Sendmail and Unexpected EOM
ka at pacific.net
Mon Nov 5 15:46:20 GMT 2007
Quentin Campbell wrote:
>> -----Original Message-----
>> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
>> bounces at lists.mailscanner.info] On Behalf Of Scott Silva
>> Sent: 29 October 2007 17:55
>> To: mailscanner at lists.mailscanner.info
>> Subject: Sendmail and Unexpected EOM
>> I'm getting a lot of collect: premature EOM: unexpected close
>> errors from certain servers, and a google gives me much conflicting
>> Running CentOS 4 and current stable MailScanner.
>> I have tried decreasing the MTU on the external interface, and only
>> succeeded in stopping all traffic. Tried disabling window scaling, and
>> that also had no effect. Could the default be to set no-fragment on
>>from CentOS 4?
> What evidence do you have that it is your end rather than the sending
> site, or somewhere in between, that is at fault?
> Although a 'traceroute' does not always work (because ICMP is disabled
> at gateways) it may indicate some large delay on the route between the
> sender and you.
> I also see the 'premature EOM' messages here and have assumed them to be
> a problem for the sender, not us.
> Where they occur after we have returned 'REJECT' status for all
> recipients after a DNSBL lookup, I assume that because the sender is a
> spammer they do not bother to close down the SMTP connection with a
> RESET or QUIT and simply move on to start a new SMTP connection with
> another target.
Recently, I saw this happening to mail from one of our hosting
webservers. The only indication in the mail log on the mailscanner box
was the 'EOM' message, and the only indication in the maillog on the
hosting server was deferred, stat='broken pipe' and some nasty TLS errors.
I discovered when running 'sendmail -v -q' on the hosting box that the
email was being blocked by milter-link, which does rhsdnsbl lookups on
links in the email, but nameservers were timing out trying to lookup
hostnames in form submissions containing hundreds of spam urls, many of
which were lame delegations, or broken in other ways. I'd post some, but
they wouldn't get very far. :-)
It can be hard to track these down!
More information about the MailScanner