Strange problem!!

[sulfuric]

1.Sorry for my english
2.I have a perfect setup on ubuntu breeze system
my dns on godday grupaprop.net my server name is omaxserver omaxserver.xxxxxxx.net, all functions of server work perfectly lasts months smtp, pop3, etc... but now can't recive mails, when some body try to send me a mail the postfix return this error

3.
This is the Postfix program at host omaxserver.xxxxxx.net.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The Postfix program

<web10_info@omaxserver.xxxxxxx.net> (expanded from <info@xxxxxxx.org>):
host smtp.secureserver.net[64.202.166.12] said: 553 Bogus helo lh
62.14.87.233. <http://unblock.secureserver.net/?ip=62.14.87.*> (in reply to
RCPT TO command)


4. And extrange mail.log

May 29 23:59:03 omaxserver postfix/master[16108]: daemon started -- version 2.2.4, configuration /etc/postfix
May 30 00:32:23 omaxserver postfix/qmgr[16113]: 07A7660406C: from=<>, size=28591, nrcpt=1 (queue active)
May 30 00:32:54 omaxserver postfix/smtp[16713]: connect to repairnet.biz[69.39.226.204]: Connection timed out (port 25)
May 30 00:32:54 omaxserver postfix/smtp[16713]: 07A7660406C: to=<simon@repairnet.biz>, relay=none, delay=166044, status=deferred (connect to repairnet.biz[69.39.226.204]: Connection timed out)
May 30 00:49:03 omaxserver postfix/qmgr[16113]: B33AB604076: from=<>, size=28574, nrcpt=1 (queue active)
May 30 00:49:34 omaxserver postfix/smtp[16978]: connect to mail.pradella.biz[212.77.229.254]: Connection timed out (port 25)
May 30 00:49:34 omaxserver postfix/smtp[16978]: B33AB604076: to=<henry@pradella.biz>, relay=none, delay=41646, status=deferred (connect to mail.pradella.biz[212.77.229.254]: Connection timed out)
May 30 01:05:43 omaxserver postfix/qmgr[16113]: 9DDE7604072: from=<>, size=28591, nrcpt=1 (queue active)
May 30 01:05:44 omaxserver postfix/smtp[17187]: warning: numeric domain name in resource data of MX record for quitsmokeless.biz: 64.202.167.73
May 30 01:06:14 omaxserver postfix/smtp[17187]: connect to 64.202.167.73[64.202.167.73]: Connection timed out (port 25)
May 30 01:06:14 omaxserver postfix/smtp[17187]: 9DDE7604072: to=<richard@quitsmokeless.biz>, relay=none, delay=81681, status=deferred (connect to 64.202.167.73[64.202.167.73]: Connection timed out)
May 30 01:35:09 omaxserver postfix/master[16108]: reload configuration /etc/postfix
May 30 01:35:18 omaxserver authdaemond.plain: restarting authdaemond children
May 30 01:35:18 omaxserver authdaemond.plain: modules="authpam", daemons=5
May 30 01:35:21 omaxserver postfix/master[16108]: terminating on signal 15
May 30 01:36:34 omaxserver authdaemond.plain: modules="authpam", daemons=5
May 30 01:36:37 omaxserver postfix/master[8937]: daemon started -- version 2.2.4, configuration /etc/postfix
May 30 01:36:47 omaxserver postfix/master[8937]: terminating on signal 15
May 30 01:36:47 omaxserver postfix/master[9758]: daemon started -- version 2.2.4, configuration /etc/postfix
May 30 01:36:57 omaxserver postfix/master[9758]: reload configuration /etc/postfix
May 30 01:36:57 omaxserver postfix/qmgr[9958]: 07A7660406C: from=<>, size=28591, nrcpt=1 (queue active)
May 30 01:36:57 omaxserver postfix/qmgr[9958]: 9DDE7604072: from=<>, size=28591, nrcpt=1 (queue active)
May 30 01:36:57 omaxserver postfix/qmgr[9958]: B33AB604076: from=<>, size=28574, nrcpt=1 (queue active)
May 30 01:36:57 omaxserver postfix/smtp[9965]: warning: numeric domain name in resource data of MX record for quitsmokeless.biz: 64.202.167.73
May 30 01:37:27 omaxserver postfix/smtp[9965]: connect to 64.202.167.73[64.202.167.73]: Connection timed out (port 25)
May 30 01:37:27 omaxserver postfix/smtp[9965]: 9DDE7604072: to=<richard@quitsmokeless.biz>, relay=none, delay=83554, status=deferred (connect to 64.202.167.73[64.202.167.73]: Connection timed out)
May 30 01:37:27 omaxserver postfix/smtp[9963]: connect to repairnet.biz[69.39.226.204]: Connection timed out (port 25)
May 30 01:37:27 omaxserver postfix/smtp[9963]: 07A7660406C: to=<simon@repairnet.biz>, relay=none, delay=169917, status=deferred (connect to repairnet.biz[69.39.226.204]: Connection timed out)
May 30 01:37:27 omaxserver postfix/smtp[9966]: connect to mail.pradella.biz[212.77.229.254]: Connection timed out (port 25)

5.I have only 4 dominds created
www.xxxxxxxx.com
www.xxxxxxxx.org
www.heroesdelplastico.com
www.tintoreriagelsy.com

but xxxxx.biz appear in mail log ????!!!!!!!

6. Sorry for that large post and thanks for help.

p.d: it's possible that my host was hacked and it's use for spam and secureserver.net blocks my host???

[falko]

Originally Posted by sulfuric

p.d: it's possible that my host was hacked and it's use for spam and secureserver.net blocks my host???

Please check this like this: http://www.howtoforge.com/faq/1_38_en.html

Also check if your server is listed on a spam blacklist. That might be the reason why other systems refuse the connection to your system.

[sulfuric]

I was install thi programs for prevent attacks, I had executed the chkrootkit and rkhunter and it hadn't detected nothing, i had change my ip for try to repair that problem but now the error change for this:

This is the Postfix program at host omaxserver.grupaprop.net.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The Postfix program

<web9_ramon@omaxserver.xxxxxxxx.net> (expanded from <ramon@xxxxxx.com>):
host smtp.secureserver.net[64.202.166.12] said: 553 Attack detected from
pool 85.55.11.22. <http://unblock.secureserver.net/?ip=85.55.11.*> (in
reply to RCPT TO command)


thanks a lot

sincerely.

[falko]

Please check if you server is listed on any spam blacklist.

[sulfuric]

Where can i see this, and how??? by ip or by domind name??

[till]

For example:

http://www.nl.sorbs.net/lookup.shtml
http://www.spamcop.net

[sulfuric]

I look this at http://www.nl.sorbs.net/lookup.shtml

Dynamic IP Space (LAN, Cable, DSL & Dial Ups)
Netblock: 85.52.0.0/14 (85.52.0.0-85.55.255.255)
Record Created: Sun May 14 11:47:30 2006 GMT
Record Updated: Sun May 14 11:47:30 2006 GMT
Additional Information: Dynamic/Generic IP/rDNS address, use your ISPs mail server or get rDNS set to indicate static assignment.
Currently active and flagged to be published in DNS
If you wish to request a delisting please do so through the Support System.

but my ip is 85.55.8.* and Netblock: 85.52.0.0/14 (85.52.0.0-85.55.255.255) It's blocked my server ??

[falko]

Yes, it's blocked, because it's in this range: 85.52.0.0-85.55.255.255.

Additional Information: Dynamic/Generic IP/rDNS address, use your ISPs mail server or get rDNS set to indicate static assignment.

The reason seems to be that you have a dynamic IP address.

[sulfuric]

Can't i use dinamic ip for my server?? have this any solution??

Thanks.

[falko]

Most blacklists block dynamic IP addresses.
You can use another email server for relaying your domains: http://www.howtoforge.com/forums/sho...ight=relayhost