Briefly, we have a number of mail rules in server configuration documents which deny mail based on certain criteria. We are seeing a surprisingly high number of hits at the moment (but there could be a perfectly reasonable explanation).
Is there any way to log which rule is being triggered rather than the generic message we have now “SMTP Server: Error storing received message; message rejected by mail rule”?
TIA
Subject: How to tell which mail rule is causing a rejection
If you’re using don’t accept or don’t deliver + send NDR, then it is just going to use the standard NDR.
A workaround would be to set up the rules to use “move to database”. Then set up an agent/agents in that database/s which mimic the rules and send their own “pseudo-NDR” stating which policy was violated. Or, if you only need to know internally, instead of sending notice, just have the agent move it to a specific folder.
Subject: I think I have the answer
We have rules set up which deny mail when the phrase used by the connecting host in HELO/EHLO is the public IP address or fully qualified name of our local SMTP host.
I was a little concerned because the hit rate was so high, so wanted to see which of these rules was being triggered. But an answer of sorts (or at least a clue) is here…
http://www.unixwiz.net/blog/archives/001173.html
This says that at least one variant of Netsky (and I guess some other prevalent mass mailing worms which have their own SMTP engines) uses the target domain as the HELO phrase.
So this is probably just virus activity that is causing the high hit rate.