Sendmail and Unexpected EOM

[Ken A]

Quentin Campbell wrote:
>> -----Original Message-----
>> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
>> bounces at lists.mailscanner.info] On Behalf Of Scott Silva
>> Sent: 29 October 2007 17:55
>> To: mailscanner at lists.mailscanner.info
>> Subject: Sendmail and Unexpected EOM
>>
>> I'm getting a lot of collect: premature EOM: unexpected close
>> errors from certain servers, and a google gives me much conflicting
>> info.
>>
>> Running CentOS 4 and current stable MailScanner.
>>
>>  I have tried decreasing the MTU on the external interface, and only
>> succeeded in stopping all traffic. Tried disabling window scaling, and
>> that also had no effect. Could the default be to set no-fragment on
> packets
>>from CentOS 4?
>> [snip]
> 
> Scott
> 
> What evidence do you have that it is your end rather than the sending
> site, or somewhere in between, that is at fault?
> 
> Although a 'traceroute' does not always work (because ICMP is disabled
> at gateways) it may indicate some large delay on the route between the
> sender and you.
> 
> I also see the 'premature EOM' messages here and have assumed them to be
> a problem for the sender, not us. 
> 
> Where they occur after we have returned 'REJECT' status for all
> recipients after a DNSBL lookup, I assume that because the sender is a
> spammer they do not bother to close down the SMTP connection with a
> RESET or QUIT and simply move on to start a new SMTP connection with
> another target.
> 
> Quentin   

Recently, I saw this happening to mail from one of our hosting 
webservers. The only indication in the mail log on the mailscanner box 
was the 'EOM' message, and the only indication in the maillog on the 
hosting server was deferred, stat='broken pipe' and some nasty TLS errors.

I discovered when running 'sendmail -v -q' on the hosting box that the 
email was being blocked by milter-link, which does rhsdnsbl lookups on 
links in the email, but nameservers were timing out trying to lookup 
hostnames in form submissions containing hundreds of spam urls, many of 
which were lame delegations, or broken in other ways. I'd post some, but 
they wouldn't get very far. :-)
It can be hard to track these down!

Ken

-- 
Ken Anderson
Pacific.Net