无法接收客户的邮件

jackdaviv

公司的MD一切运行正常，但惟独有一个客户的邮件怎么都发不进来，有朋友跟我说是对方的邮件被服务器当成垃圾邮件了，但我把对方的主机添加到白名单还是没用，现附上日志，请大家帮我看下是什么原因，怎么解决，谢谢！
-----------------------------------------------------------------------------------------------------------
X-MDAV-Processed: abc.com, Mon, 15 Jun 2009 08:59:25 +0800
Return-path: <bnbt007@botong.com>
Received: from smtp.263xmail.com (smtp.263xmail.com [211.150.67.15])

by abc.com (abc.com)

(MDaemon PRO v10.0.0)

with ESMTP id md50000036927.msg

for <fan@abc.com>; Mon, 15 Jun 2009 08:59:24 +0800
Authentication-Results: abc.com

spf=neutral smtp.mail=bnbt007@botong.com;

x-ip-ptr=pass dns.ptr=smtp.263xmail.com (ip=211.150.67.15);

x-ip-helo=pass smtp.helo=smtp.263xmail.com (ip=211.150.67.15);

x-ip-mail=hardfail smtp.mail=bnbt007@botong.com (does not match 211.150.67.15)
X-Spam-Processed: abc.com, Mon, 15 Jun 2009 08:59:24 +0800

(not processed: spam filter heuristic analysis disabled)
X-MDOP-RefID: str=0001.0A150205.4A359CE8.0047,ss=1,pt=DBB_65838,fgs=0 (_st=1 _vt=0 _iwf=0)
X-MDPtrLookup-Result: pass dns.ptr=smtp.263xmail.com (ip=211.150.67.15) (abc.com)
X-MDHeloLookup-Result: pass smtp.helo=smtp.263xmail.com (ip=211.150.67.15) (abc.com)
X-MDMailLookup-Result: hardfail smtp.mail=bnbt007@botong.com (does not match 211.150.67.15) (abc.com)
X-MDDK-Result: neutral (abc.com)
X-MDDKIM-Result: neutral (abc.com)
X-MDDNSBL-Result: abc.com, Mon, 15 Jun 2009 08:59:24 +0800

zen.spamhaus.org returned result of 60.191.124.236

cblplus.anti-spam.org.cn returned result of 60.191.124.236

bl.spamcop.net returned result of 60.191.124.236
X-Rcpt-To: fan@abc.com
X-MDRcpt-To: fan@abc.com
X-MDRemoteIP: 211.150.67.15
X-Return-Path: bnbt007@botong.com
X-Envelope-From: bnbt007@botong.com
X-MDaemon-Deliver-To: fan@abc.com
Received: from smtp1.263xmail.com (localhost [127.0.0.1])

by smtp3.263xmail.com (Postfix) with ESMTP id 36D8F9747A

for <fan@abc.com>; Mon, 15 Jun 2009 08:59:18 +0800 (CST)
X-ABS-CHECKED:1
X-KSVirus-check:1
Received: from Lenov02927600 (localhost [127.0.0.1])

by smtp1.263xmail.com (Postfix) with ESMTP id F373A165EF1

for <fan@abc.com>; Mon, 15 Jun 2009 08:59:17 +0800 (CST)
X-SENDER-IP: 122.227.149.250
X-LOGIN-NAME: bnbt007@botong.com
X-ATTACHMENT-NUM: 0
X-SENDER: bnbt007@botong.com
Received: from Lenov02927600 (unknown [122.227.149.250])

by smtp1.263xmail.com (Postfix) whith ESMTP id 199727WJ09G;

Mon, 15 Jun 2009 08:59:17 +0800 (CST)
Date: Mon, 15 Jun 2009 08:59:18 +0800
From: "celia" <bnbt007@botong.com>
To: "S2M-Graham Fan" <fan@abc.com>
Subject: PO21497/21485/21495 shipping mark and barcode
X-mailer: Foxmail 5.0 [cn]
Mime-Version: 1.0
Content-Type: multipart/alternative;

boundary="=====003_Dragon345012412166_====="
Message-ID: <1211773416.1245027558.263Mail.@localhost>

jenbabe

zen.spamhaus.org returned result of 60.191.124.236

cblplus.anti-spam.org.cn returned result of 60.191.124.236

bl.spamcop.net returned result of 60.191.124.236


rbl返回值有问题，应该是类似127.0.X.X的ip，所以你的邮件被直接rbl检测后就拦截了。
可能的原因是你mail服务器所用的dns是被劫持，也可能是你服务器中毒。
IP:60.191.124.236 是杭州电信的。

jackdaviv

附上SMTP-IN日志、反病毒引擎日志还有，Content-Filter日志（这里发现
Mon 2009-06-15 08:59:25: * Message matched rule: IFRAME vulnerability [Move to bad message queue]：是不是内容过滤器规则没通过，所以被仍入到坏队列，所以收不到邮件，但这个规则是系统默认的，没有改动过。

SMTP-IN

Mon 2009-06-15 08:59:21: Session 2271; child 1; thread 404
Mon 2009-06-15 08:59:19: Accepting SMTP connection from [211.150.67.15:15108]
Mon 2009-06-15 08:59:19: Performing PTR lookup (15.67.150.211.IN-ADDR.ARPA)
Mon 2009-06-15 08:59:20: *
D=15.67.150.211.IN-ADDR.ARPA TTL=(30) PTR=[smtp.263xmail.com]
Mon 2009-06-15 08:59:20: *
Gathering A records...
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.67.16]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.67.17]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.100.26]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.157.128.26]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.157.224.133]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.67.10]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.67.11]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.67.12]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.67.13]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.67.15]
Mon 2009-06-15 08:59:20: ---- End PTR results
Mon 2009-06-15 08:59:20: --> 220 abc.com ESMTP MDaemon 10.0.0; Mon, 15 Jun 2009 08:59:20 +0800
Mon 2009-06-15 08:59:20: <-- EHLO smtp.263xmail.com
Mon 2009-06-15 08:59:20: Performing IP lookup (smtp.263xmail.com)
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.67.16]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.67.17]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.100.26]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.157.128.26]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.157.224.133]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.67.10]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.67.11]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.67.12]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.67.13]
Mon 2009-06-15 08:59:20: *
D=smtp.263xmail.com TTL=(3) A=[211.150.67.15]
Mon 2009-06-15 08:59:20: ---- End IP lookup results
Mon 2009-06-15 08:59:20: --> 250-abc.com Hello smtp.263xmail.com, pleased to meet you
Mon 2009-06-15 08:59:20: --> 250-ETRN
Mon 2009-06-15 08:59:20: --> 250-AUTH=LOGIN
Mon 2009-06-15 08:59:20: --> 250-AUTH LOGIN CRAM-MD5
Mon 2009-06-15 08:59:20: --> 250-8BITMIME
Mon 2009-06-15 08:59:20: --> 250 SIZE 0
Mon 2009-06-15 08:59:20: <-- MAIL FROM:<bnbt007@botong.com> SIZE=8117
Mon 2009-06-15 08:59:20: Performing IP lookup (chinabotong.com)
Mon 2009-06-15 08:59:20: *
P=010 S=000 D=chinabotong.com TTL=(60) MX=[mx01.263xmail.com] {211.157.224.130}
Mon 2009-06-15 08:59:20: ---- End IP lookup results
Mon 2009-06-15 08:59:20: Performing SPF lookup (chinabotong.com / 211.150.67.15)
Mon 2009-06-15 08:59:20: *
Result: none; no SPF record in DNS
Mon 2009-06-15 08:59:20: ---- End SPF results
Mon 2009-06-15 08:59:20: --> 250 <bnbt007@botong.com>, Sender ok
Mon 2009-06-15 08:59:20: <-- RCPT TO:<graham.fan@abc.com>
Mon 2009-06-15 08:59:20: Performing DNS-BL lookup (211.150.67.15 - connecting IP)
Mon 2009-06-15 08:59:20: *
zen.spamhaus.org - failed
Mon 2009-06-15 08:59:20: *
cblplus.anti-spam.org.cn - failed
Mon 2009-06-15 08:59:21: *
bl.spamcop.net - failed
Mon 2009-06-15 08:59:21: ---- End DNS-BL results
Mon 2009-06-15 08:59:21: --> 250 <graham.fan@abc.com>, Recipient ok
Mon 2009-06-15 08:59:21: <-- DATA
Mon 2009-06-15 08:59:21: Creating temp file (SMTP): d:\mdaemon\queues\temp\md50000111235.tmp
Mon 2009-06-15 08:59:21: --> 354 Enter mail, end with <CRLF>.<CRLF>
Mon 2009-06-15 08:59:21: Message size: 8117 bytes
Mon 2009-06-15 08:59:21: Performing DKIM lookup
Mon 2009-06-15 08:59:21: *
File: d:\mdaemon\queues\temp\md50000111235.tmp
Mon 2009-06-15 08:59:21: *
Message-ID: 1211773416.1245027558.263Mail.@localhost
Mon 2009-06-15 08:59:21: *
Result: neutral
Mon 2009-06-15 08:59:21: ---- End DKIM results
Mon 2009-06-15 08:59:21: Performing DomainKeys lookup (Sender: bnbt007@botong.com)
Mon 2009-06-15 08:59:21: *
File: d:\mdaemon\queues\temp\md50000111235.tmp
Mon 2009-06-15 08:59:21: *
Message-ID: 1211773416.1245027558.263Mail.@localhost
Mon 2009-06-15 08:59:21: *
Querying for policy: chinabotong.com
Mon 2009-06-15 08:59:21: *
Querying: _domainkey.chinabotong.com ...
Mon 2009-06-15 08:59:21: *
DNS: *
Name server reports domain name unknown
Mon 2009-06-15 08:59:21: *
Result: neutral
Mon 2009-06-15 08:59:21: ---- End DomainKeys results
Mon 2009-06-15 08:59:21: Passing message through AntiVirus (Size: 8117)...
Mon 2009-06-15 08:59:21: *
Message is clean (no viruses found)
Mon 2009-06-15 08:59:21: ---- End AntiVirus results
Mon 2009-06-15 08:59:21: Passing message through Outbreak Protection...
Mon 2009-06-15 08:59:21: *
Message-ID: 1211773416.1245027558.263Mail.@localhost
Mon 2009-06-15 08:59:21: *
Reference-ID: str=0001.0A150205.4A359CE8.0047,ss=1,pt=DBB_65838,fgs=0
Mon 2009-06-15 08:59:21: *
Virus result: 0 - Clean
Mon 2009-06-15 08:59:21: *
Spam result: 1 - Clean
Mon 2009-06-15 08:59:21: *
IWF result: 0 - Clean
Mon 2009-06-15 08:59:21: ---- End Outbreak Protection results
Mon 2009-06-15 08:59:21: Message creation successful: d:\mdaemon\queues\inbound\md50000036927.msg
Mon 2009-06-15 08:59:21: --> 250 Ok, message saved <Message-ID: 1211773416.1245027558.263Mail.@localhost>
Mon 2009-06-15 08:59:21: <-- QUIT




Antivirus

Mon 2009-06-15 08:59:25: SecurityPlus AntiVirus processing d:\mdaemon\queues\local\md50000095199.msg...
Mon 2009-06-15 08:59:25: * Message return-path: bnbt007@botong.com
Mon 2009-06-15 08:59:25: * Message from: bnbt007@botong.com
Mon 2009-06-15 08:59:25: * Message to: graham.fan@abc.com
Mon 2009-06-15 08:59:25: * Message subject: PO21497/21485/21495 shipping mark and barcode
Mon 2009-06-15 08:59:25: * Message ID: <1211773416.1245027558.263Mail.@localhost>
Mon 2009-06-15 08:59:25: Start SecurityPlus AntiVirus results
Mon 2009-06-15 08:59:25: * Total attachments scanned
: 3 (including multipart/alternatives and message body)
Mon 2009-06-15 08:59:25: * Total attachments infected
: 0
Mon 2009-06-15 08:59:25: * Total attachments disinfected: 0
Mon 2009-06-15 08:59:25: * Total errors while scanning
: 0
Mon 2009-06-15 08:59:25: * Total attachments removed
: 0
Mon 2009-06-15 08:59:25: End of SecurityPlus AntiVirus results
Mon 2009-06-15 08:59:25: ----------
Mon 2009-06-15 08:59:25: SecurityPlus AntiVirus processing d:\mdaemon\queues\local\md50000095200.msg...
Mon 2009-06-15 08:59:25: * Message return-path: bnbt007@botong.com
Mon 2009-06-15 08:59:25: * Message from: bnbt007@botong.com
Mon 2009-06-15 08:59:25: * Message to: adminsupport@abc.com
Mon 2009-06-15 08:59:25: * Message subject: (Archive Copy) PO21497/21485/21495 shipping mark and barcode
Mon 2009-06-15 08:59:25: * Message ID: <1211773416.1245027558.263Mail.@localhost>
Mon 2009-06-15 08:59:25: Start SecurityPlus AntiVirus results
Mon 2009-06-15 08:59:25: * Total attachments scanned
: 3 (including multipart/alternatives and message body)
Mon 2009-06-15 08:59:25: * Total attachments infected
: 0
Mon 2009-06-15 08:59:25: * Total attachments disinfected: 0
Mon 2009-06-15 08:59:25: * Total errors while scanning
: 0
Mon 2009-06-15 08:59:25: * Total attachments removed
: 0
Mon 2009-06-15 08:59:25: End of SecurityPlus AntiVirus results
Mon 2009-06-15 08:59:25: ----------

Content Filter

Mon 2009-06-15 08:59:25: Content Filter processing d:\mdaemon\queues\local\md50000095199.msg...
Mon 2009-06-15 08:59:25: * Message return-path: bnbt007@botong.com
Mon 2009-06-15 08:59:25: * Message from: bnbt007@botong.com
Mon 2009-06-15 08:59:25: * Message to: graham.fan@abc.com
Mon 2009-06-15 08:59:25: * Message subject: PO21497/21485/21495 shipping mark and barcode
Mon 2009-06-15 08:59:25: * Message ID: <1211773416.1245027558.263Mail.@localhost>
Mon 2009-06-15 08:59:25: Start Content Filter results
Mon 2009-06-15 08:59:25: * Message matched rule: SYSTEM - MDaemon INBOUND archive rule
Mon 2009-06-15 08:59:25: * Message matched rule: IFRAME vulnerability [Move to bad message queue]
Mon 2009-06-15 08:59:25: * Matched 2 of 4 active rules
Mon 2009-06-15 08:59:25: End of Content Filter results
Mon 2009-06-15 08:59:25: ----------
Mon 2009-06-15 08:59:25: Content Filter processing d:\mdaemon\queues\local\md50000095200.msg...
Mon 2009-06-15 08:59:25: * Message return-path: bnbt007@botong.com
Mon 2009-06-15 08:59:25: * Message from: bnbt007@botong.com
Mon 2009-06-15 08:59:25: * Message to: adminsupport@abc.com
Mon 2009-06-15 08:59:25: * Message subject: (Archive Copy) PO21497/21485/21495 shipping mark and barcode
Mon 2009-06-15 08:59:25: * Message ID: <1211773416.1245027558.263Mail.@localhost>
Mon 2009-06-15 08:59:25: Start Content Filter results
Mon 2009-06-15 08:59:25: * Message matched rule: SYSTEM - MDaemon INBOUND archive rule
Mon 2009-06-15 08:59:25: * Message matched rule: IFRAME vulnerability [Move to bad message queue]
Mon 2009-06-15 08:59:25: * Matched 2 of 4 active rules
Mon 2009-06-15 08:59:25: End of Content Filter results
Mon 2009-06-15 08:59:25: ----------

jackdaviv

删掉会不会收到很多垃圾邮件，或者出现其他问题