InstantForum.NET v4.1.4Ipswitch Forumshttp://forums.ipswitch.com/forums@ipswitch.comSun, 07 Sep 2008 00:58:16 GMT20http://forums.ipswitch.com/Topic41044-10-1.aspxAn update to my previous post is that when using connection filtering the DNS BLs work fine, but the verify mail from, verify helo/ehlo, and the perform reverse DNS lookup features all seem to fail the system.<P>I am running IMail 8.15, and when I ran 8.15 on W2K Advanced Server with a much slower machine (Athlon 3200+ with 1GB RAM) I did not get the NTDLL.dll SMTPD32.exe failures when running the verify and revdns connection filters, but after upgrading to a much faster Athlon X2 6400+ with 4GB RAM running on a Windows 2003 Server (x64) I have these limitations with these filters.</P><P>My theories (yes, I have more than one) ...</P><P>1. The new faster system is processing more data than the SMTPD32.exe can handle, particularly when thses filters are enabled, causing some sort of buffer issue.</P><P>2. Imail 8.15 is not as stable with Windows 2003 Server, particularly, the x64 bit version.</P><P>Incidentally, the verify and revdns connection filters induced crashes occur even when the server is running at off peak times. If I check all three, even when the server is under light load (off peak) the SMTP service will crash, in a very short time. If I check just one, it will take longer, but eventually crash.</P><P>A side effect to this problem is that the number of smd files in the spool becomes quite large.</P><P>As a side note, I have considered these issues to also be related to DNS performance. I have also experimented with running a private secondary DNS server on the mail server itself to reduce I/O with the Primary DNS server. This DNS server allows recursion using it's root servers (which I have confirmed to be all up-to-date) and pulls the hosted domain information from the primary DNS server. Also, since my public primary and secondary DNS servers are set to not permit recursion IMail does not work well with them, since IMail requires a recursive DNS server to resolve all the mail going in and out and through the server.</P><P>Something else that had no effect on the smtp / connection filter crash issue is my recent DNS implementation of SPF (v=spf1 a mx ?all), simply by adding a text entry. This has had a great impact on reducing "backscatter" that comes from spammers spoofing my customers valid email addresses to pass certain validation filters. This has reduced the load on my mail server, but had not impact on the issue of this post.Thu, 24 Apr 2008 08:31:04 GMTskikayakerhttp://forums.ipswitch.com/Topic41044-10-1.aspxThank you for your diligence in working this through.Thu, 17 Apr 2008 05:14:41 GMTJohn Thttp://forums.ipswitch.com/Topic41044-10-1.aspxRegarding SMTPd32.exe crashing:<P>I have just spent the last four weeks of my life babysitting this issue :) And I have discovered the following ...</P><P>I discovered that enabling verify helo/ehlo, OR REVDNS, or Mailfrom all caused the SMTP to crash WHEN rules.ima included these x-imail-spam headers to forward email to the spambox or NUL.</P><P>After trying one at a time, all at a time, it did not change the crash pattern. There are no known issues with the speed of DNS resolving.</P><P>CONCLUSION:<BR>I have enabled ALL connection filters without a problem after removing the x-imail-spam headers that included VALHELO, MAILFROM, or VALREVDNS from the rules.ima file. I am using the IMFILTER utility to propagate the rules to the top directories of each domain, and distribute the .fwd files to each user, making sure to not re-apply the rule for the spambox email address by removing the .fwd files from that user account.</P><P>I set my delete after number of tries setting to 2. Therefore, I have no stats on what is being deleted other than to say any mail failing the VALHELO, MAILFROM, VALREVDNS, or is flagged by my six DNSBLs the email will be deleted.Tue, 15 Apr 2008 11:06:33 GMTskikayakerhttp://forums.ipswitch.com/Topic41044-10-1.aspxtry these<br><br> bl.spamcop.net DNS * bl.spamcop.net Yes No <br> dnsbl-1.uceprotect.net DNS * dnsbl-1.uceprotect.net Yes No <br> dnsbl-3.uceprotect.net DNS * dnsbl-3.uceprotect.net Yes No <br> psbl.surriel.com DNS * psbl.surriel.com Yes No <br> zen.spamhaus.org <br>Tue, 11 Mar 2008 10:42:41 GMTjergerhttp://forums.ipswitch.com/Topic41044-10-1.aspxif dnsrbl's responds swift you should have no problem</P><P>03:06 23:59 SMTPD(7742029000002a91) [00001304] &lt;smtp.soko.nl&gt; BLACKLIST: <STRONG><FONT color=#dd3333>retrying service</FONT></STRONG> (dynablock.njabl.org:*:dynablock.njabl.org)<BR></P><P>This made my server stall.. messages like 421 Server to busy</P><P>messages not arriving</P><P>I heard from support that there is a 21 sec time out on DNS lookups (for dnsrbls) much to long imho..Fri, 07 Mar 2008 08:38:40 GMTRichardFhttp://forums.ipswitch.com/Topic41044-10-1.aspxgosh same here... tw telecom's server started failing pings 3 out of 4 attempts which would crash our server.<br><br>remeber to change it at the NIC level and at the smtp service level.<br><br>if you have an internal win2k3 dns server... you could tyr pointing to the local address as well. for one of our servers this helps alot.Wed, 20 Feb 2008 15:18:20 GMTjergerhttp://forums.ipswitch.com/Topic41044-10-1.aspxGood news. Several changes, and I haven't had a crash of SMTPd32.exe in almost 20 hours.<br><br>I contacted support, and they gave me some new Dlls to install. We also removed the all the blacklists, since timeouts on the blacklists seemed to be correlated with the crashes.<br><br>Another problem we found was that our ISP had changed DNS servers without telling us. That meant that the mail server was having to use the secondary DNS instead of the primary DNS. This might have also caused longer lookup times that may/may not have caused the crashes.<br><br>Thanks to the Ipswitch tech support. They did a great job helping.<br><br>Wed, 20 Feb 2008 10:22:57 GMTplunenfeldhttp://forums.ipswitch.com/Topic41044-10-1.aspxwell try only two blacklists... zen and spamcop...<br><br>btw 9.23 sucks... they have new beta files that do not crash. you might have to wait until the next release. i would call support. they will tell you to get rid of your blacklists... but then you will get lots of spam. kind of a crappy solution.<br><br>so try 2 lists. do not use any "block all ips from this country" blacklists.Tue, 19 Feb 2008 12:02:42 GMTjergerhttp://forums.ipswitch.com/Topic41044-10-1.aspxHello</P><P>Try this..</P><P>don´t use black list check... </P><P>I belive that black list checks take too much time and that crashes smtp</P><P>Jukka <BR>Tue, 19 Feb 2008 10:14:05 GMTJukkajhttp://forums.ipswitch.com/Topic41044-10-1.aspxYesterday we had seventeen (17) crashes of the SMTPd32.exe. Please help!Tue, 19 Feb 2008 10:08:29 GMTplunenfeldhttp://forums.ipswitch.com/Topic41044-10-1.aspxWe are receiving the following message up to EIGHTEEN (18) per day:<br>Faulting application SMTPd32.exe, version 7.11.30.0, faulting module msvcr80.dll, version 8.0.50727.1433, fault address 0x00011eeb.<br><br>This is causing files to be orphaned in the spool folder (up to 2,500), and causing messages to be lost/not delivered to users. <br><br>Can anyone help?! We discovered this problem on Fri (2/15/08) afternoon, but the Ipswitch tech support is closed during the weekend and the U.S. holiday today (Monday 2/18/08).<br><br>We are running:<br>- version 9.23<br>- Premium Antivirus, powered by Symantec <br>- StarEngine Premium Filter (Anti-spam)<br><br><br>We have read some earlier posts, and made the following settings changes, but it has not helped so far:<br><br>- changed SMTP timeout in the registry to 20 seconds<br>- using only 2 black lists<br>- SMTP service set to restart after 1 minute in Windows Services<br><br>SMTP Settings:<br>- Tries before return to sender: 20<br>- Max tries for NULL senders: 1 (Delete after max tries is CHECKED)<br>- Max Invalid Recipients Per Session: 2<br>- Check Valid Sender is UNCHECKED<br>- Auto Deny Possible Hack Attempts is CHECKED<br>- Max Connections: 50<br>- Max Threads: 60<br>Mon, 18 Feb 2008 12:21:53 GMTplunenfeld