]
Jan 11 04:37:36 zimbra postfix/smtpd[2597]: 946C018CA5E4: client=localhost.localdomain[127.0.0.1]
Jan 11 04:37:36 zimbra postfix/cleanup[2589]: 946C018CA5E4: message-id=<1481812382.91900391.1326274240600.JavaMail.app @ela4-app0106.prod>
Jan 11 04:37:36 zimbra postfix/qmgr[32414]: 946C018CA5E4: from=<m-vmFCEFRN4cc7lrWAsXHyLLguv1DPf7W0K7Xt2LRX4MR7fu95Kz kEjdg4ityDs4@bounce.linkedin.com>, size=60425, nrcpt=1 (que
Jan 11 04:37:36 zimbra postfix/smtpd[2597]: disconnect from localhost.localdomain[127.0.0.1]
Jan 11 04:37:36 zimbra postfix/smtp[3454]: 02D2018CA648: to=<bod@in.need.help>, relay=127.0.0.1[127.0.0.1]:10024, delay=9.3, delays=1/0/0/8.3, dsn=2.0.0, status=sent (25
Jan 11 04:37:36 zimbra postfix/qmgr[32414]: 02D2018CA648: removed
Jan 11 04:37:36 zimbra postfix/lmtp[2598]: 946C018CA5E4: to=<bod@in.need.help>, relay=zimbra.in.need.help[192.8.26.167]:7025, delay=0.13, delays=0.05/0/0/0.08, dsn=2.
Jan 11 04:37:36 zimbra postfix/qmgr[32414]: 946C018CA5E4: removed
Jan 11 04:38:05 zimbra zmmailboxdmgr[3723]: status requested
Jan 11 04:38:05 zimbra zmmailboxdmgr[3723]: status OK
Jan 11 04:39:38 zimbra postfix/smtpd[3922]: connect from omp.email.kohls.com[12.130.139.186]
Jan 11 04:39:39 zimbra postfix/smtpd[3922]: 1C66318CA5E4: client=omp.email.kohls.com[12.130.139.186]
Jan 11 04:39:39 zimbra postfix/cleanup[3929]: 1C66318CA5E4: message-id=<0.0.63.8CB.1CCD043FBF98AFC.0@omp.email.kohls.c om>
Jan 11 04:39:39 zimbra postfix/qmgr[32414]: 1C66318CA5E4: from=<kohls.3425@envfrm.rsys2.com>, size=22018, nrcpt=1 (queue active)

[LaFong]

Originally Posted by borngunners

after looking into the mail log file, this is a portion of the error message:

Jan 11 04:36:07 zimbra postfix/smtp[2976]: warning: relayhost configuration problem
Jan 11 04:36:07 zimbra postfix/smtp[2976]: 01DA118CA646:  to=<bcooper4@terpmail.umd.edu>, relay=none, delay=1147,  delays=1147/0.01/0/0, dsn=4.3.5, status=deferred (mail for hea

Your log snippet leaves out the rest of the error after "deferred". Has your network setup changed? Did you alter your Postfix config?

[h. g.]

One thing I'm seeing in the error message:

Jan 11 04:37:26 zimbra postfix/cleanup[2589]: E0A9B18CA5E4: message-id=<20120110232923.3D3254CEF40948A1@amazonjr.net>

Jan 11 04:37:27 zimbra postfix/qmgr[32414]: E0A9B18CA5E4: from=<info@amazonjr.net>, size=9560, nrcpt=1 (queue active)

That e-mail address: info@amazonjr.net ..is associated with, at a minimum, a straight user/pass ID theft. At a maximum, depending on the attachment that comes with the message, a potential download of either the Zeus trojan or the Blackhole Trojan/exploit.

This scam/exploit apparently went out yesterday, 1/10.

Just something else to check .. like an AV scan.

h.g.

[borngunners]

Yes my network setup has changed. I have managed to resolve the issue temporarily by relaying outgoing messages through my backup email server. My goal was to setup the MTA without relaying no messages to any other server. Is that possible?

[h. g.]

I'll have to let somebody a whole lot smarter on these issues answer your question. I was just pointing out the e-mail address and the association with possible malware.

[LaFong]

Originally Posted by borngunners

Yes my network setup has changed. I have managed to resolve the issue temporarily by relaying outgoing messages through my backup email server. My goal was to setup the MTA without relaying no messages to any other server. Is that possible?

Sure. Have you set up your DNS A, MX, PTR records properly? What is the relayhost setting in /opt/zimbra/postfix/conf/main.cf? Ordinarily, it should be:

relayhost =

In other words, it should be set to null, if you're not relaying though another server. This can also be set in the admin gui, in Server settings->MTA tab.