Logout

Alt-N Discussion Groups > MDaemon Discussion Groups > MDaemon Support > Archive > Backscatter and Aliases

 [F] Alt-N Discussion Groups  / MDaemon Discussion Groups  / MDaemon Support  / Archive  /

Backscatter and Aliases

When an asynchronous bounce message is received by my mail server, it seems like the processing is different if the bounce is coming to an alias instead of an actual mailbox address. And it also seems like the processing is different from one even to another.

Is this the expected behavior? See these excerpts from my -all log (with name and domain edited) listed below.

In the first example, the message was processed through backscatter protection and delivered to the mailbox. This example seemed to work correctly.

In the second case, it seems like the alias was substituted, but the backscatter check was not performed.

In the third case, it seems like the backscatter protection was performed, and the alias swap was not performed. In my system, without the alias swap, the backscatter protection will fail.

It's not clear to me what causes case 2 versus case 3. And in my setup, I'd like to have the alias processing first, then backscatter protection applied, consistently every time.

Can anyone help me understand why the processing seems different in the two cases? And what I can do to cause it to happen the way I want?

Example 1:
Tue 2021-03-23 09:12:54.652: [230116] <-- RCPT TO:<prvs=1111cd8f54=Foo@MyDomain.com>
Tue 2021-03-23 09:12:54.653: [230116] Performing Backscatter Protection...
Tue 2021-03-23 09:12:54.653: [230116] * Address: prvs=1111cd8f54=Foo@MyDomain.com
Tue 2021-03-23 09:12:54.653: [230116] * Verifier: key=1 date=716 sha-1 hmac=cd8f54
Tue 2021-03-23 09:12:54.653: [230116] * Result: pass
Tue 2021-03-23 09:12:54.653: [230116] --- End Backscatter Protection
Tue 2021-03-23 09:12:54.653: [230116] --> 250 2.1.5 Recipient OK

Example 2:
Tue 2021-03-23 18:49:14.040: [231256] <-- RCPT TO:<prvs=111104275c=Bar@MyDomain.com>
Tue 2021-03-23 18:49:14.040: [231256] Bar@MyDomain.com is an alias for Bar-3@MyDomain.com
Tue 2021-03-23 18:49:14.041: [231256] --> 250 2.1.5 Recipient OK

Example 3:
Wed 2021-03-24 13:09:14.023: [232444] <-- RCPT TO:<prvs=111104275c=Bar@MyDomain.com>
Wed 2021-03-24 13:09:14.023: [232444] Performing Backscatter Protection...
Wed 2021-03-24 13:09:14.023: [232444] * Address: prvs=111104275c=Bar@MyDomain.com
Wed 2021-03-24 13:09:14.023: [232444] * Verifier: key=1 date=717 sha-1 hmac=8e6024
Wed 2021-03-24 13:09:14.023: [232444] * Result: fail
Wed 2021-03-24 13:09:14.023: [232444] * Reject: Yes
Wed 2021-03-24 13:09:14.023: [232444] --- End Backscatter Protection
Wed 2021-03-24 13:09:14.023: [232444] --> 550 5.1.1 Backscatter Protection detected an invalid or expired email address

Thanks,
Tom

  All MessagesOldest ItemsOlder ItemsNewer ItemsNewest Items

Arron Caruth - Mar 24, 2021 4:13 pm (#1 Total: 1)  

Guest User  

Photo of Author
Posts: 1
What version of MDaemon are you using?
 
Do you have any entries on the BackScatter White list?
 
Have you recently changed your backscatter keys?
 
So far I have not been able to reproduce any issues with backscatter processing.  Can you send me the full inbound SMTP transcript for each example along with a copy of your alias.dat, mdaemon.ini, and the batvxcpt.dat. Please send all the data to me privately at arron.caruth@mdaemon.com.
 
 
--
Arron Caruth
Vice President of Product Development
o: 817-601-3222    e: Arron.Caruth@mdaemon.com

MDaemon Technologies
Simple Secure Email
Visit us on www.mdaemon.com | Facebook | LinkedIn | YouTube
Sent using the MDaemon Email Server
 
On Wed, 24 Mar 2021 15:22:10 -0500, "lists-md-support@mdaemon.com (Tom Wood)" <lists-md-support@mdaemon.com> wrote:
When an asynchronous bounce message is received by my mail server, it seems like the processing is different if the bounce is coming to an alias instead of an actual mailbox address. And it also seems like the processing is different from one even to another.

Is this the expected behavior? See these excerpts from my -all log (with name and domain edited) listed below.

In the first example, the message was processed through backscatter protection and delivered to the mailbox. This example seemed to work correctly.

In the second case, it seems like the alias was substituted, but the backscatter check was not performed.

In the third case, it seems like the backscatter protection was performed, and the alias swap was not performed. In my system, without the alias swap, the backscatter protection will fail.

It's not clear to me what causes case 2 versus case 3. And in my setup, I'd like to have the alias processing first, then backscatter protection applied, consistently every time.

Can anyone help me understand why the processing seems different in the two cases? And what I can do to cause it to happen the way I want?

Example 1:
Tue 2021-03-23 09:12:54.652: [230116] <-- RCPT TO:<prvs=1111cd8f54=Foo@MyDomain.com>
Tue 2021-03-23 09:12:54.653: [230116] Performing Backscatter Protection...
Tue 2021-03-23 09:12:54.653: [230116] * Address: prvs=1111cd8f54=Foo@MyDomain.com
Tue 2021-03-23 09:12:54.653: [230116] * Verifier: key=1 date=716 sha-1 hmac=cd8f54
Tue 2021-03-23 09:12:54.653: [230116] * Result: pass
Tue 2021-03-23 09:12:54.653: [230116] --- End Backscatter Protection
Tue 2021-03-23 09:12:54.653: [230116] --> 250 2.1.5 Recipient OK

Example 2:
Tue 2021-03-23 18:49:14.040: [231256] <-- RCPT TO:<prvs=111104275c=Bar@MyDomain.com>
Tue 2021-03-23 18:49:14.040: [231256] Bar@MyDomain.com is an alias for Bar-3@MyDomain.com
Tue 2021-03-23 18:49:14.041: [231256] --> 250 2.1.5 Recipient OK

Example 3:
Wed 2021-03-24 13:09:14.023: [232444] <-- RCPT TO:<prvs=111104275c=Bar@MyDomain.com>
Wed 2021-03-24 13:09:14.023: [232444] Performing Backscatter Protection...
Wed 2021-03-24 13:09:14.023: [232444] * Address: prvs=111104275c=Bar@MyDomain.com
Wed 2021-03-24 13:09:14.023: [232444] * Verifier: key=1 date=717 sha-1 hmac=8e6024
Wed 2021-03-24 13:09:14.023: [232444] * Result: fail
Wed 2021-03-24 13:09:14.023: [232444] * Reject: Yes
Wed 2021-03-24 13:09:14.023: [232444] --- End Backscatter Protection
Wed 2021-03-24 13:09:14.023: [232444] --> 550 5.1.1 Backscatter Protection detected an invalid or expired email address

Thanks,
Tom
 
View/reply at Backscatter and Aliases
--MD-SUPPORT--------------------------------------------------------------
This list is for questions and discussion about MDAEMON. To unsubscribe 
from this mailing list send an email to md-support-unsubscribe@mdaemon.com .
--POWERED BY MDAEMON!-----------------------------------------------------

--------------------------------------------------------------------------
These forums are provided by MDaemon Technologies for user-to-user 
support and discussion.  MDaemon staff members may participate in the 
forums periodically but please recognize that this is not the official
method of receiving technical support. To receive personal technical 
support please use the form here:
http://www.mdaemon.com/Support/RequestSupport/
--------------------------------------------------------------------------

--MD-SUPPORT--------------------------------------------------------------
This list is for questions and discussion about MDAEMON. To unsubscribe 
from this mailing list send an email to md-support-unsubscribe@mdaemon.com .
--POWERED BY MDAEMON!-----------------------------------------------------

--------------------------------------------------------------------------
These forums are provided by MDaemon Technologies for user-to-user 
support and discussion.  MDaemon staff members may participate in the 
forums periodically but please recognize that this is not the official
method of receiving technical support. To receive personal technical 
support please use the form here:
http://www.mdaemon.com/Support/RequestSupport/
--------------------------------------------------------------------------



  All MessagesOldest ItemsOlder ItemsNewer ItemsNewest Items



 Content:

Read New | Search

 Guest:

Email to Admin



You are visiting as a Guest user.